Edit tour

Windows Analysis Report
https://ayudamodelo200.com/?uid=829102

Overview

General Information

Sample URL:	https://ayudamodelo200.com/?uid=829102
Analysis ID:	1466755
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2468,i,7815768011067595301,10011362975349948554,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ayudamodelo200.com/?uid=829102" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /report/v4?s=ynoxncfqlBdAPnCHZjexezA3whilk4OQrXxQ8hM6QOiPMJSC3S0D1qbe1Hwk%2BBWizfSDrnmbBO4UavXfEKO3aL%2FMzPyJzz%2BS2ZhdID6VWfgd%2BENpVuo2Umcb2kQzAGlszENXlOQ%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 401Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: sets.json.0.dr	String found in binary or memory: https://24.hu
Source: sets.json.0.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.0.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.0.dr	String found in binary or memory: https://alice.tw
Source: sets.json.0.dr	String found in binary or memory: https://ambitionbox.com
Source: sets.json.0.dr	String found in binary or memory: https://autobild.de
Source: sets.json.0.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.0.dr	String found in binary or memory: https://bild.de
Source: sets.json.0.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.0.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.0.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.0.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.0.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.0.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.0.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.0.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.0.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.0.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.0.dr	String found in binary or memory: https://chennien.com
Source: sets.json.0.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.0.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.0.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.0.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.0.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.0.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.0.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.0.dr	String found in binary or memory: https://deere.com
Source: sets.json.0.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.0.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.0.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.0.dr	String found in binary or memory: https://een.be
Source: sets.json.0.dr	String found in binary or memory: https://efront.com
Source: sets.json.0.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.0.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.0.dr	String found in binary or memory: https://ella.sv
Source: sets.json.0.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.0.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.0.dr	String found in binary or memory: https://finn.no
Source: sets.json.0.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.0.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.0.dr	String found in binary or memory: https://gettalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.0.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.0.dr	String found in binary or memory: https://grid.id
Source: sets.json.0.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.0.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.0.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.0.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://hapara.com
Source: sets.json.0.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.global
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.0.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.0.dr	String found in binary or memory: https://hearty.app
Source: sets.json.0.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.0.dr	String found in binary or memory: https://hearty.me
Source: sets.json.0.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.0.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.0.dr	String found in binary or memory: https://hj.rs
Source: sets.json.0.dr	String found in binary or memory: https://hjck.com
Source: sets.json.0.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.0.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.0.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.0.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.0.dr	String found in binary or memory: https://intoday.in
Source: sets.json.0.dr	String found in binary or memory: https://iolam.it
Source: sets.json.0.dr	String found in binary or memory: https://ishares.com
Source: sets.json.0.dr	String found in binary or memory: https://jagran.com
Source: sets.json.0.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.0.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.0.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.0.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.0.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.0.dr	String found in binary or memory: https://libero.it
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.0.dr	String found in binary or memory: https://livechat.com
Source: sets.json.0.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.0.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.0.dr	String found in binary or memory: https://livemint.com
Source: sets.json.0.dr	String found in binary or memory: https://max.auto
Source: sets.json.0.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.0.dr	String found in binary or memory: https://meo.pt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.0.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.0.dr	String found in binary or memory: https://money.pl
Source: sets.json.0.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://nacion.com
Source: sets.json.0.dr	String found in binary or memory: https://naukri.com
Source: sets.json.0.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.co
Source: sets.json.0.dr	String found in binary or memory: https://nien.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.org
Source: sets.json.0.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.0.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.0.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.0.dr	String found in binary or memory: https://o2.pl
Source: sets.json.0.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.0.dr	String found in binary or memory: https://onet.pl
Source: sets.json.0.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.0.dr	String found in binary or memory: https://p106.net
Source: sets.json.0.dr	String found in binary or memory: https://p24.hu
Source: sets.json.0.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.0.dr	String found in binary or memory: https://player.pl
Source: sets.json.0.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.0.dr	String found in binary or memory: https://poalim.site
Source: sets.json.0.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.0.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.0.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.0.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://radio1.be
Source: sets.json.0.dr	String found in binary or memory: https://radio2.be
Source: sets.json.0.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://repid.org
Source: sets.json.0.dr	String found in binary or memory: https://reshim.org
Source: sets.json.0.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.0.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.0.dr	String found in binary or memory: https://samayam.com
Source: sets.json.0.dr	String found in binary or memory: https://sapo.io
Source: sets.json.0.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.0.dr	String found in binary or memory: https://shock.co
Source: sets.json.0.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.0.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.0.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.0.dr	String found in binary or memory: https://songshare.com
Source: sets.json.0.dr	String found in binary or memory: https://songstats.com
Source: sets.json.0.dr	String found in binary or memory: https://sporza.be
Source: sets.json.0.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.0.dr	String found in binary or memory: https://stripe.com
Source: sets.json.0.dr	String found in binary or memory: https://stripe.network
Source: sets.json.0.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.0.dr	String found in binary or memory: https://supereva.it
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.0.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.0.dr	String found in binary or memory: https://text.com
Source: sets.json.0.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.0.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.0.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.0.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.0.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://tvid.in
Source: sets.json.0.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.0.dr	String found in binary or memory: https://unotv.com
Source: sets.json.0.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.0.dr	String found in binary or memory: https://vrt.be
Source: sets.json.0.dr	String found in binary or memory: https://vwo.com
Source: sets.json.0.dr	String found in binary or memory: https://welt.de
Source: sets.json.0.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.dr	String found in binary or memory: https://wildix.com
Source: sets.json.0.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.0.dr	String found in binary or memory: https://wingify.com
Source: sets.json.0.dr	String found in binary or memory: https://wordle.at
Source: sets.json.0.dr	String found in binary or memory: https://wp.pl
Source: sets.json.0.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.0.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.0.dr	String found in binary or memory: https://ya.ru
Source: sets.json.0.dr	String found in binary or memory: https://zalo.me
Source: sets.json.0.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://zingmp3.vn

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 62077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62078 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_3108_195386981

Jump to behavior

Source: classification engine

Classification label: clean1.win@17/5@6/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2468,i,7815768011067595301,10011362975349948554,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ayudamodelo200.com/?uid=829102"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2468,i,7815768011067595301,10011362975349948554,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://ayudamodelo200.com/?uid=829102	0%	Avira URL Cloud	safe
https://ayudamodelo200.com/?uid=829102	1%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://wieistmeineip.de	0%	URL Reputation	safe
https://wieistmeineip.de	0%	URL Reputation	safe
https://mercadoshops.com.co	0%	URL Reputation	safe
https://gliadomain.com	0%	URL Reputation	safe
https://poalim.xyz	0%	URL Reputation	safe
https://mercadolivre.com	0%	URL Reputation	safe
https://reshim.org	0%	URL Reputation	safe
https://nourishingpursuits.com	0%	URL Reputation	safe
https://medonet.pl	0%	URL Reputation	safe
https://medonet.pl	0%	URL Reputation	safe
https://unotv.com	0%	URL Reputation	safe
https://mercadoshops.com.br	0%	URL Reputation	safe
https://zdrowietvn.pl	0%	URL Reputation	safe
https://songstats.com	0%	URL Reputation	safe
https://baomoi.com	0%	URL Reputation	safe
https://supereva.it	0%	URL Reputation	safe
https://supereva.it	0%	URL Reputation	safe
https://elfinancierocr.com	0%	URL Reputation	safe
https://elfinancierocr.com	0%	URL Reputation	safe
https://bolasport.com	0%	URL Reputation	safe
https://rws1nvtvt.com	0%	URL Reputation	safe
https://desimartini.com	0%	URL Reputation	safe
https://hearty.app	0%	URL Reputation	safe
https://hearty.gift	0%	URL Reputation	safe
https://hearty.gift	0%	URL Reputation	safe
https://mercadoshops.com	0%	URL Reputation	safe
https://mercadoshops.com	0%	URL Reputation	safe
https://heartymail.com	0%	URL Reputation	safe
https://heartymail.com	0%	URL Reputation	safe
https://p106.net	0%	URL Reputation	safe
https://p106.net	0%	URL Reputation	safe
https://radio2.be	0%	URL Reputation	safe
https://finn.no	0%	URL Reputation	safe
https://finn.no	0%	URL Reputation	safe
https://hc1.com	0%	URL Reputation	safe
https://kompas.tv	0%	URL Reputation	safe
https://mystudentdashboard.com	0%	URL Reputation	safe
https://songshare.com	0%	URL Reputation	safe
https://mercadopago.com.mx	0%	URL Reputation	safe
https://p24.hu	0%	URL Reputation	safe
https://p24.hu	0%	URL Reputation	safe
https://talkdeskqaid.com	0%	URL Reputation	safe
https://mercadopago.com.pe	0%	URL Reputation	safe
https://cardsayings.net	0%	URL Reputation	safe
https://mightytext.net	0%	URL Reputation	safe
https://pudelek.pl	0%	URL Reputation	safe
https://hazipatika.com	0%	URL Reputation	safe
https://joyreactor.com	0%	URL Reputation	safe
https://cookreactor.com	0%	URL Reputation	safe
https://wildixin.com	0%	URL Reputation	safe
https://joyreactor.cc	0%	Avira URL Cloud	safe
https://eworkbookcloud.com	0%	URL Reputation	safe
https://cognitiveai.ru	0%	URL Reputation	safe
https://nacion.com	0%	URL Reputation	safe
https://chennien.com	0%	URL Reputation	safe
https://chennien.com	0%	URL Reputation	safe
https://mercadopago.cl	0%	URL Reputation	safe
https://talkdeskstgid.com	0%	URL Reputation	safe
https://bonvivir.com	0%	URL Reputation	safe
https://carcostadvisor.be	0%	URL Reputation	safe
https://salemovetravel.com	0%	URL Reputation	safe
https://sapo.io	0%	URL Reputation	safe
https://wpext.pl	0%	URL Reputation	safe
https://nlc.hu	0%	Avira URL Cloud	safe
https://welt.de	0%	URL Reputation	safe
https://poalim.site	0%	URL Reputation	safe
https://blackrockadvisorelite.it	0%	URL Reputation	safe
https://cognitive-ai.ru	0%	URL Reputation	safe
https://cafemedia.com	0%	URL Reputation	safe
https://thirdspace.org.au	0%	URL Reputation	safe
https://mercadoshops.com.ar	0%	URL Reputation	safe
https://smpn106jkt.sch.id	0%	URL Reputation	safe
https://elpais.uy	0%	URL Reputation	safe
https://landyrev.com	0%	URL Reputation	safe
https://commentcamarche.com	0%	URL Reputation	safe
https://tucarro.com.ve	0%	URL Reputation	safe
https://rws3nvtvt.com	0%	URL Reputation	safe
https://eleconomista.net	0%	URL Reputation	safe
https://clmbtech.com	0%	URL Reputation	safe
https://standardsandpraiserepurpose.com	0%	URL Reputation	safe
https://24.hu	0%	Avira URL Cloud	safe
https://salemovefinancial.com	0%	URL Reputation	safe
https://text.com	0%	Avira URL Cloud	safe
https://mercadopago.com.br	0%	URL Reputation	safe
https://commentcamarche.net	0%	URL Reputation	safe
https://etfacademy.it	0%	URL Reputation	safe
https://mighty-app.appspot.com	0%	URL Reputation	safe
https://hj.rs	0%	URL Reputation	safe
https://hearty.me	0%	URL Reputation	safe
https://mercadolibre.com.gt	0%	URL Reputation	safe
https://timesinternet.in	0%	URL Reputation	safe
https://indiatodayne.in	0%	URL Reputation	safe
https://idbs-staging.com	0%	URL Reputation	safe
https://blackrock.com	0%	URL Reputation	safe
https://idbs-eworkbook.com	0%	URL Reputation	safe
https://mercadolibre.co.cr	0%	URL Reputation	safe
https://hjck.com	0%	URL Reputation	safe
https://vrt.be	0%	URL Reputation	safe
https://prisjakt.no	0%	URL Reputation	safe
https://kompas.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
ayudamodelo200.com	188.114.96.3	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wieistmeineip.de	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://mercadoshops.com.co	sets.json.0.dr	false	URL Reputation: safe	unknown
https://gliadomain.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://poalim.xyz	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadolivre.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://reshim.org	sets.json.0.dr	false	URL Reputation: safe	unknown
https://nourishingpursuits.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://medonet.pl	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://unotv.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.br	sets.json.0.dr	false	URL Reputation: safe	unknown
https://joyreactor.cc	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://zdrowietvn.pl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://johndeere.com	sets.json.0.dr	false		unknown
https://songstats.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://baomoi.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://supereva.it	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://elfinancierocr.com	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://bolasport.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://rws1nvtvt.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://desimartini.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hearty.app	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hearty.gift	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://mercadoshops.com	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://heartymail.com	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://nlc.hu	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://p106.net	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://radio2.be	sets.json.0.dr	false	URL Reputation: safe	unknown
https://finn.no	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://hc1.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://kompas.tv	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mystudentdashboard.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://songshare.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.mx	sets.json.0.dr	false	URL Reputation: safe	unknown
https://p24.hu	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://talkdeskqaid.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://24.hu	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadopago.com.pe	sets.json.0.dr	false	URL Reputation: safe	unknown
https://cardsayings.net	sets.json.0.dr	false	URL Reputation: safe	unknown
https://text.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mightytext.net	sets.json.0.dr	false	URL Reputation: safe	unknown
https://pudelek.pl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hazipatika.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://joyreactor.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://cookreactor.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://wildixin.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://eworkbookcloud.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://cognitiveai.ru	sets.json.0.dr	false	URL Reputation: safe	unknown
https://nacion.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://chennien.com	sets.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://mercadopago.cl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://talkdeskstgid.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://naukri.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://bonvivir.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://carcostadvisor.be	sets.json.0.dr	false	URL Reputation: safe	unknown
https://salemovetravel.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://sapo.io	sets.json.0.dr	false	URL Reputation: safe	unknown
https://wpext.pl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://welt.de	sets.json.0.dr	false	URL Reputation: safe	unknown
https://poalim.site	sets.json.0.dr	false	URL Reputation: safe	unknown
https://infoedgeindia.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://blackrockadvisorelite.it	sets.json.0.dr	false	URL Reputation: safe	unknown
https://cognitive-ai.ru	sets.json.0.dr	false	URL Reputation: safe	unknown
https://cafemedia.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://thirdspace.org.au	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.ar	sets.json.0.dr	false	URL Reputation: safe	unknown
https://smpn106jkt.sch.id	sets.json.0.dr	false	URL Reputation: safe	unknown
https://elpais.uy	sets.json.0.dr	false	URL Reputation: safe	unknown
https://landyrev.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://commentcamarche.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://tucarro.com.ve	sets.json.0.dr	false	URL Reputation: safe	unknown
https://rws3nvtvt.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://eleconomista.net	sets.json.0.dr	false	URL Reputation: safe	unknown
https://helpdesk.com	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadolivre.com.br	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://clmbtech.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://standardsandpraiserepurpose.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://salemovefinancial.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.br	sets.json.0.dr	false	URL Reputation: safe	unknown
https://commentcamarche.net	sets.json.0.dr	false	URL Reputation: safe	unknown
https://etfacademy.it	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mighty-app.appspot.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hj.rs	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hearty.me	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadolibre.com.gt	sets.json.0.dr	false	URL Reputation: safe	unknown
https://timesinternet.in	sets.json.0.dr	false	URL Reputation: safe	unknown
https://indiatodayne.in	sets.json.0.dr	false	URL Reputation: safe	unknown
https://idbs-staging.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://blackrock.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://idbs-eworkbook.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadolibre.co.cr	sets.json.0.dr	false	URL Reputation: safe	unknown
https://hjck.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://vrt.be	sets.json.0.dr	false	URL Reputation: safe	unknown
https://prisjakt.no	sets.json.0.dr	false	URL Reputation: safe	unknown
https://kompas.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://idbs-dev.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://wingify.com	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadolibre.cl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://player.pl	sets.json.0.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.ar	sets.json.0.dr	false	Avira URL Cloud: safe	unknown
https://mercadolibre.com.hn	sets.json.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	ayudamodelo200.com	European Union	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466755
Start date and time:	2024-07-03 11:03:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://ayudamodelo200.com/?uid=829102
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/5@6/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.212.131, 142.250.181.238, 108.177.15.84, 34.104.35.123, 40.127.169.103, 192.229.221.95, 20.166.126.56, 199.232.214.172, 20.3.187.198, 142.250.181.227, 2.19.126.137, 2.19.126.163, 172.217.18.99, 2.16.164.18, 2.16.164.123, 2.16.164.43, 2.16.164.25, 2.16.164.89, 2.16.164.81
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	low
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.0157277397082884
Encrypted:	false
SSDEEP:	48:p/hUI15ul1AdIj7ak+wsdrtra1cuUX0eYDAA98gkXhVdEXeXF:RnQQIj7aL11ayjgDzUSXYF
MD5:	4CBD807685B88243CC9EA3E4B60FE8FD
SHA1:	B02FB2A85ECBEA61424F9F14A32590FA2041C068
SHA-256:	8E9B53C9DCD85F58E64164CEAF4E327B52B88C98946EF1067B112B3C9BDC5FEE
SHA-512:	61B4E345BB2AE6BD8907C1D23582709D21089504B23497EC0906D489C096CE981F31CE0D2A2FB5B97E3E5B8D71B36ECC1B0393F55AE9007D36D790FA0B7C4161
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJ4UlFLT0lkOFU5ZzZhTTNZdnlieVpyUVcwUnRvM3JWeXpwaXQ3RjB4YUZnIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiQ1k5VzJMb3NsRkxMQmR3VFhVVFJNYnBxdnVSd2g1SVByT1ZsdG9BSUlFNCJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC42LjI2LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"JwsfiQnUWfcg0_PuT83D82ftcuaZ7vEsE_gMNDBSQyf3yMBDUgfqYwvvVFJbiHScUgP70t-BqLn6UQvY0bPu6W8oxy6WzuhegflPkarNrUr5BrTQ6T6GUQS5rb5hsCNYhNq2yDXc6JRw2fVbWfO5BsQ7VSpW8gO0oN3x3Ju-4Lr72tesPWvv_g2rkIXZLJHw4z1oZoKx1T2xY6ncKsFBbLnmD1gUSN3iAPPZ9zHg41a62wpcpb9uWRD

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.760377931718998
Encrypted:	false
SSDEEP:	3:SURcG3XcDLSHH33BU9DcWTNnn:SUj2SHHBCcWpnn
MD5:	C18D2397B5F0CFF55132B016467CA189
SHA1:	B60B8ADF7CABF73855BB17212831736FB0CB9F74
SHA-256:	5C3233CF05E64742B923685C31E5347CABA89B198FD4A1BBA59A9500C3C16082
SHA-512:	5EF20571951238C960107E0F16ABC3C5FDEAFC6CED038220835B5341C18CEB7C144FB2B2CCA1094C98C5900A15A1B1B1FA3357E011C492805567AE56DE57A1B6
Malicious:	false
Reputation:	low
Preview:	1.1848d9cb81709d6bb8a9612e1cba9fc97bb669c7ef81e2d11c0f937896df8e27

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.424014792499492
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1jvhg:F6VlM8aRWpqS16
MD5:	2C221BDCF91C9C07551499EE4CD15A6F
SHA1:	CBC3CE0947A3D61A7673A7729CA25DB7DB023336
SHA-256:	C5140A38877C53D83A68CDD8BF26F266B416D11B68DEB572CE98ADEC5D316858
SHA-512:	B77656D3D8598FB946F988906FBE4399B30C4B1DB284FA187C617ECAADA0C98EB913572D4361E43058A68D175E95451B05F875372669ACF98DD1BAAE59F8D9BE
Malicious:	false
Reputation:	low
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.6.26.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9068
Entropy (8bit):	4.624080015119112
Encrypted:	false
SSDEEP:	96:Mon4mvCSqX1gs9/BNKLcxbdmf56MFJtRTGXvcxNnuP+8qJq:v5CSqlTBkIVmtRTGXvcx0sq
MD5:	1D67EF4C7F90E1C8A620ADF17C6B6B13
SHA1:	E90E51A4A2305BCBD5016A3CA02CD14F77FDCBBA
SHA-256:	578DF0513FF5FA4080BDFC0B7094DCB444E09CD3AB3DCBC60165D1369681E2C1
SHA-512:	59B80B6A767EA95254CC64A5CDC17DF3ACC2F0B0E52416D86477109A1EDAB7479E0B1AEAB1FF793F8DC1807AAFAB38915A8267D4F31F618E99DF1AB07C095EE9
Malicious:	false
Reputation:	low
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://elpais.com.uy","

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 11:03:50.374689102 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 3, 2024 11:03:50.390311003 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 3, 2024 11:03:50.718415022 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 3, 2024 11:03:55.093965054 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.094016075 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.094146013 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.094254971 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.094373941 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.094439983 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.094449997 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.094449997 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.094660044 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.094680071 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.577090025 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.579186916 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.579209089 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.580221891 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.580322027 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.581273079 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.581351995 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.581433058 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.581449032 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.593899965 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.594242096 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.594310045 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.595336914 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.595438957 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.595786095 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.595860004 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.684833050 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.685230970 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:55.685302019 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 11:03:55.886976004 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:03:56.960804939 CEST	49718	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:03:56.960854053 CEST	443	49718	142.250.186.68	192.168.2.6
Jul 3, 2024 11:03:56.960918903 CEST	49718	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:03:56.961113930 CEST	49718	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:03:56.961133003 CEST	443	49718	142.250.186.68	192.168.2.6
Jul 3, 2024 11:03:57.607767105 CEST	443	49718	142.250.186.68	192.168.2.6
Jul 3, 2024 11:03:57.608011961 CEST	49718	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:03:57.608041048 CEST	443	49718	142.250.186.68	192.168.2.6
Jul 3, 2024 11:03:57.609150887 CEST	443	49718	142.250.186.68	192.168.2.6
Jul 3, 2024 11:03:57.609206915 CEST	49718	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:03:57.610424042 CEST	49718	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:03:57.610482931 CEST	443	49718	142.250.186.68	192.168.2.6
Jul 3, 2024 11:03:57.659471989 CEST	49718	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:03:57.659481049 CEST	443	49718	142.250.186.68	192.168.2.6
Jul 3, 2024 11:03:57.706351042 CEST	49718	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:03:57.889698982 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:03:57.889745951 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 3, 2024 11:03:57.889806032 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:03:57.891890049 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:03:57.891905069 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 3, 2024 11:03:58.691875935 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 3, 2024 11:03:58.691942930 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:03:58.703516960 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:03:58.703546047 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 3, 2024 11:03:58.703773975 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 3, 2024 11:03:58.710994005 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:03:58.711379051 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:03:58.711385012 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 3, 2024 11:03:58.711842060 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:03:58.756505013 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 3, 2024 11:03:58.887984991 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 3, 2024 11:03:58.888068914 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 3, 2024 11:03:58.888113976 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:03:58.888371944 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:03:58.888391972 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 3, 2024 11:03:59.159672976 CEST	49721	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:03:59.159717083 CEST	443	49721	184.28.90.27	192.168.2.6
Jul 3, 2024 11:03:59.159837961 CEST	49721	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:03:59.162372112 CEST	49721	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:03:59.162389040 CEST	443	49721	184.28.90.27	192.168.2.6
Jul 3, 2024 11:03:59.801686049 CEST	443	49721	184.28.90.27	192.168.2.6
Jul 3, 2024 11:03:59.801757097 CEST	49721	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:03:59.819190025 CEST	49721	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:03:59.819217920 CEST	443	49721	184.28.90.27	192.168.2.6
Jul 3, 2024 11:03:59.819520950 CEST	443	49721	184.28.90.27	192.168.2.6
Jul 3, 2024 11:03:59.874639034 CEST	49721	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:03:59.932977915 CEST	49721	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:03:59.976500034 CEST	443	49721	184.28.90.27	192.168.2.6
Jul 3, 2024 11:03:59.982034922 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 3, 2024 11:03:59.998848915 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 3, 2024 11:04:00.117810965 CEST	443	49721	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:00.117887974 CEST	443	49721	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:00.117935896 CEST	49721	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:00.117981911 CEST	49721	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:00.118000984 CEST	443	49721	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:00.118014097 CEST	49721	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:00.118020058 CEST	443	49721	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:00.164680004 CEST	49722	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:00.164719105 CEST	443	49722	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:00.164798975 CEST	49722	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:00.165415049 CEST	49722	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:00.165426970 CEST	443	49722	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:00.319670916 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 3, 2024 11:04:00.819325924 CEST	443	49722	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:00.819395065 CEST	49722	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:00.822918892 CEST	49722	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:00.822930098 CEST	443	49722	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:00.823172092 CEST	443	49722	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:00.825222015 CEST	49722	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:00.868494987 CEST	443	49722	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:01.111841917 CEST	443	49722	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:01.111908913 CEST	443	49722	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:01.111967087 CEST	49722	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:01.188579082 CEST	49722	443	192.168.2.6	184.28.90.27
Jul 3, 2024 11:04:01.188597918 CEST	443	49722	184.28.90.27	192.168.2.6
Jul 3, 2024 11:04:02.024620056 CEST	443	49705	173.222.162.64	192.168.2.6
Jul 3, 2024 11:04:02.024727106 CEST	49705	443	192.168.2.6	173.222.162.64
Jul 3, 2024 11:04:05.870345116 CEST	49723	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:05.870388985 CEST	443	49723	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:05.870462894 CEST	49723	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:05.870999098 CEST	49723	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:05.871018887 CEST	443	49723	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:06.667675972 CEST	443	49723	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:06.667789936 CEST	49723	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:06.674506903 CEST	49723	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:06.674530983 CEST	443	49723	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:06.674720049 CEST	443	49723	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:06.678149939 CEST	49723	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:06.678360939 CEST	49723	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:06.678369045 CEST	443	49723	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:06.678808928 CEST	49723	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:06.720504999 CEST	443	49723	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:06.854639053 CEST	443	49723	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:06.854746103 CEST	443	49723	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:06.854804039 CEST	49723	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:06.855065107 CEST	49723	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:06.855087996 CEST	443	49723	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:07.524718046 CEST	443	49718	142.250.186.68	192.168.2.6
Jul 3, 2024 11:04:07.524796009 CEST	443	49718	142.250.186.68	192.168.2.6
Jul 3, 2024 11:04:07.524876118 CEST	49718	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:04:08.562129021 CEST	49718	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:04:08.562170982 CEST	443	49718	142.250.186.68	192.168.2.6
Jul 3, 2024 11:04:10.499299049 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:10.499366999 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:10.499530077 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:10.627595901 CEST	49716	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:10.627629995 CEST	443	49716	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:18.339967012 CEST	49728	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:18.340010881 CEST	443	49728	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:18.340080976 CEST	49728	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:18.341449976 CEST	49728	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:18.341459036 CEST	443	49728	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:19.132963896 CEST	443	49728	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:19.133379936 CEST	49728	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:19.140369892 CEST	49728	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:19.140382051 CEST	443	49728	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:19.140595913 CEST	443	49728	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:19.144970894 CEST	49728	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:19.145132065 CEST	49728	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:19.145132065 CEST	49728	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:19.145137072 CEST	443	49728	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:19.188509941 CEST	443	49728	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:19.316189051 CEST	443	49728	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:19.316277981 CEST	443	49728	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:19.317473888 CEST	49728	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:19.336047888 CEST	49728	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:19.336067915 CEST	443	49728	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:34.491442919 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:34.491513968 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:34.491566896 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:34.493103027 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:34.493123055 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:34.556476116 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:34.556590080 CEST	443	49730	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:34.556685925 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:34.557677031 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:34.557715893 CEST	443	49730	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:34.748889923 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:34.748914957 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:34.748986959 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:34.751857042 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:34.751869917 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:35.022314072 CEST	443	49730	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.023204088 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.023257971 CEST	443	49730	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.024828911 CEST	443	49730	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.024902105 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.033216953 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.033459902 CEST	443	49730	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.033474922 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.075862885 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.075884104 CEST	443	49730	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.122700930 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.155780077 CEST	443	49730	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.155858040 CEST	443	49730	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.155921936 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.156717062 CEST	49730	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.156744003 CEST	443	49730	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.157871008 CEST	49732	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.157898903 CEST	443	49732	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.158035040 CEST	49732	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.158504009 CEST	49732	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.158519983 CEST	443	49732	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.210129023 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:35.212378979 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:35.212404013 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:35.212713003 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:35.213126898 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:35.213184118 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:35.215138912 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:35.260499954 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:35.615052938 CEST	443	49732	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.615566015 CEST	49732	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.615596056 CEST	443	49732	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.615931988 CEST	443	49732	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.617357969 CEST	49732	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.617418051 CEST	443	49732	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.617918968 CEST	49732	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.660506964 CEST	443	49732	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.746644020 CEST	443	49732	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.747091055 CEST	443	49732	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.747106075 CEST	49732	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.747132063 CEST	443	49732	35.190.80.1	192.168.2.6
Jul 3, 2024 11:04:35.747160912 CEST	49732	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:35.747205973 CEST	49732	443	192.168.2.6	35.190.80.1
Jul 3, 2024 11:04:37.694878101 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:37.694912910 CEST	443	49733	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:37.695039034 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:37.695637941 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:37.695651054 CEST	443	49733	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:38.715585947 CEST	443	49733	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:38.715714931 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:38.717744112 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:38.717752934 CEST	443	49733	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:38.718041897 CEST	443	49733	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:38.720079899 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:38.720079899 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:38.720103979 CEST	443	49733	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:38.720308065 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:38.760505915 CEST	443	49733	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:38.894238949 CEST	443	49733	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:38.894486904 CEST	443	49733	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:38.894942045 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:38.895688057 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:38.895688057 CEST	49733	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:04:38.895703077 CEST	443	49733	40.115.3.253	192.168.2.6
Jul 3, 2024 11:04:54.685986996 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:54.686052084 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:54.686337948 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:54.686784983 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 3, 2024 11:04:54.686804056 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 3, 2024 11:04:54.960707903 CEST	62075	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:04:54.965513945 CEST	53	62075	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:54.965589046 CEST	62075	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:04:54.965653896 CEST	62075	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:04:54.972201109 CEST	53	62075	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:55.423772097 CEST	53	62075	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:55.424633026 CEST	62075	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:04:55.432723045 CEST	53	62075	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:55.432790995 CEST	62075	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:04:57.005012989 CEST	62077	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:04:57.005065918 CEST	443	62077	142.250.186.68	192.168.2.6
Jul 3, 2024 11:04:57.005206108 CEST	62077	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:04:57.006386042 CEST	62077	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:04:57.006406069 CEST	443	62077	142.250.186.68	192.168.2.6
Jul 3, 2024 11:04:57.639015913 CEST	443	62077	142.250.186.68	192.168.2.6
Jul 3, 2024 11:04:57.639331102 CEST	62077	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:04:57.639360905 CEST	443	62077	142.250.186.68	192.168.2.6
Jul 3, 2024 11:04:57.639698029 CEST	443	62077	142.250.186.68	192.168.2.6
Jul 3, 2024 11:04:57.640042067 CEST	62077	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:04:57.640104055 CEST	443	62077	142.250.186.68	192.168.2.6
Jul 3, 2024 11:04:57.685286045 CEST	62077	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:05:03.718390942 CEST	62078	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:05:03.718421936 CEST	443	62078	40.115.3.253	192.168.2.6
Jul 3, 2024 11:05:03.718503952 CEST	62078	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:05:03.719135046 CEST	62078	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:05:03.719149113 CEST	443	62078	40.115.3.253	192.168.2.6
Jul 3, 2024 11:05:04.537451029 CEST	443	62078	40.115.3.253	192.168.2.6
Jul 3, 2024 11:05:04.537795067 CEST	62078	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:05:04.541423082 CEST	62078	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:05:04.541430950 CEST	443	62078	40.115.3.253	192.168.2.6
Jul 3, 2024 11:05:04.541659117 CEST	443	62078	40.115.3.253	192.168.2.6
Jul 3, 2024 11:05:04.549905062 CEST	62078	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:05:04.549905062 CEST	62078	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:05:04.549931049 CEST	443	62078	40.115.3.253	192.168.2.6
Jul 3, 2024 11:05:04.560126066 CEST	62078	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:05:04.600502968 CEST	443	62078	40.115.3.253	192.168.2.6
Jul 3, 2024 11:05:04.720649958 CEST	443	62078	40.115.3.253	192.168.2.6
Jul 3, 2024 11:05:04.720729113 CEST	443	62078	40.115.3.253	192.168.2.6
Jul 3, 2024 11:05:04.720863104 CEST	62078	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:05:04.721270084 CEST	62078	443	192.168.2.6	40.115.3.253
Jul 3, 2024 11:05:04.721287012 CEST	443	62078	40.115.3.253	192.168.2.6
Jul 3, 2024 11:05:07.568053961 CEST	443	62077	142.250.186.68	192.168.2.6
Jul 3, 2024 11:05:07.568253994 CEST	443	62077	142.250.186.68	192.168.2.6
Jul 3, 2024 11:05:07.568310976 CEST	62077	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:05:08.564326048 CEST	62077	443	192.168.2.6	142.250.186.68
Jul 3, 2024 11:05:08.564373970 CEST	443	62077	142.250.186.68	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 11:03:53.453062057 CEST	53	60890	1.1.1.1	192.168.2.6
Jul 3, 2024 11:03:53.454649925 CEST	53	58830	1.1.1.1	192.168.2.6
Jul 3, 2024 11:03:54.677900076 CEST	53	52924	1.1.1.1	192.168.2.6
Jul 3, 2024 11:03:55.062654972 CEST	49556	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:03:55.062980890 CEST	58498	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:03:55.078974962 CEST	53	49556	1.1.1.1	192.168.2.6
Jul 3, 2024 11:03:55.124769926 CEST	53	58498	1.1.1.1	192.168.2.6
Jul 3, 2024 11:03:56.952505112 CEST	59286	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:03:56.952610016 CEST	58671	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:03:56.959600925 CEST	53	58671	1.1.1.1	192.168.2.6
Jul 3, 2024 11:03:56.960083961 CEST	53	59286	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:11.695720911 CEST	53	59382	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:25.059775114 CEST	53	54391	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:30.774713039 CEST	53	59103	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:34.534604073 CEST	51409	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:04:34.534943104 CEST	52482	53	192.168.2.6	1.1.1.1
Jul 3, 2024 11:04:34.542587042 CEST	53	52482	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:34.542637110 CEST	53	51409	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:52.809432983 CEST	53	59621	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:53.918467045 CEST	53	49866	1.1.1.1	192.168.2.6
Jul 3, 2024 11:04:54.960082054 CEST	53	52052	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 3, 2024 11:03:55.125135899 CEST	192.168.2.6	1.1.1.1	c233	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 11:03:55.062654972 CEST	192.168.2.6	1.1.1.1	0xdcd	Standard query (0)	ayudamodelo200.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:03:55.062980890 CEST	192.168.2.6	1.1.1.1	0x5d51	Standard query (0)	ayudamodelo200.com	65	IN (0x0001)	false
Jul 3, 2024 11:03:56.952505112 CEST	192.168.2.6	1.1.1.1	0x4ad9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:03:56.952610016 CEST	192.168.2.6	1.1.1.1	0xc28e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 3, 2024 11:04:34.534604073 CEST	192.168.2.6	1.1.1.1	0x7cb8	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:04:34.534943104 CEST	192.168.2.6	1.1.1.1	0x60a	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 11:03:55.078974962 CEST	1.1.1.1	192.168.2.6	0xdcd	No error (0)	ayudamodelo200.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:03:55.078974962 CEST	1.1.1.1	192.168.2.6	0xdcd	No error (0)	ayudamodelo200.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:03:55.124769926 CEST	1.1.1.1	192.168.2.6	0x5d51	No error (0)	ayudamodelo200.com			65	IN (0x0001)	false
Jul 3, 2024 11:03:56.959600925 CEST	1.1.1.1	192.168.2.6	0xc28e	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 3, 2024 11:03:56.960083961 CEST	1.1.1.1	192.168.2.6	0x4ad9	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:04:11.173818111 CEST	1.1.1.1	192.168.2.6	0x36d0	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 11:04:11.173818111 CEST	1.1.1.1	192.168.2.6	0x36d0	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:04:12.689048052 CEST	1.1.1.1	192.168.2.6	0x1a2c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:04:12.689048052 CEST	1.1.1.1	192.168.2.6	0x1a2c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:04:26.777280092 CEST	1.1.1.1	192.168.2.6	0x5a69	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:04:26.777280092 CEST	1.1.1.1	192.168.2.6	0x5a69	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 3, 2024 11:04:34.542637110 CEST	1.1.1.1	192.168.2.6	0x7cb8	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ayudamodelo200.com

fs.microsoft.com

https:

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	188.114.96.3	443	6504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:03:55 UTC	672	OUT	GET /?uid=829102 HTTP/1.1 Host: ayudamodelo200.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 09:04:34 UTC	743	IN	HTTP/1.1 522 Date: Wed, 03 Jul 2024 09:04:34 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ynoxncfqlBdAPnCHZjexezA3whilk4OQrXxQ8hM6QOiPMJSC3S0D1qbe1Hwk%2BBWizfSDrnmbBO4UavXfEKO3aL%2FMzPyJzz%2BS2ZhdID6VWfgd%2BENpVuo2Umcb2kQzAGlszENXlOQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 89d5b484b8734308-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 09:04:34 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49720	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:03:58 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 63 75 36 74 4a 46 50 4f 30 6b 32 53 30 6d 74 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 63 37 61 65 66 31 62 36 39 37 34 31 64 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: cu6tJFPO0k2S0mtd.1Context: f3c7aef1b69741d6
2024-07-03 09:03:58 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 09:03:58 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 63 75 36 74 4a 46 50 4f 30 6b 32 53 30 6d 74 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 63 37 61 65 66 31 62 36 39 37 34 31 64 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: cu6tJFPO0k2S0mtd.2Context: f3c7aef1b69741d6<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-03 09:03:58 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 63 75 36 74 4a 46 50 4f 30 6b 32 53 30 6d 74 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 63 37 61 65 66 31 62 36 39 37 34 31 64 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: cu6tJFPO0k2S0mtd.3Context: f3c7aef1b69741d6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 09:03:58 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 09:03:58 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 61 78 52 50 66 58 72 46 30 57 31 70 59 77 74 77 36 36 50 32 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6axRPfXrF0W1pYwtw66P2A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49721	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:03:59 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 09:04:00 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=111904 Date: Wed, 03 Jul 2024 09:04:00 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49722	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:04:00 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 09:04:01 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=111913 Date: Wed, 03 Jul 2024 09:04:01 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-03 09:04:01 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49723	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:04:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 49 68 74 73 41 6d 51 4d 46 45 36 38 70 31 77 56 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 61 62 66 61 31 38 32 33 33 37 32 36 66 62 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: IhtsAmQMFE68p1wV.1Context: 4abfa18233726fb1
2024-07-03 09:04:06 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 09:04:06 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 49 68 74 73 41 6d 51 4d 46 45 36 38 70 31 77 56 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 61 62 66 61 31 38 32 33 33 37 32 36 66 62 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: IhtsAmQMFE68p1wV.2Context: 4abfa18233726fb1<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-03 09:04:06 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 49 68 74 73 41 6d 51 4d 46 45 36 38 70 31 77 56 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 61 62 66 61 31 38 32 33 33 37 32 36 66 62 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: IhtsAmQMFE68p1wV.3Context: 4abfa18233726fb1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 09:04:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 09:04:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 43 53 32 35 36 34 32 74 6b 4f 4c 73 54 49 71 78 69 58 46 31 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: kCS25642tkOLsTIqxiXF1w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49728	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:04:19 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 45 70 37 72 68 59 2f 4a 30 32 77 74 75 73 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 62 37 36 64 63 36 64 64 36 64 34 62 36 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: hEp7rhY/J02wtusP.1Context: 97b76dc6dd6d4b63
2024-07-03 09:04:19 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 09:04:19 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 68 45 70 37 72 68 59 2f 4a 30 32 77 74 75 73 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 62 37 36 64 63 36 64 64 36 64 34 62 36 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: hEp7rhY/J02wtusP.2Context: 97b76dc6dd6d4b63<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-03 09:04:19 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 45 70 37 72 68 59 2f 4a 30 32 77 74 75 73 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 62 37 36 64 63 36 64 64 36 64 34 62 36 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: hEp7rhY/J02wtusP.3Context: 97b76dc6dd6d4b63<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 09:04:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 09:04:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4d 4c 35 36 39 73 77 53 36 6b 32 54 30 76 53 45 30 73 64 70 63 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ML569swS6k2T0vSE0sdpcg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49730	35.190.80.1	443	6504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:04:35 UTC	545	OUT	OPTIONS /report/v4?s=ynoxncfqlBdAPnCHZjexezA3whilk4OQrXxQ8hM6QOiPMJSC3S0D1qbe1Hwk%2BBWizfSDrnmbBO4UavXfEKO3aL%2FMzPyJzz%2BS2ZhdID6VWfgd%2BENpVuo2Umcb2kQzAGlszENXlOQ%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://ayudamodelo200.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 09:04:35 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 03 Jul 2024 09:04:34 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49731	188.114.96.3	443	6504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:04:35 UTC	603	OUT	GET /favicon.ico HTTP/1.1 Host: ayudamodelo200.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ayudamodelo200.com/?uid=829102 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 09:04:54 UTC	739	IN	HTTP/1.1 522 Date: Wed, 03 Jul 2024 09:04:54 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vern9gdE6hmOerJ%2FVAhI3Qn1jLnEBWt%2Fjdp29kT9vlbaQD7fWVnpQoOlHr9Nz2cimjuUzML2HzBqSJAcNe0RsNIpsBmdznBH7mAdZA67YjbN9SVN0bqlULBJSvB5HzRtiIPklkk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 89d5b57cab077cb4-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 09:04:54 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49732	35.190.80.1	443	6504	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:04:35 UTC	484	OUT	POST /report/v4?s=ynoxncfqlBdAPnCHZjexezA3whilk4OQrXxQ8hM6QOiPMJSC3S0D1qbe1Hwk%2BBWizfSDrnmbBO4UavXfEKO3aL%2FMzPyJzz%2BS2ZhdID6VWfgd%2BENpVuo2Umcb2kQzAGlszENXlOQ%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 401 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 09:04:35 UTC	401	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 34 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 33 39 34 31 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 35 32 32 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 79 75 64 61 6d 6f 64 65 6c 6f 32 30 30 Data Ascii: [{"age":41,"body":{"elapsed_time":39419,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":522,"type":"http.error"},"type":"network-error","url":"https://ayudamodelo200
2024-07-03 09:04:35 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Wed, 03 Jul 2024 09:04:35 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49733	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:04:38 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 66 53 4f 4e 34 31 4f 67 6f 55 6d 73 78 46 6f 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 36 35 31 30 39 36 34 30 37 30 62 39 65 33 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: fSON41OgoUmsxFoJ.1Context: 26510964070b9e38
2024-07-03 09:04:38 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 09:04:38 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 66 53 4f 4e 34 31 4f 67 6f 55 6d 73 78 46 6f 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 36 35 31 30 39 36 34 30 37 30 62 39 65 33 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: fSON41OgoUmsxFoJ.2Context: 26510964070b9e38<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-03 09:04:38 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 66 53 4f 4e 34 31 4f 67 6f 55 6d 73 78 46 6f 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 36 35 31 30 39 36 34 30 37 30 62 39 65 33 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: fSON41OgoUmsxFoJ.3Context: 26510964070b9e38<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 09:04:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 09:04:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 42 42 4d 36 44 4a 34 34 6b 57 39 70 5a 68 62 35 2b 69 38 6d 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fBBM6DJ44kW9pZhb5+i8mQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	62078	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 09:05:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 53 61 33 50 67 44 45 53 54 45 36 67 46 46 39 6e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 64 39 37 61 30 31 30 30 34 66 34 32 30 62 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Sa3PgDESTE6gFF9n.1Context: 7d97a01004f420b5
2024-07-03 09:05:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 09:05:04 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 53 61 33 50 67 44 45 53 54 45 36 67 46 46 39 6e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 64 39 37 61 30 31 30 30 34 66 34 32 30 62 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 65 35 53 74 76 2b 75 33 76 51 51 62 52 65 30 2f 33 4a 43 62 76 33 38 39 63 38 46 6e 46 6f 31 68 46 54 52 72 6b 67 77 64 31 64 39 51 78 53 6e 76 55 44 32 42 56 78 59 41 4e 70 2b 6d 56 42 47 53 6c 54 64 6b 6c 54 66 63 63 2b 33 4a 59 31 79 45 69 45 36 78 57 45 6c 43 2b 4a 4b 62 37 72 69 61 7a 2b 53 76 57 51 74 79 34 68 55 69 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: Sa3PgDESTE6gFF9n.2Context: 7d97a01004f420b5<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWe5Stv+u3vQQbRe0/3JCbv389c8FnFo1hFTRrkgwd1d9QxSnvUD2BVxYANp+mVBGSlTdklTfcc+3JY1yEiE6xWElC+JKb7riaz+SvWQty4hUi
2024-07-03 09:05:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 53 61 33 50 67 44 45 53 54 45 36 67 46 46 39 6e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 64 39 37 61 30 31 30 30 34 66 34 32 30 62 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Sa3PgDESTE6gFF9n.3Context: 7d97a01004f420b5<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 09:05:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 09:05:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 4a 4d 69 62 62 77 33 57 45 43 37 66 57 75 36 6b 58 79 66 32 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: kJMibbw3WEC7fWu6kXyf2A.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 3108, Parent PID: 5876

General

Target ID:	0
Start time:	05:03:49
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6504, Parent PID: 3108

General

Target ID:	2
Start time:	05:03:51
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2468,i,7815768011067595301,10011362975349948554,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 1476, Parent PID: 5876

General

Target ID:	3
Start time:	05:03:54
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ayudamodelo200.com/?uid=829102"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: global traffic	HTTP traffic detected: GET /?uid=829102 HTTP/1.1Host: ayudamodelo200.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ayudamodelo200.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ayudamodelo200.com/?uid=829102Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: ayudamodelo200.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://ayudamodelo200.com/?uid=829102

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3108_433166071\sets.json

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 3108, Parent PID: 5876

General

Chronological Activities

Analysis Process: chrome.exePID: 6504, Parent PID: 3108

General

Chronological Activities

Analysis Process: chrome.exePID: 1476, Parent PID: 5876

General

Chronological Activities

Disassembly

Windows Analysis Report
https://ayudamodelo200.com/?uid=829102