Edit tour

Windows Analysis Report
http://help-copyright-issuenow-here.vercel.app/

Overview

General Information

Sample URL:	http://help-copyright-issuenow-here.vercel.app/
Analysis ID:	1637966
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Creates files inside the system directory

Deletes files inside the Windows folder

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,16888145351997362526,6260123567948548937,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://help-copyright-issuenow-here.vercel.app/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://help-copyright-issuenow-here.vercel.app/

Avira URL Cloud: detection malicious, Label: phishing

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.22
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: help-copyright-issuenow-here.vercel.app
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5304_1673060549

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5304_1673060549

Jump to behavior

Source: classification engine

Classification label: mal48.win@25/0@22/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,16888145351997362526,6260123567948548937,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://help-copyright-issuenow-here.vercel.app/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,16888145351997362526,6260123567948548937,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://help-copyright-issuenow-here.vercel.app/	100%	Avira URL Cloud	phishing

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
beacons-handoff.gcp.gvt2.com	142.250.180.99	true	false	high
www.google.com	142.250.186.164	true	false	high
help-copyright-issuenow-here.vercel.app	64.29.17.65	true	false	unknown
beacons.gvt2.com	216.58.206.67	true	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	unknown	United States	15169	GOOGLEUS	false
64.29.17.193	unknown	Canada	13768	COGECO-PEER1CA	false
216.198.79.65	unknown	United States	11696	NBS11696US	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637966
Start date and time:	2025-03-14 01:40:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://help-copyright-issuenow-here.vercel.app/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@25/0@22/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.142, 142.250.185.206, 74.125.133.84, 2.23.77.188, 142.250.185.227, 142.250.185.163, 142.250.186.174, 66.102.1.84
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, accounts.google.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: http://help-copyright-issuenow-here.vercel.app/

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

⊘No static file info

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 210
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 01:41:01.381264925 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:41:01.692497015 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:41:02.379933119 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:41:03.485827923 CET	49718	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:41:03.485877037 CET	443	49718	142.250.185.195	192.168.2.4
Mar 14, 2025 01:41:03.485955000 CET	49718	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:41:03.486721039 CET	49718	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:41:03.486735106 CET	443	49718	142.250.185.195	192.168.2.4
Mar 14, 2025 01:41:03.660444975 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:41:03.685617924 CET	443	49718	142.250.185.195	192.168.2.4
Mar 14, 2025 01:41:03.686868906 CET	49722	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:41:03.686923027 CET	443	49722	142.250.185.195	192.168.2.4
Mar 14, 2025 01:41:03.686990976 CET	49722	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:41:03.687604904 CET	49722	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:41:03.687644005 CET	443	49722	142.250.185.195	192.168.2.4
Mar 14, 2025 01:41:03.885299921 CET	443	49722	142.250.185.195	192.168.2.4
Mar 14, 2025 01:41:06.066871881 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:41:07.529594898 CET	49735	443	192.168.2.4	142.250.186.164
Mar 14, 2025 01:41:07.529692888 CET	443	49735	142.250.186.164	192.168.2.4
Mar 14, 2025 01:41:07.529782057 CET	49735	443	192.168.2.4	142.250.186.164
Mar 14, 2025 01:41:07.530189991 CET	49735	443	192.168.2.4	142.250.186.164
Mar 14, 2025 01:41:07.530229092 CET	443	49735	142.250.186.164	192.168.2.4
Mar 14, 2025 01:41:07.729731083 CET	443	49735	142.250.186.164	192.168.2.4
Mar 14, 2025 01:41:07.730297089 CET	49736	443	192.168.2.4	142.250.186.164
Mar 14, 2025 01:41:07.730333090 CET	443	49736	142.250.186.164	192.168.2.4
Mar 14, 2025 01:41:07.730616093 CET	49736	443	192.168.2.4	142.250.186.164
Mar 14, 2025 01:41:07.730786085 CET	49736	443	192.168.2.4	142.250.186.164
Mar 14, 2025 01:41:07.730798960 CET	443	49736	142.250.186.164	192.168.2.4
Mar 14, 2025 01:41:07.929677010 CET	443	49736	142.250.186.164	192.168.2.4
Mar 14, 2025 01:41:08.554594040 CET	49739	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.554637909 CET	443	49739	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.554824114 CET	49739	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.554939032 CET	49740	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.554981947 CET	443	49740	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.555270910 CET	49740	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.555752993 CET	49739	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.555769920 CET	443	49739	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.556642056 CET	49741	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:08.556649923 CET	49740	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.556675911 CET	443	49740	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.556693077 CET	443	49741	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:08.556785107 CET	49741	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:08.557079077 CET	49741	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:08.557095051 CET	443	49741	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:08.753593922 CET	443	49739	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.755831003 CET	49742	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.755878925 CET	443	49742	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.756155014 CET	49742	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.756336927 CET	49742	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.756350994 CET	443	49742	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.757055044 CET	443	49741	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:08.758174896 CET	49743	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:08.758208036 CET	443	49743	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:08.758455992 CET	49743	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:08.758637905 CET	443	49740	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.758943081 CET	49743	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:08.758954048 CET	443	49743	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:08.760828018 CET	49744	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.760837078 CET	443	49744	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.760927916 CET	49744	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.761192083 CET	49744	443	192.168.2.4	216.198.79.65
Mar 14, 2025 01:41:08.761207104 CET	443	49744	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.957132101 CET	443	49742	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:08.957652092 CET	443	49743	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:08.961375952 CET	443	49744	216.198.79.65	192.168.2.4
Mar 14, 2025 01:41:09.794033051 CET	49746	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:41:09.794073105 CET	443	49746	23.60.203.209	192.168.2.4
Mar 14, 2025 01:41:09.794193029 CET	49746	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:41:09.796818018 CET	49746	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:41:09.796834946 CET	443	49746	23.60.203.209	192.168.2.4
Mar 14, 2025 01:41:09.797493935 CET	443	49746	23.60.203.209	192.168.2.4
Mar 14, 2025 01:41:09.798497915 CET	49747	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:41:09.798543930 CET	443	49747	23.60.203.209	192.168.2.4
Mar 14, 2025 01:41:09.798612118 CET	49747	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:41:09.799031019 CET	49747	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:41:09.799046993 CET	443	49747	23.60.203.209	192.168.2.4
Mar 14, 2025 01:41:09.799428940 CET	443	49747	23.60.203.209	192.168.2.4
Mar 14, 2025 01:41:09.799967051 CET	49748	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:41:09.800017118 CET	443	49748	23.60.203.209	192.168.2.4
Mar 14, 2025 01:41:09.800085068 CET	49748	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:41:09.800924063 CET	49748	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:41:09.800960064 CET	443	49748	23.60.203.209	192.168.2.4
Mar 14, 2025 01:41:09.801028967 CET	49748	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:41:09.928941965 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:41:10.002423048 CET	49749	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.002465963 CET	443	49749	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.002553940 CET	49749	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.002932072 CET	49750	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.002969980 CET	443	49750	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.003021955 CET	49750	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.005841970 CET	49750	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.005858898 CET	443	49750	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.006144047 CET	49749	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.006159067 CET	443	49749	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.205421925 CET	443	49750	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.205430031 CET	443	49749	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.206302881 CET	49752	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.206337929 CET	443	49752	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.206402063 CET	49752	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.206724882 CET	49753	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.206782103 CET	443	49753	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.206892967 CET	49753	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.207163095 CET	49752	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.207180023 CET	443	49752	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.207401037 CET	49753	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:10.207422972 CET	443	49753	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.232578993 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:41:10.405678034 CET	443	49753	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.405884027 CET	443	49752	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:10.848483086 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:41:10.879719973 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:41:12.052021027 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:41:14.457750082 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:41:14.507895947 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:41:14.817116022 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:41:15.139812946 CET	49708	443	192.168.2.4	52.113.196.254
Mar 14, 2025 01:41:15.140189886 CET	49708	443	192.168.2.4	52.113.196.254
Mar 14, 2025 01:41:15.140228033 CET	49708	443	192.168.2.4	52.113.196.254
Mar 14, 2025 01:41:15.144480944 CET	443	49708	52.113.196.254	192.168.2.4
Mar 14, 2025 01:41:15.144840956 CET	443	49708	52.113.196.254	192.168.2.4
Mar 14, 2025 01:41:15.144850969 CET	443	49708	52.113.196.254	192.168.2.4
Mar 14, 2025 01:41:15.235064983 CET	443	49708	52.113.196.254	192.168.2.4
Mar 14, 2025 01:41:15.235162020 CET	49708	443	192.168.2.4	52.113.196.254
Mar 14, 2025 01:41:15.362587929 CET	443	49708	52.113.196.254	192.168.2.4
Mar 14, 2025 01:41:15.362668991 CET	49708	443	192.168.2.4	52.113.196.254
Mar 14, 2025 01:41:15.426496983 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:41:15.444679022 CET	49756	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.444727898 CET	443	49756	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.444812059 CET	49756	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.444942951 CET	49757	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.444976091 CET	443	49757	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.445028067 CET	49757	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.446100950 CET	49757	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.446115971 CET	443	49757	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.446475029 CET	49756	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.446491957 CET	443	49756	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.644860983 CET	443	49756	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.645441055 CET	443	49757	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.645512104 CET	49758	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.645549059 CET	443	49758	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.645627022 CET	49758	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.646532059 CET	49759	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.646567106 CET	443	49759	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.646876097 CET	49759	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.647420883 CET	49758	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.647437096 CET	443	49758	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.648056030 CET	49759	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:15.648070097 CET	443	49759	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.845088005 CET	443	49758	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:15.845412970 CET	443	49759	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:16.499242067 CET	49760	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.499280930 CET	443	49760	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.499358892 CET	49760	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.500452042 CET	49760	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.500466108 CET	443	49760	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.504861116 CET	443	49760	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.520109892 CET	49761	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.520148039 CET	443	49761	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.520248890 CET	49761	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.521192074 CET	49761	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.521205902 CET	443	49761	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.521708012 CET	443	49761	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.542045116 CET	49762	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.542138100 CET	443	49762	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.542289019 CET	49762	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.542629957 CET	49762	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.542665958 CET	443	49762	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.543001890 CET	443	49762	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.557960987 CET	49763	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.558012009 CET	443	49763	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.558134079 CET	49763	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.558417082 CET	49763	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.558434010 CET	443	49763	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.558758974 CET	443	49763	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.584577084 CET	49764	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.584613085 CET	443	49764	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.584676027 CET	49764	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.585011959 CET	49764	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.585028887 CET	443	49764	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.585411072 CET	443	49764	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.601463079 CET	49765	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.601480961 CET	443	49765	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.601721048 CET	49765	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.602689981 CET	49765	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.602706909 CET	443	49765	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.603183031 CET	443	49765	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.627283096 CET	49766	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.627338886 CET	443	49766	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.627490044 CET	49766	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.627768993 CET	49766	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.627803087 CET	443	49766	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.628173113 CET	443	49766	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.629981041 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:41:16.641344070 CET	49767	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.641381025 CET	443	49767	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.641459942 CET	49767	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.641694069 CET	49767	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:16.641706944 CET	443	49767	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:16.642080069 CET	443	49767	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:19.036122084 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:41:19.270478010 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:41:20.480478048 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:41:23.840878963 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:41:28.874950886 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:41:33.442280054 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:41:45.863436937 CET	49776	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:45.863497019 CET	443	49776	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:45.863590956 CET	49776	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:45.863636971 CET	49777	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:45.863684893 CET	443	49777	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:45.863738060 CET	49777	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:45.864778996 CET	49777	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:45.864794970 CET	443	49777	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:45.865462065 CET	49776	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:45.865478039 CET	443	49776	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:46.065571070 CET	443	49776	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:46.065608978 CET	443	49777	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:46.066087008 CET	49778	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:46.066154003 CET	443	49778	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:46.066231012 CET	49778	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:46.066442013 CET	49779	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:46.066473007 CET	443	49779	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:46.066535950 CET	49779	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:46.066790104 CET	49778	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:46.066804886 CET	443	49778	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:46.067013979 CET	49779	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:41:46.067028999 CET	443	49779	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:46.265482903 CET	443	49779	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:46.265533924 CET	443	49778	64.29.17.193	192.168.2.4
Mar 14, 2025 01:41:52.821078062 CET	49780	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.821114063 CET	443	49780	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.821186066 CET	49780	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.821717978 CET	49780	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.821728945 CET	443	49780	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.822539091 CET	443	49780	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.826539040 CET	49781	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.826586962 CET	443	49781	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.826652050 CET	49781	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.827053070 CET	49781	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.827064991 CET	443	49781	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.827564001 CET	443	49781	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.844978094 CET	49782	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.845017910 CET	443	49782	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.845087051 CET	49782	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.845582962 CET	49782	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.845596075 CET	443	49782	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.846087933 CET	443	49782	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.860204935 CET	49783	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.860250950 CET	443	49783	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.860712051 CET	49783	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.860712051 CET	49783	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.860749006 CET	443	49783	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.861279964 CET	443	49783	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.881894112 CET	49784	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.881931067 CET	443	49784	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.882002115 CET	49784	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.882381916 CET	49784	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.882395029 CET	443	49784	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.882877111 CET	443	49784	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.895345926 CET	49785	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.895370960 CET	443	49785	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.895425081 CET	49785	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.896126032 CET	49785	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.896140099 CET	443	49785	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.896612883 CET	443	49785	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.912791967 CET	49786	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.912820101 CET	443	49786	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.912894964 CET	49786	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.913440943 CET	49786	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.913460016 CET	443	49786	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.913918018 CET	443	49786	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.927576065 CET	49787	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.927613974 CET	443	49787	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.927680969 CET	49787	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.928128004 CET	49787	443	192.168.2.4	20.109.210.53
Mar 14, 2025 01:41:52.928142071 CET	443	49787	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:52.928570032 CET	443	49787	20.109.210.53	192.168.2.4
Mar 14, 2025 01:41:53.176855087 CET	49712	80	192.168.2.4	172.217.18.99
Mar 14, 2025 01:41:53.176914930 CET	49714	80	192.168.2.4	199.232.210.172
Mar 14, 2025 01:41:53.176964045 CET	49716	80	192.168.2.4	199.232.214.172
Mar 14, 2025 01:41:53.181689978 CET	80	49712	172.217.18.99	192.168.2.4
Mar 14, 2025 01:41:53.181746960 CET	49712	80	192.168.2.4	172.217.18.99
Mar 14, 2025 01:41:53.182049036 CET	80	49714	199.232.210.172	192.168.2.4
Mar 14, 2025 01:41:53.182061911 CET	80	49716	199.232.214.172	192.168.2.4
Mar 14, 2025 01:41:53.182096958 CET	49714	80	192.168.2.4	199.232.210.172
Mar 14, 2025 01:41:53.182136059 CET	49716	80	192.168.2.4	199.232.214.172
Mar 14, 2025 01:41:53.852195978 CET	49713	443	192.168.2.4	184.86.251.22
Mar 14, 2025 01:41:53.852592945 CET	49715	80	192.168.2.4	199.232.210.172
Mar 14, 2025 01:42:02.396382093 CET	49788	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:42:02.396428108 CET	443	49788	142.250.185.195	192.168.2.4
Mar 14, 2025 01:42:02.396503925 CET	49788	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:42:02.396863937 CET	49788	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:42:02.396877050 CET	443	49788	142.250.185.195	192.168.2.4
Mar 14, 2025 01:42:02.597470999 CET	443	49788	142.250.185.195	192.168.2.4
Mar 14, 2025 01:42:02.598222971 CET	49789	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:42:02.598270893 CET	443	49789	142.250.185.195	192.168.2.4
Mar 14, 2025 01:42:02.598344088 CET	49789	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:42:02.598674059 CET	49789	443	192.168.2.4	142.250.185.195
Mar 14, 2025 01:42:02.598690987 CET	443	49789	142.250.185.195	192.168.2.4
Mar 14, 2025 01:42:02.796951056 CET	443	49789	142.250.185.195	192.168.2.4
Mar 14, 2025 01:42:05.123090029 CET	49797	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.123141050 CET	443	49797	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.123235941 CET	49797	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.123394966 CET	49798	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.123436928 CET	443	49798	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.123493910 CET	49798	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.125294924 CET	49797	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.125310898 CET	443	49797	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.126655102 CET	49798	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.126669884 CET	443	49798	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.325321913 CET	443	49798	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.325390100 CET	443	49797	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.442953110 CET	49799	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.443006039 CET	443	49799	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.443078041 CET	49799	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.443610907 CET	49800	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.443656921 CET	443	49800	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.443718910 CET	49800	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.443856001 CET	49801	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.443892956 CET	443	49801	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.444030046 CET	49801	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.444188118 CET	49799	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.444205999 CET	443	49799	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.444470882 CET	49800	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.444488049 CET	443	49800	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.444797039 CET	49801	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.444811106 CET	443	49801	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.640949965 CET	443	49799	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.645185947 CET	443	49800	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.645677090 CET	443	49801	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.655678988 CET	49802	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.655721903 CET	443	49802	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.655824900 CET	49802	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.656757116 CET	49802	443	192.168.2.4	64.29.17.193
Mar 14, 2025 01:42:05.656771898 CET	443	49802	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:05.857588053 CET	443	49802	64.29.17.193	192.168.2.4
Mar 14, 2025 01:42:07.591576099 CET	49803	443	192.168.2.4	142.250.186.68
Mar 14, 2025 01:42:07.591623068 CET	443	49803	142.250.186.68	192.168.2.4
Mar 14, 2025 01:42:07.591692924 CET	49803	443	192.168.2.4	142.250.186.68
Mar 14, 2025 01:42:07.592159033 CET	49803	443	192.168.2.4	142.250.186.68
Mar 14, 2025 01:42:07.592178106 CET	443	49803	142.250.186.68	192.168.2.4
Mar 14, 2025 01:42:07.790153027 CET	443	49803	142.250.186.68	192.168.2.4
Mar 14, 2025 01:42:07.822084904 CET	49804	443	192.168.2.4	142.250.186.68
Mar 14, 2025 01:42:07.822132111 CET	443	49804	142.250.186.68	192.168.2.4
Mar 14, 2025 01:42:07.822321892 CET	49804	443	192.168.2.4	142.250.186.68
Mar 14, 2025 01:42:07.822719097 CET	49804	443	192.168.2.4	142.250.186.68
Mar 14, 2025 01:42:07.822738886 CET	443	49804	142.250.186.68	192.168.2.4
Mar 14, 2025 01:42:08.021763086 CET	443	49804	142.250.186.68	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 01:41:03.484252930 CET	53	52880	1.1.1.1	192.168.2.4
Mar 14, 2025 01:41:03.499815941 CET	53	60889	1.1.1.1	192.168.2.4
Mar 14, 2025 01:41:07.521380901 CET	63013	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:41:07.521567106 CET	54599	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:41:07.528136969 CET	53	63013	1.1.1.1	192.168.2.4
Mar 14, 2025 01:41:07.528597116 CET	53	54599	1.1.1.1	192.168.2.4
Mar 14, 2025 01:41:08.516510963 CET	55578	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:41:08.516510963 CET	60914	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:41:08.527044058 CET	53	60914	1.1.1.1	192.168.2.4
Mar 14, 2025 01:41:08.532610893 CET	53	55578	1.1.1.1	192.168.2.4
Mar 14, 2025 01:41:08.533082008 CET	49981	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:41:08.533370972 CET	55776	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:41:08.534009933 CET	52779	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:41:08.534193993 CET	50551	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:41:08.542294025 CET	53	52779	1.1.1.1	192.168.2.4
Mar 14, 2025 01:41:08.542932987 CET	53	55776	1.1.1.1	192.168.2.4
Mar 14, 2025 01:41:08.548986912 CET	53	50551	1.1.1.1	192.168.2.4
Mar 14, 2025 01:41:08.551425934 CET	53	49981	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:02.875883102 CET	53	64672	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:03.286777973 CET	53	58071	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:04.373883009 CET	53	49169	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:05.642674923 CET	52119	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:05.642746925 CET	54994	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:05.649400949 CET	53	54994	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:05.649419069 CET	53	52119	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:06.661648989 CET	65507	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:06.661820889 CET	52133	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:06.667983055 CET	53	65507	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:06.669123888 CET	53	52133	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:07.584086895 CET	54870	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:07.584242105 CET	52551	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:07.590701103 CET	53	54870	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:07.590715885 CET	53	52551	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:08.693036079 CET	62914	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:08.699784040 CET	53	62914	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:09.433507919 CET	138	138	192.168.2.4	192.168.2.255
Mar 14, 2025 01:42:09.706617117 CET	62914	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:09.713278055 CET	53	62914	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:10.708293915 CET	62914	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:10.717900991 CET	53	62914	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:12.724033117 CET	62914	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:12.730823994 CET	53	62914	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:16.739538908 CET	62914	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:16.746309042 CET	53	62914	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:21.712455988 CET	62923	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:21.712730885 CET	50817	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:21.719166994 CET	53	62923	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:21.720098019 CET	53	50817	1.1.1.1	192.168.2.4
Mar 14, 2025 01:42:22.723889112 CET	53506	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:42:22.730607033 CET	53	53506	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 14, 2025 01:41:07.521380901 CET	192.168.2.4	1.1.1.1	0x6a90	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:07.521567106 CET	192.168.2.4	1.1.1.1	0xe4d8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 14, 2025 01:41:08.516510963 CET	192.168.2.4	1.1.1.1	0xe86d	Standard query (0)	help-copyright-issuenow-here.vercel.app	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:08.516510963 CET	192.168.2.4	1.1.1.1	0x6d63	Standard query (0)	help-copyright-issuenow-here.vercel.app	65	IN (0x0001)	false
Mar 14, 2025 01:41:08.533082008 CET	192.168.2.4	1.1.1.1	0xcc15	Standard query (0)	help-copyright-issuenow-here.vercel.app	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:08.533370972 CET	192.168.2.4	1.1.1.1	0x934c	Standard query (0)	help-copyright-issuenow-here.vercel.app	65	IN (0x0001)	false
Mar 14, 2025 01:41:08.534009933 CET	192.168.2.4	1.1.1.1	0x7fcf	Standard query (0)	help-copyright-issuenow-here.vercel.app	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:08.534193993 CET	192.168.2.4	1.1.1.1	0x1e6f	Standard query (0)	help-copyright-issuenow-here.vercel.app	65	IN (0x0001)	false
Mar 14, 2025 01:42:05.642674923 CET	192.168.2.4	1.1.1.1	0xe072	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:05.642746925 CET	192.168.2.4	1.1.1.1	0x251a	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 14, 2025 01:42:06.661648989 CET	192.168.2.4	1.1.1.1	0xa347	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:06.661820889 CET	192.168.2.4	1.1.1.1	0xc794	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 14, 2025 01:42:07.584086895 CET	192.168.2.4	1.1.1.1	0x9c47	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:07.584242105 CET	192.168.2.4	1.1.1.1	0x25c2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 14, 2025 01:42:08.693036079 CET	192.168.2.4	1.1.1.1	0xefc5	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:09.706617117 CET	192.168.2.4	1.1.1.1	0xefc5	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:10.708293915 CET	192.168.2.4	1.1.1.1	0xefc5	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:12.724033117 CET	192.168.2.4	1.1.1.1	0xefc5	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:16.739538908 CET	192.168.2.4	1.1.1.1	0xefc5	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:21.712455988 CET	192.168.2.4	1.1.1.1	0x9f3e	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:21.712730885 CET	192.168.2.4	1.1.1.1	0x65b9	Standard query (0)	beacons.gvt2.com	65	IN (0x0001)	false
Mar 14, 2025 01:42:22.723889112 CET	192.168.2.4	1.1.1.1	0x7e56	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 14, 2025 01:41:07.528136969 CET	1.1.1.1	192.168.2.4	0x6a90	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:07.528597116 CET	1.1.1.1	192.168.2.4	0xe4d8	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 14, 2025 01:41:08.532610893 CET	1.1.1.1	192.168.2.4	0xe86d	No error (0)	help-copyright-issuenow-here.vercel.app		64.29.17.65	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:08.532610893 CET	1.1.1.1	192.168.2.4	0xe86d	No error (0)	help-copyright-issuenow-here.vercel.app		216.198.79.65	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:08.542294025 CET	1.1.1.1	192.168.2.4	0x7fcf	No error (0)	help-copyright-issuenow-here.vercel.app		216.198.79.65	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:08.542294025 CET	1.1.1.1	192.168.2.4	0x7fcf	No error (0)	help-copyright-issuenow-here.vercel.app		64.29.17.65	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:08.551425934 CET	1.1.1.1	192.168.2.4	0xcc15	No error (0)	help-copyright-issuenow-here.vercel.app		64.29.17.193	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:08.551425934 CET	1.1.1.1	192.168.2.4	0xcc15	No error (0)	help-copyright-issuenow-here.vercel.app		216.198.79.193	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:05.649400949 CET	1.1.1.1	192.168.2.4	0x251a	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:05.649419069 CET	1.1.1.1	192.168.2.4	0xe072	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:05.649419069 CET	1.1.1.1	192.168.2.4	0xe072	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:06.667983055 CET	1.1.1.1	192.168.2.4	0xa347	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:06.667983055 CET	1.1.1.1	192.168.2.4	0xa347	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.67	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:06.669123888 CET	1.1.1.1	192.168.2.4	0xc794	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:07.590701103 CET	1.1.1.1	192.168.2.4	0x9c47	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:07.590715885 CET	1.1.1.1	192.168.2.4	0x25c2	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 14, 2025 01:42:08.699784040 CET	1.1.1.1	192.168.2.4	0xefc5	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:08.699784040 CET	1.1.1.1	192.168.2.4	0xefc5	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.185.195	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:09.713278055 CET	1.1.1.1	192.168.2.4	0xefc5	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:09.713278055 CET	1.1.1.1	192.168.2.4	0xefc5	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.185.195	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:10.717900991 CET	1.1.1.1	192.168.2.4	0xefc5	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:10.717900991 CET	1.1.1.1	192.168.2.4	0xefc5	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.185.195	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:12.730823994 CET	1.1.1.1	192.168.2.4	0xefc5	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:12.730823994 CET	1.1.1.1	192.168.2.4	0xefc5	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.185.195	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:16.746309042 CET	1.1.1.1	192.168.2.4	0xefc5	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:16.746309042 CET	1.1.1.1	192.168.2.4	0xefc5	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.185.195	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:21.719166994 CET	1.1.1.1	192.168.2.4	0x9f3e	No error (0)	beacons.gvt2.com		216.58.206.67	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:22.730607033 CET	1.1.1.1	192.168.2.4	0x7e56	No error (0)	beacons.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5304, Parent PID: 3556

Function Logs

General

Target ID:	1
Start time:	20:40:58
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

COM Activities

WMI Operations

Show Windows behavior

Process Activities

Process Created

Process Terminated

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 1832, Parent PID: 5304

Function Logs

General

Target ID:	2
Start time:	20:41:01
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,16888145351997362526,6260123567948548937,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2336 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6924, Parent PID: 3556

Function Logs

General

Target ID:	4
Start time:	20:41:07
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://help-copyright-issuenow-here.vercel.app/"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://help-copyright-issuenow-here.vercel.app/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5304, Parent PID: 3556

General

File Activities

File Opened

File Created

File Deleted

File Moved

Other File Operations

Registry Activities

Key Deleted

Key Value Deleted

COM Activities

WMI Operations

Process Activities

Process Created

Process Terminated

Thread Activities

Thread Terminated

Memory Activities

Memory Usage Statistics

Windows Analysis Report
http://help-copyright-issuenow-here.vercel.app/