Edit tour

Windows Analysis Report
http://safety-profiles-fb-ads-156388685.vercel.app/

Overview

General Information

Sample URL:	http://safety-profiles-fb-ads-156388685.vercel.app/
Analysis ID:	1637969
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Creates files inside the system directory

Deletes files inside the Windows folder

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,8748762235944217247,6867490386744010562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2072 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,8748762235944217247,6867490386744010562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4952 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://safety-profiles-fb-ads-156388685.vercel.app/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://safety-profiles-fb-ads-156388685.vercel.app/

Avira URL Cloud: detection malicious, Label: phishing

Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.120
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: safety-profiles-fb-ads-156388685.vercel.app
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55423
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5956_1024850312

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5956_1024850312

Jump to behavior

Source: classification engine

Classification label: mal48.win@27/0@23/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,8748762235944217247,6867490386744010562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2072 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,8748762235944217247,6867490386744010562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4952 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://safety-profiles-fb-ads-156388685.vercel.app/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,8748762235944217247,6867490386744010562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2072 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,8748762235944217247,6867490386744010562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4952 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://safety-profiles-fb-ads-156388685.vercel.app/	100%	Avira URL Cloud	phishing

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
safety-profiles-fb-ads-156388685.vercel.app	64.29.17.65	true	false	unknown
beacons-handoff.gcp.gvt2.com	142.250.180.99	true	false	high
www.google.com	142.250.185.132	true	false	high
beacons.gvt2.com	142.251.143.67	true	false	high
beacons6.gvt2.com	216.58.206.35	true	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
64.29.17.65	safety-profiles-fb-ads-156388685.vercel.app	Canada	13768	COGECO-PEER1CA	false
216.198.79.129	unknown	United States	11696	NBS11696US	false

Private

IP
192.168.2.6
192.168.2.5
192.168.2.14

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637969
Start date and time:	2025-03-14 01:40:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://safety-profiles-fb-ads-156388685.vercel.app/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@27/0@23/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, BackgroundTransferHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.206, 142.250.186.163, 216.58.206.78, 142.251.5.84, 142.250.186.131, 142.250.184.238
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, accounts.google.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, g.bing.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: http://safety-profiles-fb-ads-156388685.vercel.app/

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

⊘No static file info

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 221
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 01:41:42.019402027 CET	80	49707	184.30.131.245	192.168.2.5
Mar 14, 2025 01:41:42.023627996 CET	49705	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.023696899 CET	49706	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.023935080 CET	49705	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.023976088 CET	49705	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.024017096 CET	49706	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.024039984 CET	49705	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.028321981 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.028333902 CET	443	49706	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.028605938 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.028615952 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.028786898 CET	443	49706	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.028796911 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.064698935 CET	49707	80	192.168.2.5	184.30.131.245
Mar 14, 2025 01:41:42.142839909 CET	49672	443	192.168.2.5	204.79.197.203
Mar 14, 2025 01:41:42.208621025 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.208688021 CET	49705	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.211169958 CET	443	49706	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.211229086 CET	49706	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.215503931 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.215517044 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.215528011 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.215538979 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.215549946 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.215564966 CET	49705	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.215605974 CET	49705	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.215675116 CET	49705	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.220376968 CET	443	49705	2.19.96.120	192.168.2.5
Mar 14, 2025 01:41:42.333453894 CET	49705	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.333492994 CET	49706	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:41:42.333658934 CET	49707	80	192.168.2.5	184.30.131.245
Mar 14, 2025 01:41:44.549102068 CET	49672	443	192.168.2.5	204.79.197.203
Mar 14, 2025 01:41:46.887368917 CET	49711	443	192.168.2.5	23.60.203.209
Mar 14, 2025 01:41:46.887404919 CET	443	49711	23.60.203.209	192.168.2.5
Mar 14, 2025 01:41:46.887471914 CET	49711	443	192.168.2.5	23.60.203.209
Mar 14, 2025 01:41:46.889254093 CET	49711	443	192.168.2.5	23.60.203.209
Mar 14, 2025 01:41:46.889266968 CET	443	49711	23.60.203.209	192.168.2.5
Mar 14, 2025 01:41:46.890841007 CET	443	49711	23.60.203.209	192.168.2.5
Mar 14, 2025 01:41:46.897964001 CET	49712	443	192.168.2.5	23.60.203.209
Mar 14, 2025 01:41:46.897996902 CET	443	49712	23.60.203.209	192.168.2.5
Mar 14, 2025 01:41:46.898061991 CET	49712	443	192.168.2.5	23.60.203.209
Mar 14, 2025 01:41:46.899019003 CET	49712	443	192.168.2.5	23.60.203.209
Mar 14, 2025 01:41:46.899034023 CET	443	49712	23.60.203.209	192.168.2.5
Mar 14, 2025 01:41:46.899508953 CET	443	49712	23.60.203.209	192.168.2.5
Mar 14, 2025 01:41:46.899772882 CET	49713	443	192.168.2.5	23.60.203.209
Mar 14, 2025 01:41:46.899806976 CET	443	49713	23.60.203.209	192.168.2.5
Mar 14, 2025 01:41:46.899861097 CET	49713	443	192.168.2.5	23.60.203.209
Mar 14, 2025 01:41:46.902015924 CET	49713	443	192.168.2.5	23.60.203.209
Mar 14, 2025 01:41:46.902049065 CET	443	49713	23.60.203.209	192.168.2.5
Mar 14, 2025 01:41:46.902097940 CET	49713	443	192.168.2.5	23.60.203.209
Mar 14, 2025 01:41:48.445233107 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 01:41:48.752253056 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 01:41:49.361684084 CET	49672	443	192.168.2.5	204.79.197.203
Mar 14, 2025 01:41:49.373331070 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 01:41:50.580363035 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 01:41:53.080348015 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 01:41:57.657942057 CET	49727	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:41:57.657979012 CET	443	49727	142.250.185.132	192.168.2.5
Mar 14, 2025 01:41:57.658072948 CET	49727	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:41:57.658380985 CET	49727	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:41:57.658396006 CET	443	49727	142.250.185.132	192.168.2.5
Mar 14, 2025 01:41:57.857249022 CET	443	49727	142.250.185.132	192.168.2.5
Mar 14, 2025 01:41:57.857933044 CET	49728	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:41:57.857966900 CET	443	49728	142.250.185.132	192.168.2.5
Mar 14, 2025 01:41:57.858033895 CET	49728	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:41:57.858391047 CET	49728	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:41:57.858405113 CET	443	49728	142.250.185.132	192.168.2.5
Mar 14, 2025 01:41:57.893217087 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 01:41:58.057504892 CET	443	49728	142.250.185.132	192.168.2.5
Mar 14, 2025 01:41:58.937032938 CET	49731	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:41:58.937087059 CET	443	49731	64.29.17.65	192.168.2.5
Mar 14, 2025 01:41:58.937268972 CET	49731	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:41:58.937701941 CET	49731	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:41:58.937722921 CET	443	49731	64.29.17.65	192.168.2.5
Mar 14, 2025 01:41:58.963171959 CET	49732	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:58.963207960 CET	443	49732	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:58.963506937 CET	49733	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:58.963535070 CET	443	49733	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:58.963597059 CET	49732	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:58.963598013 CET	49733	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:58.963895082 CET	49733	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:58.963911057 CET	443	49733	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:58.964143991 CET	49732	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:58.964158058 CET	443	49732	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:58.971581936 CET	49672	443	192.168.2.5	204.79.197.203
Mar 14, 2025 01:41:59.136938095 CET	443	49731	64.29.17.65	192.168.2.5
Mar 14, 2025 01:41:59.137520075 CET	49734	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:41:59.137554884 CET	443	49734	64.29.17.65	192.168.2.5
Mar 14, 2025 01:41:59.137687922 CET	49734	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:41:59.138046026 CET	49734	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:41:59.138057947 CET	443	49734	64.29.17.65	192.168.2.5
Mar 14, 2025 01:41:59.161886930 CET	443	49732	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:59.161923885 CET	443	49733	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:59.162492990 CET	49735	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:59.162514925 CET	443	49735	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:59.162676096 CET	49735	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:59.162961960 CET	49736	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:59.163002014 CET	443	49736	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:59.163084030 CET	49736	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:59.163574934 CET	49735	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:59.163575888 CET	49736	443	192.168.2.5	216.198.79.129
Mar 14, 2025 01:41:59.163589954 CET	443	49735	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:59.163594961 CET	443	49736	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:59.337395906 CET	443	49734	64.29.17.65	192.168.2.5
Mar 14, 2025 01:41:59.361023903 CET	443	49735	216.198.79.129	192.168.2.5
Mar 14, 2025 01:41:59.361296892 CET	443	49736	216.198.79.129	192.168.2.5
Mar 14, 2025 01:42:00.387646914 CET	49741	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.387698889 CET	443	49741	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.387813091 CET	49741	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.388426065 CET	49742	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.388432026 CET	49741	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.388448954 CET	443	49741	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.388463020 CET	443	49742	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.388642073 CET	49742	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.389260054 CET	49742	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.389286041 CET	443	49742	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.589051962 CET	443	49741	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.589243889 CET	443	49742	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.589704037 CET	49743	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.589728117 CET	443	49743	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.590182066 CET	49744	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.590214968 CET	443	49744	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.590245962 CET	49743	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.590368032 CET	49744	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.590804100 CET	49744	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.590805054 CET	49743	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:00.590814114 CET	443	49743	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.590818882 CET	443	49744	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.789024115 CET	443	49743	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:00.789187908 CET	443	49744	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:04.336484909 CET	49745	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.336532116 CET	443	49745	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.337455034 CET	49745	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.348673105 CET	49745	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.348690987 CET	443	49745	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.349457026 CET	443	49745	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.366908073 CET	49746	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.366941929 CET	443	49746	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.367008924 CET	49746	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.367399931 CET	49746	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.367415905 CET	443	49746	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.367965937 CET	443	49746	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.397039890 CET	49747	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.397069931 CET	443	49747	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.397339106 CET	49747	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.397933960 CET	49747	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.397948980 CET	443	49747	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.398571968 CET	443	49747	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.410621881 CET	49748	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.410650015 CET	443	49748	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.410837889 CET	49748	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.411211014 CET	49748	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.411221027 CET	443	49748	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.411798954 CET	443	49748	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.467546940 CET	49749	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.467586040 CET	443	49749	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.467689991 CET	49749	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.468130112 CET	49749	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.468144894 CET	443	49749	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.468849897 CET	443	49749	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.510971069 CET	49750	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.511015892 CET	443	49750	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.511079073 CET	49750	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.511482954 CET	49750	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.511499882 CET	443	49750	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.512227058 CET	443	49750	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.559820890 CET	49751	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.559863091 CET	443	49751	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.559931993 CET	49751	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.560513020 CET	49751	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.560524940 CET	443	49751	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.561351061 CET	443	49751	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.584682941 CET	49752	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.584723949 CET	443	49752	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.584791899 CET	49752	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.585367918 CET	49752	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:04.585383892 CET	443	49752	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:04.585855961 CET	443	49752	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:05.814201117 CET	49753	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:05.814245939 CET	443	49753	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:05.814316988 CET	49753	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:05.814870119 CET	49753	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:05.814883947 CET	443	49753	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:05.834110022 CET	49754	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:05.834141016 CET	443	49754	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:05.834209919 CET	49754	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:05.836082935 CET	49754	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:05.836096048 CET	443	49754	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:06.013394117 CET	443	49753	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:06.014043093 CET	49755	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:06.014084101 CET	443	49755	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:06.014169931 CET	49755	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:06.014511108 CET	49755	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:06.014524937 CET	443	49755	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:06.033829927 CET	443	49754	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:06.035959959 CET	49756	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:06.036001921 CET	443	49756	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:06.036077976 CET	49756	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:06.036468029 CET	49756	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:06.036484003 CET	443	49756	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:06.084765911 CET	49757	443	192.168.2.5	150.171.27.10
Mar 14, 2025 01:42:06.084808111 CET	443	49757	150.171.27.10	192.168.2.5
Mar 14, 2025 01:42:06.084891081 CET	49757	443	192.168.2.5	150.171.27.10
Mar 14, 2025 01:42:06.087516069 CET	49757	443	192.168.2.5	150.171.27.10
Mar 14, 2025 01:42:06.087528944 CET	443	49757	150.171.27.10	192.168.2.5
Mar 14, 2025 01:42:06.088073969 CET	443	49757	150.171.27.10	192.168.2.5
Mar 14, 2025 01:42:06.088510990 CET	49758	443	192.168.2.5	150.171.27.10
Mar 14, 2025 01:42:06.088536978 CET	443	49758	150.171.27.10	192.168.2.5
Mar 14, 2025 01:42:06.088630915 CET	49758	443	192.168.2.5	150.171.27.10
Mar 14, 2025 01:42:06.089037895 CET	49758	443	192.168.2.5	150.171.27.10
Mar 14, 2025 01:42:06.089050055 CET	443	49758	150.171.27.10	192.168.2.5
Mar 14, 2025 01:42:06.089452028 CET	443	49758	150.171.27.10	192.168.2.5
Mar 14, 2025 01:42:06.089890003 CET	49759	443	192.168.2.5	150.171.27.10
Mar 14, 2025 01:42:06.089910030 CET	443	49759	150.171.27.10	192.168.2.5
Mar 14, 2025 01:42:06.090044022 CET	49759	443	192.168.2.5	150.171.27.10
Mar 14, 2025 01:42:06.090069056 CET	49759	443	192.168.2.5	150.171.27.10
Mar 14, 2025 01:42:06.090106964 CET	443	49759	150.171.27.10	192.168.2.5
Mar 14, 2025 01:42:06.090184927 CET	49759	443	192.168.2.5	150.171.27.10
Mar 14, 2025 01:42:06.213179111 CET	443	49755	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:06.237193108 CET	443	49756	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:07.501956940 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 01:42:35.400712967 CET	80	49688	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:35.400896072 CET	49688	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:35.401071072 CET	49688	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:35.405663967 CET	80	49688	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:35.571890116 CET	80	49690	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:35.572117090 CET	49690	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:35.572117090 CET	49690	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:35.576781034 CET	80	49690	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:35.588913918 CET	80	49689	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:35.589365005 CET	49689	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:35.589670897 CET	49689	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:35.595002890 CET	80	49689	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:35.740787029 CET	80	49691	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:35.741004944 CET	49691	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:35.741041899 CET	49691	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:35.745693922 CET	80	49691	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:36.254698992 CET	49768	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.254759073 CET	443	49768	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.254882097 CET	49769	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.254894018 CET	49768	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.254935026 CET	443	49769	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.254998922 CET	49769	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.255372047 CET	49768	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.255390882 CET	443	49768	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.256688118 CET	49769	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.256711960 CET	443	49769	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.453470945 CET	443	49768	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.454267979 CET	49770	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.454315901 CET	443	49770	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.454407930 CET	49770	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.454727888 CET	49770	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.454744101 CET	443	49770	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.457617044 CET	443	49769	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.458389044 CET	49771	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.458446026 CET	443	49771	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.458514929 CET	49771	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.458949089 CET	49771	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:42:36.458962917 CET	443	49771	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.653676987 CET	443	49770	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:36.658004999 CET	443	49771	64.29.17.65	192.168.2.5
Mar 14, 2025 01:42:37.974483967 CET	80	49696	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:37.974581003 CET	49696	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:37.974623919 CET	49696	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:37.979330063 CET	80	49696	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:39.596836090 CET	49703	80	192.168.2.5	172.217.18.3
Mar 14, 2025 01:42:39.596982956 CET	49701	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:39.602626085 CET	80	49703	172.217.18.3	192.168.2.5
Mar 14, 2025 01:42:39.602744102 CET	49703	80	192.168.2.5	172.217.18.3
Mar 14, 2025 01:42:39.602853060 CET	80	49701	217.20.57.20	192.168.2.5
Mar 14, 2025 01:42:39.603087902 CET	49701	80	192.168.2.5	217.20.57.20
Mar 14, 2025 01:42:40.444502115 CET	49697	443	192.168.2.5	2.19.96.120
Mar 14, 2025 01:42:40.444880009 CET	49704	80	192.168.2.5	184.30.131.245
Mar 14, 2025 01:42:40.754551888 CET	49772	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.754591942 CET	443	49772	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.754662991 CET	49772	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.755145073 CET	49772	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.755156040 CET	443	49772	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.755803108 CET	443	49772	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.758301020 CET	49773	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.758346081 CET	443	49773	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.758413076 CET	49773	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.758748055 CET	49773	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.758773088 CET	443	49773	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.759264946 CET	443	49773	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.784806013 CET	49774	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.784842968 CET	443	49774	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.784908056 CET	49774	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.785481930 CET	49774	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.785494089 CET	443	49774	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.786016941 CET	443	49774	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.801245928 CET	49775	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.801301956 CET	443	49775	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.801379919 CET	49775	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.801682949 CET	49775	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.801693916 CET	443	49775	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.802217960 CET	443	49775	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.820389986 CET	49776	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.820444107 CET	443	49776	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.820519924 CET	49776	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.820775986 CET	49776	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.820786953 CET	443	49776	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.821304083 CET	443	49776	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.833333015 CET	49777	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.833373070 CET	443	49777	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.833462954 CET	49777	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.833703995 CET	49777	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.833718061 CET	443	49777	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.834110022 CET	443	49777	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.849862099 CET	49778	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.849900007 CET	443	49778	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.850101948 CET	49778	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.850492001 CET	49778	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.850506067 CET	443	49778	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.850866079 CET	443	49778	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.872454882 CET	49779	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.872508049 CET	443	49779	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.872581005 CET	49779	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.873059988 CET	49779	443	192.168.2.5	4.245.163.56
Mar 14, 2025 01:42:40.873074055 CET	443	49779	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:40.873424053 CET	443	49779	4.245.163.56	192.168.2.5
Mar 14, 2025 01:42:57.707415104 CET	49789	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:42:57.707477093 CET	443	49789	142.250.185.132	192.168.2.5
Mar 14, 2025 01:42:57.707566023 CET	49789	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:42:57.707956076 CET	49789	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:42:57.707974911 CET	443	49789	142.250.185.132	192.168.2.5
Mar 14, 2025 01:42:57.905143023 CET	443	49789	142.250.185.132	192.168.2.5
Mar 14, 2025 01:42:57.906100035 CET	49790	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:42:57.906152010 CET	443	49790	142.250.185.132	192.168.2.5
Mar 14, 2025 01:42:57.906223059 CET	49790	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:42:57.906544924 CET	49790	443	192.168.2.5	142.250.185.132
Mar 14, 2025 01:42:57.906558990 CET	443	49790	142.250.185.132	192.168.2.5
Mar 14, 2025 01:42:58.105746031 CET	443	49790	142.250.185.132	192.168.2.5
Mar 14, 2025 01:43:07.436156988 CET	49791	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.436212063 CET	443	49791	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.436295033 CET	49791	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.436548948 CET	49792	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.436580896 CET	443	49792	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.436638117 CET	49792	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.439001083 CET	49792	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.439019918 CET	443	49792	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.439810991 CET	49791	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.439832926 CET	443	49791	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.637161970 CET	443	49792	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.637495995 CET	443	49791	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.638032913 CET	49793	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.638099909 CET	443	49793	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.638180971 CET	49793	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.638514042 CET	49794	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.638576031 CET	443	49794	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.638649940 CET	49794	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.638906002 CET	49793	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.638921976 CET	443	49793	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.639163971 CET	49794	443	192.168.2.5	64.29.17.65
Mar 14, 2025 01:43:07.639177084 CET	443	49794	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.837593079 CET	443	49794	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:07.837666988 CET	443	49793	64.29.17.65	192.168.2.5
Mar 14, 2025 01:43:15.712764978 CET	55421	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:15.717519999 CET	53	55421	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:15.717609882 CET	55421	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:15.717658043 CET	55421	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:15.722444057 CET	53	55421	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:16.451082945 CET	53	55421	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:16.459755898 CET	55421	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:16.464955091 CET	53	55421	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:16.468424082 CET	55421	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:16.468758106 CET	55422	443	192.168.2.5	142.250.114.94
Mar 14, 2025 01:43:16.468791962 CET	443	55422	142.250.114.94	192.168.2.5
Mar 14, 2025 01:43:16.468873978 CET	55422	443	192.168.2.5	142.250.114.94
Mar 14, 2025 01:43:16.469372034 CET	55422	443	192.168.2.5	142.250.114.94
Mar 14, 2025 01:43:16.469379902 CET	443	55422	142.250.114.94	192.168.2.5
Mar 14, 2025 01:43:16.681350946 CET	443	55422	142.250.114.94	192.168.2.5
Mar 14, 2025 01:43:16.685323000 CET	55423	443	192.168.2.5	142.250.114.94
Mar 14, 2025 01:43:16.685358047 CET	443	55423	142.250.114.94	192.168.2.5
Mar 14, 2025 01:43:16.685421944 CET	55423	443	192.168.2.5	142.250.114.94
Mar 14, 2025 01:43:16.685697079 CET	55423	443	192.168.2.5	142.250.114.94
Mar 14, 2025 01:43:16.685709000 CET	443	55423	142.250.114.94	192.168.2.5
Mar 14, 2025 01:43:16.885868073 CET	443	55423	142.250.114.94	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 01:41:53.293092966 CET	53	62886	1.1.1.1	192.168.2.5
Mar 14, 2025 01:41:53.484899998 CET	53	59744	1.1.1.1	192.168.2.5
Mar 14, 2025 01:41:57.646930933 CET	55320	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:41:57.647294044 CET	50455	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:41:57.656872034 CET	53	55320	1.1.1.1	192.168.2.5
Mar 14, 2025 01:41:57.657160997 CET	53	50455	1.1.1.1	192.168.2.5
Mar 14, 2025 01:41:58.903003931 CET	58399	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:41:58.903350115 CET	49700	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:41:58.919239044 CET	53	49700	1.1.1.1	192.168.2.5
Mar 14, 2025 01:41:58.921829939 CET	49708	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:41:58.921829939 CET	63785	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:41:58.930473089 CET	53	49708	1.1.1.1	192.168.2.5
Mar 14, 2025 01:41:58.930854082 CET	53	63785	1.1.1.1	192.168.2.5
Mar 14, 2025 01:41:58.952013016 CET	53	58399	1.1.1.1	192.168.2.5
Mar 14, 2025 01:41:58.953036070 CET	50489	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:41:58.953265905 CET	56289	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:41:58.961893082 CET	53	56289	1.1.1.1	192.168.2.5
Mar 14, 2025 01:41:58.962554932 CET	53	50489	1.1.1.1	192.168.2.5
Mar 14, 2025 01:42:51.667536974 CET	138	138	192.168.2.5	192.168.2.255
Mar 14, 2025 01:42:53.063723087 CET	53	52057	1.1.1.1	192.168.2.5
Mar 14, 2025 01:42:53.481158972 CET	53	59943	1.1.1.1	192.168.2.5
Mar 14, 2025 01:42:53.985635996 CET	53	60214	1.1.1.1	192.168.2.5
Mar 14, 2025 01:42:55.648721933 CET	49339	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:42:55.648972988 CET	51314	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:42:55.655702114 CET	53	51314	1.1.1.1	192.168.2.5
Mar 14, 2025 01:42:55.655756950 CET	53	49339	1.1.1.1	192.168.2.5
Mar 14, 2025 01:42:56.675159931 CET	52004	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:42:56.675159931 CET	56052	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:42:56.681991100 CET	53	56052	1.1.1.1	192.168.2.5
Mar 14, 2025 01:42:56.682009935 CET	53	52004	1.1.1.1	192.168.2.5
Mar 14, 2025 01:42:58.707072020 CET	63902	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:42:58.714755058 CET	53	63902	1.1.1.1	192.168.2.5
Mar 14, 2025 01:42:59.721832037 CET	63902	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:42:59.728622913 CET	53	63902	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:00.737433910 CET	63902	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:00.744118929 CET	53	63902	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:02.753038883 CET	63902	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:02.764188051 CET	53	63902	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:06.753706932 CET	63902	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:06.760695934 CET	53	63902	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:11.651900053 CET	55364	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:11.652177095 CET	53400	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:11.661595106 CET	53	55364	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:11.662781000 CET	53	53400	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:12.674782038 CET	50275	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:12.681735992 CET	53	50275	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:14.706231117 CET	57255	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:14.713545084 CET	53	57255	1.1.1.1	192.168.2.5
Mar 14, 2025 01:43:15.705565929 CET	57255	53	192.168.2.5	1.1.1.1
Mar 14, 2025 01:43:15.712224007 CET	53	57255	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 14, 2025 01:41:57.646930933 CET	192.168.2.5	1.1.1.1	0x1669	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:57.647294044 CET	192.168.2.5	1.1.1.1	0x7bc5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 14, 2025 01:41:58.903003931 CET	192.168.2.5	1.1.1.1	0xbdf4	Standard query (0)	safety-profiles-fb-ads-156388685.vercel.app	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:58.903350115 CET	192.168.2.5	1.1.1.1	0x56e0	Standard query (0)	safety-profiles-fb-ads-156388685.vercel.app	65	IN (0x0001)	false
Mar 14, 2025 01:41:58.921829939 CET	192.168.2.5	1.1.1.1	0xdcfa	Standard query (0)	safety-profiles-fb-ads-156388685.vercel.app	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:58.921829939 CET	192.168.2.5	1.1.1.1	0x2341	Standard query (0)	safety-profiles-fb-ads-156388685.vercel.app	65	IN (0x0001)	false
Mar 14, 2025 01:41:58.953036070 CET	192.168.2.5	1.1.1.1	0x5201	Standard query (0)	safety-profiles-fb-ads-156388685.vercel.app	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:58.953265905 CET	192.168.2.5	1.1.1.1	0xe186	Standard query (0)	safety-profiles-fb-ads-156388685.vercel.app	65	IN (0x0001)	false
Mar 14, 2025 01:42:55.648721933 CET	192.168.2.5	1.1.1.1	0x7b17	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:55.648972988 CET	192.168.2.5	1.1.1.1	0x34b0	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 14, 2025 01:42:56.675159931 CET	192.168.2.5	1.1.1.1	0x5909	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:56.675159931 CET	192.168.2.5	1.1.1.1	0x4782	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 14, 2025 01:42:58.707072020 CET	192.168.2.5	1.1.1.1	0x303	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:59.721832037 CET	192.168.2.5	1.1.1.1	0x303	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:00.737433910 CET	192.168.2.5	1.1.1.1	0x303	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:02.753038883 CET	192.168.2.5	1.1.1.1	0x303	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:06.753706932 CET	192.168.2.5	1.1.1.1	0x303	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:11.651900053 CET	192.168.2.5	1.1.1.1	0x162a	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:11.652177095 CET	192.168.2.5	1.1.1.1	0xa8b2	Standard query (0)	beacons.gvt2.com	65	IN (0x0001)	false
Mar 14, 2025 01:43:12.674782038 CET	192.168.2.5	1.1.1.1	0x16f1	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:14.706231117 CET	192.168.2.5	1.1.1.1	0xe7a1	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:15.705565929 CET	192.168.2.5	1.1.1.1	0xe7a1	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:15.717658043 CET	192.168.2.5	1.1.1.1	0x1	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 14, 2025 01:41:57.656872034 CET	1.1.1.1	192.168.2.5	0x1669	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:57.657160997 CET	1.1.1.1	192.168.2.5	0x7bc5	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 14, 2025 01:41:58.930473089 CET	1.1.1.1	192.168.2.5	0xdcfa	No error (0)	safety-profiles-fb-ads-156388685.vercel.app		64.29.17.65	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:58.930473089 CET	1.1.1.1	192.168.2.5	0xdcfa	No error (0)	safety-profiles-fb-ads-156388685.vercel.app		216.198.79.65	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:58.952013016 CET	1.1.1.1	192.168.2.5	0xbdf4	No error (0)	safety-profiles-fb-ads-156388685.vercel.app		216.198.79.129	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:58.952013016 CET	1.1.1.1	192.168.2.5	0xbdf4	No error (0)	safety-profiles-fb-ads-156388685.vercel.app		64.29.17.129	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:58.962554932 CET	1.1.1.1	192.168.2.5	0x5201	No error (0)	safety-profiles-fb-ads-156388685.vercel.app		216.198.79.129	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:41:58.962554932 CET	1.1.1.1	192.168.2.5	0x5201	No error (0)	safety-profiles-fb-ads-156388685.vercel.app		64.29.17.129	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:55.655702114 CET	1.1.1.1	192.168.2.5	0x34b0	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:55.655756950 CET	1.1.1.1	192.168.2.5	0x7b17	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:55.655756950 CET	1.1.1.1	192.168.2.5	0x7b17	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:56.681991100 CET	1.1.1.1	192.168.2.5	0x4782	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:56.682009935 CET	1.1.1.1	192.168.2.5	0x5909	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:56.682009935 CET	1.1.1.1	192.168.2.5	0x5909	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:58.714755058 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:58.714755058 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.67	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:42:59.728622913 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:42:59.728622913 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.67	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:00.744118929 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:43:00.744118929 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.67	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:02.764188051 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:43:02.764188051 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.67	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:06.760695934 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:43:06.760695934 CET	1.1.1.1	192.168.2.5	0x303	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.67	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:11.661595106 CET	1.1.1.1	192.168.2.5	0x162a	No error (0)	beacons.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:12.681735992 CET	1.1.1.1	192.168.2.5	0x16f1	No error (0)	beacons.gvt2.com	beacons6.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:43:12.681735992 CET	1.1.1.1	192.168.2.5	0x16f1	No error (0)	beacons6.gvt2.com		216.58.206.35	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:14.713545084 CET	1.1.1.1	192.168.2.5	0xe7a1	No error (0)	beacons.gvt2.com	beacons6.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 01:43:14.713545084 CET	1.1.1.1	192.168.2.5	0xe7a1	No error (0)	beacons6.gvt2.com		216.58.206.67	A (IP address)	IN (0x0001)	false
Mar 14, 2025 01:43:16.451082945 CET	1.1.1.1	192.168.2.5	0x1	No error (0)	beacons.gvt2.com		142.250.114.94	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49707	184.30.131.245	80

Timestamp	Bytes transferred	Direction	Data
Mar 14, 2025 01:41:42.019402027 CET	717	IN	HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 312 Cache-Control: max-age=3073 Expires: Fri, 14 Mar 2025 01:32:54 GMT Date: Fri, 14 Mar 2025 00:41:41 GMT Connection: keep-alive Server-Timing: cdn-cache; desc=HIT Server-Timing: edge; dur=1 Akamai-GRN: 0.a67a7b5c.1741912901.17cd2b60 Server-Timing: ak_p; desc="1741912901924_1551596198_399321952_18_1346_178_0_-";dur=1 Data Raw: 30 82 01 34 0a 01 00 a0 82 01 2d 30 82 01 29 06 09 2b 06 01 05 05 07 30 01 01 04 82 01 1a 30 82 01 16 30 81 9e a2 16 04 14 b3 db 48 a4 f9 a1 c5 d8 ae 36 41 cc 11 63 69 62 29 bc 4b c6 18 0f 32 30 32 35 30 33 31 32 31 39 30 34 33 35 5a 30 73 30 71 30 49 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 eb 8e bc 9d 47 2b 7e 02 91 77 19 23 f2 a5 f1 c1 c5 1e 57 b5 04 14 b3 db 48 a4 f9 a1 c5 d8 ae 36 41 cc 11 63 69 62 29 bc 4b c6 02 10 02 39 3d 48 d7 02 42 5a 7c b4 1c 00 0b 0e d7 ca 80 00 18 0f 32 30 32 35 30 33 31 32 31 39 30 34 33 35 5a a0 11 18 0f 32 30 32 35 30 33 31 39 31 39 30 34 33 35 5a 30 0a 06 08 2a 86 48 ce 3d 04 03 03 03 67 00 30 64 02 30 2e 47 aa 9a b2 f0 76 88 3e 82 06 35 cc 8e 7b 2d 88 d8 da b0 cb 95 b8 d4 b5 4c 3f f2 72 93 ba 5b b1 a3 e8 57 8e 20 2a 8b da 46 8b 8a 7b 3f e6 4d 02 30 63 d1 d4 37 77 47 2c 69 3c 42 21 6a 9f 1a 68 34 ae 88 aa 5e 29 46 43 37 2d c2 56 6a cb ad 5b b1 31 d0 8f 70 c3 ca ad a9 88 f6 e2 be 9b af 2d 8d Data Ascii: 04-0)+000H6Acib)K20250312190435Z0s0q0I0+G+~w#WH6Acib)K9=HBZ\|20250312190435Z20250319190435Z0H=g0d0.Gv>5{-L?r[W F{?M0c7wG,i<B!jh4^)FC7-Vj[1p-

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5956, Parent PID: 1016

Function Logs

General

Target ID:	1
Start time:	20:41:45
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff68aaa0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

COM Activities

WMI Operations

Show Windows behavior

Process Activities

Process Created

Process Terminated

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6948, Parent PID: 5956

Function Logs

General

Target ID:	4
Start time:	20:41:51
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,8748762235944217247,6867490386744010562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2072 /prefetch:3
Imagebase:	0x7ff68aaa0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7316, Parent PID: 5956

Function Logs

General

Target ID:	9
Start time:	20:41:54
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,8748762235944217247,6867490386744010562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4952 /prefetch:8
Imagebase:	0x7ff68aaa0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7524, Parent PID: 1016

Function Logs

General

Target ID:	12
Start time:	20:41:57
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://safety-profiles-fb-ads-156388685.vercel.app/"
Imagebase:	0x7ff68aaa0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://safety-profiles-fb-ads-156388685.vercel.app/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5956, Parent PID: 1016

General

File Activities

File Opened

File Created

File Deleted

File Moved

Other File Operations

Registry Activities

Key Deleted

Key Value Deleted

COM Activities

WMI Operations

Process Activities

Process Created

Process Terminated

Thread Activities

Thread Terminated

Memory Activities

Windows Analysis Report
http://safety-profiles-fb-ads-156388685.vercel.app/