Edit tour

Windows Analysis Report
http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19

Overview

General Information

Sample URL:	http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19
Analysis ID:	1637986
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5324 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2260,i,6001787884130247300,2422151676545335571,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2288 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Suricata Signatures

ETPRO EXPLOIT_KIT FoxTDS Filtered Blacklisted

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T01:53:51.278764+0100	2859624	1	Exploit Kit Activity Detected	185.246.85.93	80	192.168.2.4	49731	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Address: gin_throttle_mw_7200000000_8.46.123.189X-Ratelimit-Limit: 500X-Ratelimit-Remaining: 497X-Ratelimit-Reset: 1741917230Date: Fri, 14 Mar 2025 00:53:51 GMTContent-Length: 0

Source: http://czm11.cavernbeatles.com/t/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19	HTTP Parser: No favicon
Source: http://czm11.cavernbeatles.com/news?q=IP%20provider%20is%20blacklisted!%20LEVEL3	HTTP Parser: No favicon
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No favicon
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No favicon
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No favicon
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No favicon
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No favicon

Source: http://czm11.cavernbeatles.com/	HTTP Parser: No <meta name="author".. found
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No <meta name="author".. found
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No <meta name="author".. found
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No <meta name="author".. found
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No <meta name="author".. found

Source: http://czm11.cavernbeatles.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://czm11.cavernbeatles.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73

Source: global traffic	HTTP traffic detected: GET /rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19 HTTP/1.1Host: czm11.cavernbeatles.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /t/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19 HTTP/1.1Host: czm11.cavernbeatles.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: czm11.cavernbeatles.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://czm11.cavernbeatles.com/t/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /news?q=IP%20provider%20is%20blacklisted!%20LEVEL3 HTTP/1.1Host: czm11.cavernbeatles.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://czm11.cavernbeatles.com/t/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: czm11.cavernbeatles.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://czm11.cavernbeatles.com/news?q=IP%20provider%20is%20blacklisted!%20LEVEL3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/styles.css HTTP/1.1Host: czm11.cavernbeatles.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://czm11.cavernbeatles.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: czm11.cavernbeatles.com
Source: global traffic	DNS traffic detected: DNS query: feeds.foxnews.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2260,i,6001787884130247300,2422151676545335571,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2288 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2260,i,6001787884130247300,2422151676545335571,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2288 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://czm11.cavernbeatles.com/assets/styles.css	0%	Avira URL Cloud	safe
http://czm11.cavernbeatles.com/favicon.ico	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
j.sni.global.fastly.net	151.101.2.132	true	false	high
czm11.cavernbeatles.com	185.246.85.93	true	true	unknown
beacons-handoff.gcp.gvt2.com	142.251.143.35	true	false	high
www.google.com	142.250.185.132	true	false	high
beacons.gvt2.com	142.250.181.227	true	false	high
beacons6.gvt2.com	142.250.186.35	true	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
feeds.foxnews.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
185.246.85.93	czm11.cavernbeatles.com	France	21409	IKOULAFR	true
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
151.101.2.132	j.sni.global.fastly.net	United States	54113	FASTLYUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637986
Start date and time:	2025-03-14 01:52:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@20/10@24/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	2883
Entropy (8bit):	4.855223108468014
Encrypted:	false
SSDEEP:	48:Z+dEJJpI4LLIk6ddLHJy8A3SXUV/ot5CjsEn+yxw4Dj7jvj:j3LLIk6T9yvGssE5x7
MD5:	4C70E6AE58B22DD268F5106D4EE3AE44
SHA1:	0C5646A9F164D08F74FE393211B2F4DC0421010B
SHA-256:	BF7E3FCFBDA05EA1397C425FC2CE4F3D669059AC6F9BBE762A27111AFF3FF310
SHA-512:	DB248ED77A34E0177622C314DE834BC2A215C1B2EABF5D6BDEC717A61C20436A19FB94B4C0C54EDC32636728D2F163B91644EB34E6CC005CD3307EAB89BAA1E0
Malicious:	false
Reputation:	low
URL:	http://czm11.cavernbeatles.com/
Preview:	.............<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Coming Soon - aeroportodiancona.info</title>.. <link rel="stylesheet" href="/assets/styles.css">..</head>.<body>.<div class="container">. <h1>Our Website is Coming Soon!</h1>. <p>We are working hard to give you the best experience. Stay tuned!</p>. <div class="countdown">. <div class="countdown-item">. <span id="days">00</span>. <label>Days</label>. </div>. <div class="countdown-item">. <span id="hours">00</span>. <label>Hours</label>. </div>. <div class="countdown-item">. <span id="minutes">00</span>. <label>Minutes</label>. </div>. <div class="countdown-item">. <span id="seconds">00</span>. <label>Seconds</label>. </div>. </div>.. <form id="subscription-form" on

Name	Malicious	Antivirus Detection	Reputation
http://czm11.cavernbeatles.com/news?q=IP%20provider%20is%20blacklisted!%20LEVEL3	false		unknown
http://czm11.cavernbeatles.com/assets/styles.css	true	Avira URL Cloud: safe	unknown
http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19	true		unknown
http://czm11.cavernbeatles.com/t/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19	false		unknown
http://czm11.cavernbeatles.com/	false		unknown
http://czm11.cavernbeatles.com/favicon.ico	true	Avira URL Cloud: safe	unknown

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 01:53:43.028965950 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:53:43.338982105 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:53:44.010864973 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:53:45.307789087 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:53:47.713844061 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:53:48.191029072 CET	49726	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:53:48.191087008 CET	443	49726	142.250.185.132	192.168.2.4
Mar 14, 2025 01:53:48.191226006 CET	49726	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:53:48.191492081 CET	49726	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:53:48.191515923 CET	443	49726	142.250.185.132	192.168.2.4
Mar 14, 2025 01:53:48.389930010 CET	443	49726	142.250.185.132	192.168.2.4
Mar 14, 2025 01:53:48.390753031 CET	49727	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:53:48.390799999 CET	443	49727	142.250.185.132	192.168.2.4
Mar 14, 2025 01:53:48.390995026 CET	49727	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:53:48.391357899 CET	49727	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:53:48.391374111 CET	443	49727	142.250.185.132	192.168.2.4
Mar 14, 2025 01:53:48.589823961 CET	443	49727	142.250.185.132	192.168.2.4
Mar 14, 2025 01:53:50.030682087 CET	49730	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.030802011 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.035830975 CET	80	49730	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:50.036262035 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:50.036345005 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.036350965 CET	49730	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.062822104 CET	49732	443	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.062872887 CET	443	49732	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:50.062941074 CET	49732	443	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.063225031 CET	49732	443	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.063241005 CET	443	49732	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:50.221271038 CET	49733	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:53:50.221323013 CET	443	49733	23.60.203.209	192.168.2.4
Mar 14, 2025 01:53:50.221417904 CET	49733	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:53:50.223429918 CET	49733	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:53:50.223444939 CET	443	49733	23.60.203.209	192.168.2.4
Mar 14, 2025 01:53:50.224080086 CET	443	49733	23.60.203.209	192.168.2.4
Mar 14, 2025 01:53:50.245995045 CET	49734	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:53:50.246037960 CET	443	49734	23.60.203.209	192.168.2.4
Mar 14, 2025 01:53:50.246114016 CET	49734	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:53:50.246452093 CET	49734	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:53:50.246465921 CET	443	49734	23.60.203.209	192.168.2.4
Mar 14, 2025 01:53:50.246889114 CET	443	49734	23.60.203.209	192.168.2.4
Mar 14, 2025 01:53:50.247201920 CET	49735	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:53:50.247323036 CET	443	49735	23.60.203.209	192.168.2.4
Mar 14, 2025 01:53:50.249629021 CET	49735	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:53:50.253242970 CET	49735	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:53:50.253293991 CET	443	49735	23.60.203.209	192.168.2.4
Mar 14, 2025 01:53:50.253351927 CET	49735	443	192.168.2.4	23.60.203.209
Mar 14, 2025 01:53:50.261593103 CET	443	49732	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:50.262582064 CET	49736	443	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.262598991 CET	443	49736	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:50.262684107 CET	49736	443	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.262979984 CET	49736	443	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.262993097 CET	443	49736	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:50.461664915 CET	443	49736	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:50.531416893 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.536206961 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:50.706698895 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:50.759968042 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.944650888 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:50.949681997 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:51.216758966 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:51.266678095 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:51.274039984 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:51.278764009 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:51.449297905 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:51.493920088 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:51.776316881 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:53:52.076679945 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:53:52.280495882 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:52.285300970 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:52.456248045 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:52.456268072 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:52.456279993 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:52.456291914 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:53:52.456321955 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:52.456352949 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:53:52.514936924 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:53:52.548381090 CET	49739	443	192.168.2.4	151.101.2.132
Mar 14, 2025 01:53:52.548415899 CET	443	49739	151.101.2.132	192.168.2.4
Mar 14, 2025 01:53:52.548504114 CET	49739	443	192.168.2.4	151.101.2.132
Mar 14, 2025 01:53:52.549041033 CET	49739	443	192.168.2.4	151.101.2.132
Mar 14, 2025 01:53:52.549062967 CET	443	49739	151.101.2.132	192.168.2.4
Mar 14, 2025 01:53:52.679879904 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:53:52.749385118 CET	443	49739	151.101.2.132	192.168.2.4
Mar 14, 2025 01:53:52.749917030 CET	49740	443	192.168.2.4	151.101.2.132
Mar 14, 2025 01:53:52.749974966 CET	443	49740	151.101.2.132	192.168.2.4
Mar 14, 2025 01:53:52.750030994 CET	49740	443	192.168.2.4	151.101.2.132
Mar 14, 2025 01:53:52.750333071 CET	49740	443	192.168.2.4	151.101.2.132
Mar 14, 2025 01:53:52.750350952 CET	443	49740	151.101.2.132	192.168.2.4
Mar 14, 2025 01:53:52.949479103 CET	443	49740	151.101.2.132	192.168.2.4
Mar 14, 2025 01:53:53.885481119 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:53:56.291785955 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:53:56.523350000 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:53:56.823049068 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:53:57.432410002 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:53:58.318084955 CET	49745	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.318151951 CET	443	49745	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.322179079 CET	49745	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.323199034 CET	49745	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.323219061 CET	443	49745	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.323821068 CET	443	49745	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.383498907 CET	49746	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.383543015 CET	443	49746	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.383852959 CET	49746	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.383948088 CET	49746	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.383965015 CET	443	49746	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.384447098 CET	443	49746	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.429555893 CET	49747	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.429603100 CET	443	49747	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.429733992 CET	49747	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.430180073 CET	49747	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.430197954 CET	443	49747	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.430783987 CET	443	49747	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.464066029 CET	49748	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.464107990 CET	443	49748	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.464243889 CET	49748	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.466104984 CET	49748	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.466124058 CET	443	49748	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.466540098 CET	443	49748	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.529576063 CET	49749	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.529649973 CET	443	49749	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.529757023 CET	49749	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.530066967 CET	49749	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.530080080 CET	443	49749	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.530524015 CET	443	49749	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.553687096 CET	49750	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.553741932 CET	443	49750	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.553845882 CET	49750	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.554085970 CET	49750	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.554100037 CET	443	49750	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.554445028 CET	443	49750	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.593417883 CET	49751	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.593452930 CET	443	49751	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.593511105 CET	49751	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.593808889 CET	49751	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.593823910 CET	443	49751	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.594249964 CET	443	49751	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.635569096 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:53:58.645361900 CET	49752	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.645473957 CET	443	49752	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.645569086 CET	49752	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.645906925 CET	49752	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:53:58.645940065 CET	443	49752	20.12.23.50	192.168.2.4
Mar 14, 2025 01:53:58.646469116 CET	443	49752	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:01.042247057 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:54:01.104768991 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:54:02.120795965 CET	49671	443	192.168.2.4	204.79.197.203
Mar 14, 2025 01:54:05.854757071 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:54:10.715507984 CET	49678	443	192.168.2.4	20.189.173.27
Mar 14, 2025 01:54:15.411890030 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:54:15.417423964 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:54:15.465759993 CET	49681	80	192.168.2.4	2.17.190.73
Mar 14, 2025 01:54:15.587939024 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:54:15.587966919 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:54:15.587985039 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:54:15.588047028 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:54:15.638113976 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:54:15.838443995 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:54:15.843194008 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:54:16.013895988 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:54:16.013910055 CET	80	49731	185.246.85.93	192.168.2.4
Mar 14, 2025 01:54:16.013958931 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:54:21.208086967 CET	49765	80	192.168.2.4	172.217.18.3
Mar 14, 2025 01:54:21.212806940 CET	80	49765	172.217.18.3	192.168.2.4
Mar 14, 2025 01:54:21.212867975 CET	49765	80	192.168.2.4	172.217.18.3
Mar 14, 2025 01:54:21.213356018 CET	49765	80	192.168.2.4	172.217.18.3
Mar 14, 2025 01:54:21.217977047 CET	80	49765	172.217.18.3	192.168.2.4
Mar 14, 2025 01:54:21.835282087 CET	80	49765	172.217.18.3	192.168.2.4
Mar 14, 2025 01:54:21.840696096 CET	49765	80	192.168.2.4	172.217.18.3
Mar 14, 2025 01:54:21.845371962 CET	80	49765	172.217.18.3	192.168.2.4
Mar 14, 2025 01:54:22.021383047 CET	80	49765	172.217.18.3	192.168.2.4
Mar 14, 2025 01:54:22.088449001 CET	49765	80	192.168.2.4	172.217.18.3
Mar 14, 2025 01:54:34.961442947 CET	49773	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:34.961494923 CET	443	49773	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:34.961575031 CET	49773	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:34.961899996 CET	49773	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:34.961915016 CET	443	49773	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:34.962515116 CET	443	49773	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:34.965487003 CET	49774	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:34.965534925 CET	443	49774	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:34.965603113 CET	49774	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:34.965873003 CET	49774	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:34.965886116 CET	443	49774	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:34.966257095 CET	443	49774	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.002146959 CET	49775	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.002186060 CET	443	49775	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.002264023 CET	49775	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.002557993 CET	49775	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.002568960 CET	443	49775	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.002918959 CET	443	49775	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.021733999 CET	49776	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.021770000 CET	443	49776	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.021826029 CET	49776	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.022114992 CET	49776	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.022129059 CET	443	49776	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.022538900 CET	443	49776	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.041498899 CET	49730	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:54:35.046149969 CET	49777	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.046224117 CET	443	49777	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.046305895 CET	49777	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.046566963 CET	49777	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.046586037 CET	443	49777	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.046905041 CET	443	49777	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.046926975 CET	80	49730	185.246.85.93	192.168.2.4
Mar 14, 2025 01:54:35.081752062 CET	49778	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.081845999 CET	443	49778	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.081926107 CET	49778	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.082212925 CET	49778	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.082231045 CET	443	49778	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.082582951 CET	443	49778	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.116449118 CET	49779	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.116497993 CET	443	49779	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.116558075 CET	49779	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.116904020 CET	49779	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.116914988 CET	443	49779	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.117286921 CET	443	49779	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.150599957 CET	49780	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.150623083 CET	443	49780	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.150669098 CET	49780	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.150959969 CET	49780	443	192.168.2.4	20.12.23.50
Mar 14, 2025 01:54:35.150969982 CET	443	49780	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:35.151335955 CET	443	49780	20.12.23.50	192.168.2.4
Mar 14, 2025 01:54:48.246721029 CET	49790	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:54:48.246793032 CET	443	49790	142.250.185.132	192.168.2.4
Mar 14, 2025 01:54:48.246860981 CET	49790	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:54:48.247178078 CET	49790	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:54:48.247195959 CET	443	49790	142.250.185.132	192.168.2.4
Mar 14, 2025 01:54:48.445298910 CET	443	49790	142.250.185.132	192.168.2.4
Mar 14, 2025 01:54:48.445888996 CET	49791	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:54:48.445929050 CET	443	49791	142.250.185.132	192.168.2.4
Mar 14, 2025 01:54:48.446002007 CET	49791	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:54:48.446306944 CET	49791	443	192.168.2.4	142.250.185.132
Mar 14, 2025 01:54:48.446319103 CET	443	49791	142.250.185.132	192.168.2.4
Mar 14, 2025 01:54:48.645543098 CET	443	49791	142.250.185.132	192.168.2.4
Mar 14, 2025 01:54:50.715437889 CET	49730	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:54:50.720448017 CET	80	49730	185.246.85.93	192.168.2.4
Mar 14, 2025 01:54:50.720526934 CET	49730	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:55:01.026643991 CET	49731	80	192.168.2.4	185.246.85.93
Mar 14, 2025 01:55:01.031450033 CET	80	49731	185.246.85.93	192.168.2.4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 01:53:44.648801088 CET	53	54760	1.1.1.1	192.168.2.4
Mar 14, 2025 01:53:44.714888096 CET	53	55648	1.1.1.1	192.168.2.4
Mar 14, 2025 01:53:48.183479071 CET	63323	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:53:48.183619022 CET	49836	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:53:48.190181971 CET	53	49836	1.1.1.1	192.168.2.4
Mar 14, 2025 01:53:48.190196991 CET	53	63323	1.1.1.1	192.168.2.4
Mar 14, 2025 01:53:50.013650894 CET	59130	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:53:50.016819954 CET	59355	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:53:50.026855946 CET	53	59130	1.1.1.1	192.168.2.4
Mar 14, 2025 01:53:50.029987097 CET	53	59355	1.1.1.1	192.168.2.4
Mar 14, 2025 01:53:50.040178061 CET	65172	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:53:50.040328026 CET	61001	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:53:50.061614037 CET	53	61001	1.1.1.1	192.168.2.4
Mar 14, 2025 01:53:50.062058926 CET	53	65172	1.1.1.1	192.168.2.4
Mar 14, 2025 01:53:52.524221897 CET	57240	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:53:52.524712086 CET	55968	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:53:52.546314955 CET	53	55968	1.1.1.1	192.168.2.4
Mar 14, 2025 01:53:52.546994925 CET	53	57240	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:16.063039064 CET	53	52103	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:44.208892107 CET	53	51412	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:44.618257046 CET	53	60681	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:45.351607084 CET	53	53723	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:46.365870953 CET	54107	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:54:46.366156101 CET	57800	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:54:46.372828960 CET	53	54107	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:46.372844934 CET	53	57800	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:47.385952950 CET	61313	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:54:47.386089087 CET	52226	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:54:47.392752886 CET	53	61313	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:47.392931938 CET	53	52226	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:49.423064947 CET	57089	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:54:49.429709911 CET	53	57089	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:50.432570934 CET	57089	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:54:50.439208031 CET	53	57089	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:51.420296907 CET	138	138	192.168.2.4	192.168.2.255
Mar 14, 2025 01:54:51.433108091 CET	57089	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:54:51.439837933 CET	53	57089	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:53.448519945 CET	57089	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:54:53.455379009 CET	53	57089	1.1.1.1	192.168.2.4
Mar 14, 2025 01:54:57.463745117 CET	57089	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:54:57.470390081 CET	53	57089	1.1.1.1	192.168.2.4
Mar 14, 2025 01:55:01.671489954 CET	50472	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:55:01.671771049 CET	49297	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:55:01.678333998 CET	53	49297	1.1.1.1	192.168.2.4
Mar 14, 2025 01:55:01.678350925 CET	53	50472	1.1.1.1	192.168.2.4
Mar 14, 2025 01:55:02.682746887 CET	64185	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:55:02.691037893 CET	53	64185	1.1.1.1	192.168.2.4
Mar 14, 2025 01:55:04.716048002 CET	64231	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:55:04.722959042 CET	53	64231	1.1.1.1	192.168.2.4
Mar 14, 2025 01:55:05.729640961 CET	64231	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:55:05.738375902 CET	53	64231	1.1.1.1	192.168.2.4
Mar 14, 2025 01:55:06.729918003 CET	64231	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:55:06.737422943 CET	53	64231	1.1.1.1	192.168.2.4
Mar 14, 2025 01:55:08.745157957 CET	64231	53	192.168.2.4	1.1.1.1
Mar 14, 2025 01:55:08.752121925 CET	53	64231	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Mar 14, 2025 01:53:50.531416893 CET	502	OUT	GET /rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19 HTTP/1.1 Host: czm11.cavernbeatles.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 14, 2025 01:53:50.706698895 CET	487	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Address: gin_throttle_mw_7200000000_8.46.123.189 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 499 X-Ratelimit-Reset: 1741917230 Date: Fri, 14 Mar 2025 00:53:50 GMT Content-Length: 235 Data Raw: 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 74 61 72 63 6b 69 6e 67 5f 70 61 72 61 6d 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 73 70 6c 69 74 28 27 23 27 29 5b 31 5d 3b 0a 69 66 28 21 74 61 72 63 6b 69 6e 67 5f 70 61 72 61 6d 29 7b 0a 09 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 72 65 70 6c 61 63 65 28 22 2f 72 64 2f 22 2c 20 22 2f 74 2f 22 29 3b 0a 7d 65 6c 73 65 7b 0a 09 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 2f 74 2f 27 2b 74 61 72 63 6b 69 6e 67 5f 70 61 72 61 6d 3b 0a 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 3e 3c 2f 70 3e 0a Data Ascii: <script>var tarcking_param = window.location.href.split('#')[1];if(!tarcking_param){document.location.href = document.location.href.replace("/rd/", "/t/");}else{document.location.href = '/t/'+tarcking_param;}</script><p></p>
Mar 14, 2025 01:53:50.944650888 CET	607	OUT	GET /t/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19 HTTP/1.1 Host: czm11.cavernbeatles.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 14, 2025 01:53:51.216758966 CET	462	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Address: gin_throttle_mw_7200000000_8.46.123.189 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 498 X-Ratelimit-Reset: 1741917230 Date: Fri, 14 Mar 2025 00:53:51 GMT Content-Length: 210 Data Raw: 3c 73 63 72 69 70 74 3e 0a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 2f 6e 65 77 73 3f 71 3d 49 50 20 70 72 6f 76 69 64 65 72 20 69 73 20 62 6c 61 63 6b 6c 69 73 74 65 64 21 20 4c 45 56 45 4c 33 27 3b 20 0a 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 72 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 6e 65 77 73 3f 71 3d 49 50 20 70 72 6f 76 69 64 65 72 20 69 73 20 62 6c 61 63 6b 6c 69 73 74 65 64 21 20 4c 45 56 45 4c 33 27 29 3b 0a 7d 2c 20 31 30 30 30 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 3e 3c 2f 70 3e 0a Data Ascii: <script>setTimeout(function(){ window.location.href = '/news?q=IP provider is blacklisted! LEVEL3'; console.log('redirecting to /news?q=IP provider is blacklisted! LEVEL3');}, 1000);</script><p></p>
Mar 14, 2025 01:53:51.274039984 CET	453	OUT	GET /favicon.ico HTTP/1.1 Host: czm11.cavernbeatles.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://czm11.cavernbeatles.com/t/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 14, 2025 01:53:51.449297905 CET	258	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Address: gin_throttle_mw_7200000000_8.46.123.189 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 497 X-Ratelimit-Reset: 1741917230 Date: Fri, 14 Mar 2025 00:53:51 GMT Content-Length: 0
Mar 14, 2025 01:53:52.280495882 CET	592	OUT	GET /news?q=IP%20provider%20is%20blacklisted!%20LEVEL3 HTTP/1.1 Host: czm11.cavernbeatles.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://czm11.cavernbeatles.com/t/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 14, 2025 01:53:52.456248045 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Address: gin_throttle_mw_7200000000_8.46.123.189 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 496 X-Ratelimit-Reset: 1741917230 Date: Fri, 14 Mar 2025 00:53:52 GMT Transfer-Encoding: chunked Data Raw: 38 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 78 20 4e 65 77 73 20 57 6f 72 6c 64 20 52 53 53 20 46 65 65 64 20 20 2d 20 61 65 72 6f 70 6f 72 74 6f 64 69 61 6e 63 6f 6e 61 2e 69 6e 66 6f 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 34 66 36 66 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: 800<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Fox News World RSS Feed - aeroportodiancona.info </title> <style> body { font-family: Arial, sans-serif; background-color: #f4f6f9; color: #333; margin: 0; padding: 0; } .container { width: 80%; margin: 0 auto; } h1 { font-size: 2rem; margin: 2rem 0; } .news-item { background-color: white; padding: 1.5rem; margin-bottom: 1rem; box-shadow: 0 1px 3px rgba(0, 0, 0, 0.12), 0 1px 2px rgba(0, 0, 0, 0.24); } .news-item h2 { font-size: 1.5rem; margin-bottom: 1rem; } .news-item a { color: #1a73e8; text-decoration: none;
Mar 14, 2025 01:53:52.456268072 CET	224	IN	Data Raw: 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 6e 65 77 73 2d 69 74 65 6d 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 20 20 Data Ascii: } .news-item a:hover { text-decoration: underline; } .news-item p { font-size: 1rem; margin-bottom: 0; } </style></head><body><div class="
Mar 14, 2025 01:53:52.456279993 CET	1236	IN	Data Raw: 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 68 31 3e 46 6f 78 20 4e 65 77 73 20 57 6f 72 6c 64 20 52 53 53 20 46 65 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 42 61 63 6b 20 74 6f 20 74 68 65 20 6d 61 69 6e 20 Data Ascii: container"> <h1>Fox News World RSS Feed</h1> <a href="/">Back to the main page</a> <br> <h6 id="msg"></h6> <hr> <div id="news-items"> </div></div><script> const fetchRSSFeed = async (url) => {
Mar 14, 2025 01:53:52.456291914 CET	783	IN	Data Raw: 63 6f 6e 74 65 6e 74 45 6c 65 6d 65 6e 74 20 3f 20 63 6f 6e 74 65 6e 74 45 6c 65 6d 65 6e 74 2e 74 65 78 74 43 6f 6e 74 65 6e 74 20 3a 20 22 4e 6f 20 63 6f 6e 74 65 6e 74 20 61 76 61 69 6c 61 62 6c 65 2e 22 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: contentElement ? contentElement.textContent : "No content available."; const newsItem = document.createElement("div"); newsItem.classList.add("news-item"); newsItem.innerHTML = ` <h2><a href="$
Mar 14, 2025 01:54:15.411890030 CET	529	OUT	GET / HTTP/1.1 Host: czm11.cavernbeatles.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://czm11.cavernbeatles.com/news?q=IP%20provider%20is%20blacklisted!%20LEVEL3 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 14, 2025 01:54:15.587939024 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Address: gin_throttle_mw_7200000000_8.46.123.189 X-Ratelimit-Limit: 500 X-Ratelimit-Remaining: 495 X-Ratelimit-Reset: 1741917230 Date: Fri, 14 Mar 2025 00:54:15 GMT Transfer-Encoding: chunked Data Raw: 38 30 30 0d 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 6d 69 6e 67 20 53 6f 6f 6e 20 2d 20 61 65 72 6f 70 6f 72 74 6f 64 69 61 6e 63 6f 6e 61 2e 69 6e 66 6f 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 68 31 3e 4f 75 72 20 57 65 62 73 69 74 65 20 69 73 20 43 6f 6d 69 [TRUNCATED] Data Ascii: 800<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Coming Soon - aeroportodiancona.info</title> <link rel="stylesheet" href="/assets/styles.css"></head><body><div class="container"> <h1>Our Website is Coming Soon!</h1> <p>We are working hard to give you the best experience. Stay tuned!</p> <div class="countdown"> <div class="countdown-item"> <span id="days">00</span> <label>Days</label> </div> <div class="countdown-item"> <span id="hours">00</span> <label>Hours</label> </div> <div class="countdown-item"> <span id="minutes">00</span> <label>Minutes</label> </div> <div class="countdown-item"> <span id="seconds">00</span> <label>Seconds</label> </div> </div> <fo
Mar 14, 2025 01:54:15.587966919 CET	1236	IN	Data Raw: 72 6d 20 69 64 3d 22 73 75 62 73 63 72 69 70 74 69 6f 6e 2d 66 6f 72 6d 22 20 6f 6e 73 75 62 6d 69 74 3d 22 73 75 62 6d 69 74 46 6f 72 6d 28 65 76 65 6e 74 29 22 3e 0a 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 65 6d 61 69 6c Data Ascii: rm id="subscription-form" onsubmit="submitForm(event)"> <input type="email" id="email" placeholder="Enter your email" required> <button type="submit">Subscribe</button> <p id="subscription-message"></p> </form>
Mar 14, 2025 01:54:15.587985039 CET	689	IN	Data Raw: 65 6d 61 69 6e 69 6e 67 20 25 20 28 31 30 30 30 20 2a 0a 20 20 20 20 20 20 20 20 20 20 20 20 36 30 29 29 20 2f 20 31 30 30 30 29 3b 0a 0a 20 20 20 20 20 20 20 20 64 61 79 73 45 6c 65 6d 65 6e 74 2e 74 65 78 74 43 6f 6e 74 65 6e 74 20 3d 20 64 61 Data Ascii: emaining % (1000 * 60)) / 1000); daysElement.textContent = days.toString().padStart(2, '0'); hoursElement.textContent = hours.toString().padStart(2, '0'); minutesElement.textContent = minutes.toString().pad
Mar 14, 2025 01:54:15.838443995 CET	350	OUT	GET /assets/styles.css HTTP/1.1 Host: czm11.cavernbeatles.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://czm11.cavernbeatles.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 14, 2025 01:54:16.013895988 CET	1236	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 1435 Content-Type: text/css; charset=utf-8 Last-Modified: Tue, 11 Mar 2025 23:57:36 GMT Date: Fri, 14 Mar 2025 00:54:15 GMT Data Raw: 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 30 66 30 66 30 3b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 76 68 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 0a 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 33 30 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 31 30 70 78 3b 0a 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 34 70 78 20 36 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 29 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: body { font-family: Arial, sans-serif; background-color: #f0f0f0; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; padding: 0;}.container { background-color: #ffffff; padding: 30px; border-radius: 10px; box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1); text-align: center;}h1 { font-size: 36px; margin-bottom: 20px; color: #333;}p { font-size: 18px; color: #777; margin-bottom: 40px;}.countdown { display: flex; justify-content: center; margin-bottom: 40px;}.countdown-item { display: inline-block; margin: 0 10px;}.countdown-item span { font-size: 24px; color: #444;}.countdown-item label { display: block; font-size: 14px; color: #999;}form { display: flex; justify-content: center; align-items: center; flex-direction: column;}input[type="email"] { font-size: 16px; padding: 10px; border: 1px solid #ccc; [TRUNCATED]
Mar 14, 2025 01:54:16.013910055 CET	384	IN	Data Raw: 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 33 30 30 70 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 7d 0a 0a 62 75 74 74 6f 6e 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 20 Data Ascii: max-width: 300px; margin-bottom: 20px;}button { font-size: 16px; padding: 10px 20px; background-color: #333; color: #fff; border: none; border-radius: 5px; cursor: pointer; transition: background-color
Mar 14, 2025 01:55:01.026643991 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Mar 14, 2025 01:54:21.213356018 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 14, 2025 01:54:21.835282087 CET	223	IN	HTTP/1.1 304 Not Modified Date: Fri, 14 Mar 2025 00:34:27 GMT Expires: Fri, 14 Mar 2025 01:24:27 GMT Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding Age: 1194
Mar 14, 2025 01:54:21.840696096 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 14, 2025 01:54:22.021383047 CET	223	IN	HTTP/1.1 304 Not Modified Date: Fri, 14 Mar 2025 00:34:22 GMT Expires: Fri, 14 Mar 2025 01:24:22 GMT Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding Age: 1199

Target ID:	1
Start time:	20:53:40
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	20:53:42
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2260,i,6001787884130247300,2422151676545335571,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2288 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	20:53:48
Start date:	13/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 45

Chrome Cache Entry: 46

Chrome Cache Entry: 47

Chrome Cache Entry: 48

Chrome Cache Entry: 49

Static File Info

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5324, Parent PID: 3452

General

File Activities

File Opened

File Created

File Deleted

File Moved

Other File Operations

Registry Activities

Key Deleted

Windows Analysis Report
http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre