Edit tour

Windows Analysis Report
https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy

Overview

General Information

Sample URL:	https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy
Analysis ID:	1587232
Infos:

Detection

Phisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected Phisher

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1924,i,17618142120864592884,626483772498086810,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_43	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://announce-sign.es/account.intuit.com

Avira URL Cloud: Label: malware

Phishing

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_43, type: DROPPED

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	UDP traffic detected without corresponding DNS query: 20.101.57.9
Source: unknown	UDP traffic detected without corresponding DNS query: 20.101.57.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /entity/360001472 HTTP/1.1Host: ameyokonet.jpConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: https://www.google.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /entity/360001472/ HTTP/1.1Host: ameyokonet.jpConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: https://www.google.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ameyokonet.jp
Source: global traffic	DNS traffic detected: DNS query: announce-sign.es
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: chromecache_42.6.dr	String found in binary or memory: http://ameyokonet.jp/entity/360001472
Source: chromecache_43.6.dr	String found in binary or memory: https://announce-sign.es/account.intuit.com

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: classification engine

Classification label: mal56.phis.win@25/4@56/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1924,i,17618142120864592884,626483772498086810,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1924,i,17618142120864592884,626483772498086810,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://ameyokonet.jp/entity/360001472	0%	Avira URL Cloud	safe
http://ameyokonet.jp/entity/360001472/	0%	Avira URL Cloud	safe
https://announce-sign.es/account.intuit.com	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
google.com	172.217.18.14	true	false	high
www.google.com	142.250.181.228	true	false	high
ameyokonet.jp	133.130.72.11	true	false	unknown
announce-sign.es	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ameyokonet.jp/entity/360001472	false	Avira URL Cloud: safe	unknown
http://ameyokonet.jp/entity/360001472/	false	Avira URL Cloud: safe	unknown
https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://announce-sign.es/account.intuit.com	chromecache_43.6.dr	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
133.130.72.11	ameyokonet.jp	Japan	7506	INTERQGMOInternetIncJP	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.7
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587232
Start date and time:	2025-01-10 01:12:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@25/4@56/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.227, 66.102.1.84, 142.250.186.78, 142.250.184.206, 216.58.206.78, 142.250.181.238, 199.232.210.172, 142.250.185.78, 142.250.185.142, 142.250.186.46, 142.250.185.195, 172.217.16.206, 13.107.246.45, 23.56.254.164, 52.149.20.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: https://www.google.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.google.com
URL: http://ameyokonet.jp/entity/360001472/... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script redirects the user to a suspicious domain, which is a moderate-risk indicator. While the domain name suggests it may be related to Intuit, the overall context is unclear, warranting further investigation." }
window.location.href = "https://announce-sign.es/account.intuit.com"

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 42

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (508)
Category:	downloaded
Size (bytes):	707
Entropy (8bit):	5.415273461691672
Encrypted:	false
SSDEEP:	12:TwI6hYJtuDLp2kdQAw/GoVN/4ZsWLIVo1f4fUGMVRaVZO1zilGquABAtwQMQsb:TMDjdK7VNgJ4ffMVEVZO1zipBAtwQMQ6
MD5:	D4993727A32BE1CA7C776976AACEE36F
SHA1:	6216EB79B4467975994BE4A6586A6E1CC023856E
SHA-256:	A8E066DB2669E877BB6403B29B8D563650E0050B199AEA5A0EE6CB07FE0CC8E0
SHA-512:	67FADD6C6C582B3993BE28EC88A4EAEC45B67F28324CD664CDBB0D33BEC0850EB44463761AFC910F16F5BA5458DDC9C5CD4CFF2AE559ABDB335F62846335D77A
Malicious:	false
Reputation:	low
URL:	https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy
Preview:	<html lang="en"> <head> <meta content="origin" name="referrer"> <script nonce="oKb_cN4csXtW7eCx5l--2w">window.google = {};(function(){.var d=/^\s(?!javascript:)(?:[\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;.(this\|\|self).google.navigateTo=function(a,c,b){!/\/.*?[&?]gsc=1/.test(c.location.href)&&a!==c&&a.google?a.google.r&&(a.google.r=0,a=a.location,b=d.test(b)?b:void 0,b!==void 0&&(a.href=b),c.location.replace("about:blank")):c.location.replace(b)};}).call(this);(function(){var redirectUrl='http://ameyokonet.jp/entity/360001472';google.navigateTo(parent,window,redirectUrl);})();</script> <noscript> <meta content="0;url=http://ameyokonet.jp/entity/360001472" http-equiv="refresh"> </noscript> </head> </html>

Chrome Cache Entry: 43

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	109
Entropy (8bit):	4.570046000062992
Encrypted:	false
SSDEEP:	3:gnkAqRAdu6/GY7voOkADFoHDKtTDRYLn:7AqJm7+mmHg/RYL
MD5:	628FFABDA26BF416093699D4DD44C7FC
SHA1:	1EBCF9CFDA6027DBD8F274341044EB7AD2E62D7B
SHA-256:	6FDD52BE3D5153AAA2B1699A9A4E6C090B20943D99D4CB0660C8768E4F96F36C
SHA-512:	BD3BA2577EC4E10ECEB3CC7010F75B13EC99197A3E9C455240D6F36CF6397E1291917593BF103DA3EA24219C8347AFC40B35860A4F610785661FFF57C8F44494
Malicious:	false
Reputation:	low
URL:	http://ameyokonet.jp/entity/360001472/
Preview:	<script type="text/javascript">window.location.href = "https://announce-sign.es/account.intuit.com"</script>.

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 01:13:02.058275938 CET	49671	443	192.168.2.7	204.79.197.203
Jan 10, 2025 01:13:05.245767117 CET	49674	443	192.168.2.7	104.98.116.138
Jan 10, 2025 01:13:05.247287989 CET	49675	443	192.168.2.7	104.98.116.138
Jan 10, 2025 01:13:05.417663097 CET	49672	443	192.168.2.7	104.98.116.138
Jan 10, 2025 01:13:06.075589895 CET	49677	443	192.168.2.7	20.50.201.200
Jan 10, 2025 01:13:06.449007988 CET	49677	443	192.168.2.7	20.50.201.200
Jan 10, 2025 01:13:06.870945930 CET	49671	443	192.168.2.7	204.79.197.203
Jan 10, 2025 01:13:07.198903084 CET	49677	443	192.168.2.7	20.50.201.200
Jan 10, 2025 01:13:08.698992014 CET	49677	443	192.168.2.7	20.50.201.200
Jan 10, 2025 01:13:11.731178045 CET	49677	443	192.168.2.7	20.50.201.200
Jan 10, 2025 01:13:15.042659998 CET	49674	443	192.168.2.7	104.98.116.138
Jan 10, 2025 01:13:15.042678118 CET	49675	443	192.168.2.7	104.98.116.138
Jan 10, 2025 01:13:15.136835098 CET	49672	443	192.168.2.7	104.98.116.138
Jan 10, 2025 01:13:16.480071068 CET	49671	443	192.168.2.7	204.79.197.203
Jan 10, 2025 01:13:17.069539070 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:17.069550037 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:17.069771051 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:17.069972992 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:17.069984913 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:17.438579082 CET	443	49699	104.98.116.138	192.168.2.7
Jan 10, 2025 01:13:17.438704967 CET	49699	443	192.168.2.7	104.98.116.138
Jan 10, 2025 01:13:17.685115099 CET	49677	443	192.168.2.7	20.50.201.200
Jan 10, 2025 01:13:17.721776962 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:17.722158909 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:17.722183943 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:17.723197937 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:17.723262072 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:17.727288008 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:17.727402925 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:17.778848886 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:17.778873920 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:17.825731039 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:18.722125053 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:18.767334938 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:18.935628891 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:18.935775995 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:18.935930967 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:18.938213110 CET	49724	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:13:18.938236952 CET	443	49724	142.250.181.228	192.168.2.7
Jan 10, 2025 01:13:19.747973919 CET	49746	80	192.168.2.7	133.130.72.11
Jan 10, 2025 01:13:19.748430014 CET	49747	80	192.168.2.7	133.130.72.11
Jan 10, 2025 01:13:19.752827883 CET	80	49746	133.130.72.11	192.168.2.7
Jan 10, 2025 01:13:19.752907038 CET	49746	80	192.168.2.7	133.130.72.11
Jan 10, 2025 01:13:19.753087997 CET	49746	80	192.168.2.7	133.130.72.11
Jan 10, 2025 01:13:19.753233910 CET	80	49747	133.130.72.11	192.168.2.7
Jan 10, 2025 01:13:19.753282070 CET	49747	80	192.168.2.7	133.130.72.11
Jan 10, 2025 01:13:19.757839918 CET	80	49746	133.130.72.11	192.168.2.7
Jan 10, 2025 01:13:21.018506050 CET	80	49746	133.130.72.11	192.168.2.7
Jan 10, 2025 01:13:21.018646955 CET	80	49746	133.130.72.11	192.168.2.7
Jan 10, 2025 01:13:21.018707037 CET	49746	80	192.168.2.7	133.130.72.11
Jan 10, 2025 01:13:21.019100904 CET	49746	80	192.168.2.7	133.130.72.11
Jan 10, 2025 01:13:21.021873951 CET	49747	80	192.168.2.7	133.130.72.11
Jan 10, 2025 01:13:21.024590015 CET	80	49746	133.130.72.11	192.168.2.7
Jan 10, 2025 01:13:21.026701927 CET	80	49747	133.130.72.11	192.168.2.7
Jan 10, 2025 01:13:21.682008028 CET	80	49747	133.130.72.11	192.168.2.7
Jan 10, 2025 01:13:21.682158947 CET	80	49747	133.130.72.11	192.168.2.7
Jan 10, 2025 01:13:21.682322979 CET	49747	80	192.168.2.7	133.130.72.11
Jan 10, 2025 01:13:21.683249950 CET	49747	80	192.168.2.7	133.130.72.11
Jan 10, 2025 01:13:21.688057899 CET	80	49747	133.130.72.11	192.168.2.7
Jan 10, 2025 01:13:29.599087954 CET	49677	443	192.168.2.7	20.50.201.200
Jan 10, 2025 01:14:17.124619007 CET	49982	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:14:17.124695063 CET	443	49982	142.250.181.228	192.168.2.7
Jan 10, 2025 01:14:17.124798059 CET	49982	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:14:17.125097990 CET	49982	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:14:17.125111103 CET	443	49982	142.250.181.228	192.168.2.7
Jan 10, 2025 01:14:17.780874968 CET	443	49982	142.250.181.228	192.168.2.7
Jan 10, 2025 01:14:17.786437035 CET	49982	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:14:17.786475897 CET	443	49982	142.250.181.228	192.168.2.7
Jan 10, 2025 01:14:17.786806107 CET	443	49982	142.250.181.228	192.168.2.7
Jan 10, 2025 01:14:17.787187099 CET	49982	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:14:17.787242889 CET	443	49982	142.250.181.228	192.168.2.7
Jan 10, 2025 01:14:17.829907894 CET	49982	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:14:27.683217049 CET	443	49982	142.250.181.228	192.168.2.7
Jan 10, 2025 01:14:27.683294058 CET	443	49982	142.250.181.228	192.168.2.7
Jan 10, 2025 01:14:27.683353901 CET	49982	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:14:28.790430069 CET	49982	443	192.168.2.7	142.250.181.228
Jan 10, 2025 01:14:28.790483952 CET	443	49982	142.250.181.228	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 01:13:11.898605108 CET	123	123	192.168.2.7	20.101.57.9
Jan 10, 2025 01:13:12.077821016 CET	123	123	20.101.57.9	192.168.2.7
Jan 10, 2025 01:13:12.557600021 CET	53	56826	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:12.711265087 CET	53	59939	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:13.490820885 CET	123	123	192.168.2.7	20.101.57.9
Jan 10, 2025 01:13:13.702056885 CET	123	123	20.101.57.9	192.168.2.7
Jan 10, 2025 01:13:13.964378119 CET	53	59251	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:17.061407089 CET	64461	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:17.061407089 CET	64134	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:17.068376064 CET	53	64461	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:17.068517923 CET	53	64134	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:19.021934986 CET	62480	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:19.022231102 CET	55927	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:19.521883965 CET	53	55927	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:19.747298002 CET	53	62480	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:21.788855076 CET	61188	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:21.789108992 CET	59154	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:22.807779074 CET	50561	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:22.814789057 CET	61382	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:24.841718912 CET	60547	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:25.858788013 CET	60547	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:26.876239061 CET	60547	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:28.883861065 CET	60547	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:30.884836912 CET	53	60499	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:32.886604071 CET	60547	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:36.912513018 CET	56718	53	192.168.2.7	8.8.8.8
Jan 10, 2025 01:13:36.913072109 CET	53040	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:36.919610977 CET	53	53040	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:36.920886993 CET	53	56718	8.8.8.8	192.168.2.7
Jan 10, 2025 01:13:37.930058002 CET	65420	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:37.930200100 CET	50178	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:38.950364113 CET	57946	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:38.950529099 CET	55842	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:41.007796049 CET	55668	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:42.012913942 CET	55668	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:43.013465881 CET	55668	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:45.028397083 CET	55668	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:49.043140888 CET	55668	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:49.779587984 CET	53	50096	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:53.057374954 CET	52547	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:53.057921886 CET	51305	53	192.168.2.7	8.8.8.8
Jan 10, 2025 01:13:53.065790892 CET	53	52547	1.1.1.1	192.168.2.7
Jan 10, 2025 01:13:53.066258907 CET	53	51305	8.8.8.8	192.168.2.7
Jan 10, 2025 01:13:56.649139881 CET	60674	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:56.649276972 CET	56850	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:57.668569088 CET	57194	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:57.668761015 CET	56977	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:13:59.701510906 CET	59585	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:00.715387106 CET	59585	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:01.716077089 CET	59585	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:03.717484951 CET	59585	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:06.587351084 CET	138	138	192.168.2.7	192.168.2.255
Jan 10, 2025 01:14:07.732006073 CET	59585	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:11.746978998 CET	63896	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:11.747550964 CET	56051	53	192.168.2.7	8.8.8.8
Jan 10, 2025 01:14:11.753658056 CET	53	63896	1.1.1.1	192.168.2.7
Jan 10, 2025 01:14:11.754333019 CET	53	56051	8.8.8.8	192.168.2.7
Jan 10, 2025 01:14:12.368345022 CET	53	62179	1.1.1.1	192.168.2.7
Jan 10, 2025 01:14:12.802311897 CET	53	54189	1.1.1.1	192.168.2.7
Jan 10, 2025 01:14:13.280020952 CET	60255	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:13.280184984 CET	53652	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:14.324928045 CET	50675	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:14.325158119 CET	51177	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:16.405081034 CET	60041	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:17.418426037 CET	60041	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:18.463437080 CET	60041	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:20.465924025 CET	60041	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:24.478830099 CET	60041	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:28.508647919 CET	53449	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:28.509082079 CET	58104	53	192.168.2.7	8.8.8.8
Jan 10, 2025 01:14:28.515446901 CET	53	53449	1.1.1.1	192.168.2.7
Jan 10, 2025 01:14:28.515997887 CET	53	58104	8.8.8.8	192.168.2.7
Jan 10, 2025 01:14:28.869180918 CET	65413	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:28.869345903 CET	60927	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:29.895248890 CET	56921	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:29.895329952 CET	60874	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:31.918082952 CET	59573	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:32.932840109 CET	59573	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:33.934828997 CET	59573	53	192.168.2.7	1.1.1.1
Jan 10, 2025 01:14:35.949870110 CET	59573	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 01:13:17.061407089 CET	192.168.2.7	1.1.1.1	0x3221	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:17.061407089 CET	192.168.2.7	1.1.1.1	0x8619	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 10, 2025 01:13:19.021934986 CET	192.168.2.7	1.1.1.1	0xa47c	Standard query (0)	ameyokonet.jp	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:19.022231102 CET	192.168.2.7	1.1.1.1	0x1c	Standard query (0)	ameyokonet.jp	65	IN (0x0001)	false
Jan 10, 2025 01:13:21.788855076 CET	192.168.2.7	1.1.1.1	0xfb23	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:21.789108992 CET	192.168.2.7	1.1.1.1	0x10d1	Standard query (0)	announce-sign.es	65	IN (0x0001)	false
Jan 10, 2025 01:13:22.807779074 CET	192.168.2.7	1.1.1.1	0x82fa	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:22.814789057 CET	192.168.2.7	1.1.1.1	0x3359	Standard query (0)	announce-sign.es	65	IN (0x0001)	false
Jan 10, 2025 01:13:24.841718912 CET	192.168.2.7	1.1.1.1	0x3c66	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:25.858788013 CET	192.168.2.7	1.1.1.1	0x3c66	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:26.876239061 CET	192.168.2.7	1.1.1.1	0x3c66	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:28.883861065 CET	192.168.2.7	1.1.1.1	0x3c66	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:32.886604071 CET	192.168.2.7	1.1.1.1	0x3c66	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:36.912513018 CET	192.168.2.7	8.8.8.8	0xd33a	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:36.913072109 CET	192.168.2.7	1.1.1.1	0x87da	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:37.930058002 CET	192.168.2.7	1.1.1.1	0xfe60	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:37.930200100 CET	192.168.2.7	1.1.1.1	0xe4c5	Standard query (0)	announce-sign.es	65	IN (0x0001)	false
Jan 10, 2025 01:13:38.950364113 CET	192.168.2.7	1.1.1.1	0x1aee	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:38.950529099 CET	192.168.2.7	1.1.1.1	0x9909	Standard query (0)	announce-sign.es	65	IN (0x0001)	false
Jan 10, 2025 01:13:41.007796049 CET	192.168.2.7	1.1.1.1	0xc8a9	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:42.012913942 CET	192.168.2.7	1.1.1.1	0xc8a9	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:43.013465881 CET	192.168.2.7	1.1.1.1	0xc8a9	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:45.028397083 CET	192.168.2.7	1.1.1.1	0xc8a9	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:49.043140888 CET	192.168.2.7	1.1.1.1	0xc8a9	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:53.057374954 CET	192.168.2.7	1.1.1.1	0x9986	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:53.057921886 CET	192.168.2.7	8.8.8.8	0x3cef	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:56.649139881 CET	192.168.2.7	1.1.1.1	0x6fc6	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:56.649276972 CET	192.168.2.7	1.1.1.1	0x21be	Standard query (0)	announce-sign.es	65	IN (0x0001)	false
Jan 10, 2025 01:13:57.668569088 CET	192.168.2.7	1.1.1.1	0xc94c	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:57.668761015 CET	192.168.2.7	1.1.1.1	0xcf96	Standard query (0)	announce-sign.es	65	IN (0x0001)	false
Jan 10, 2025 01:13:59.701510906 CET	192.168.2.7	1.1.1.1	0x6f43	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:00.715387106 CET	192.168.2.7	1.1.1.1	0x6f43	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:01.716077089 CET	192.168.2.7	1.1.1.1	0x6f43	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:03.717484951 CET	192.168.2.7	1.1.1.1	0x6f43	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:07.732006073 CET	192.168.2.7	1.1.1.1	0x6f43	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:11.746978998 CET	192.168.2.7	1.1.1.1	0x5587	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:11.747550964 CET	192.168.2.7	8.8.8.8	0x24fd	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:13.280020952 CET	192.168.2.7	1.1.1.1	0x9f78	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:13.280184984 CET	192.168.2.7	1.1.1.1	0xee3c	Standard query (0)	announce-sign.es	65	IN (0x0001)	false
Jan 10, 2025 01:14:14.324928045 CET	192.168.2.7	1.1.1.1	0xf0a3	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:14.325158119 CET	192.168.2.7	1.1.1.1	0xc804	Standard query (0)	announce-sign.es	65	IN (0x0001)	false
Jan 10, 2025 01:14:16.405081034 CET	192.168.2.7	1.1.1.1	0xc12e	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:17.418426037 CET	192.168.2.7	1.1.1.1	0xc12e	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:18.463437080 CET	192.168.2.7	1.1.1.1	0xc12e	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:20.465924025 CET	192.168.2.7	1.1.1.1	0xc12e	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:24.478830099 CET	192.168.2.7	1.1.1.1	0xc12e	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:28.508647919 CET	192.168.2.7	1.1.1.1	0x6cdd	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:28.509082079 CET	192.168.2.7	8.8.8.8	0x277c	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:28.869180918 CET	192.168.2.7	1.1.1.1	0x68db	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:28.869345903 CET	192.168.2.7	1.1.1.1	0xc06b	Standard query (0)	announce-sign.es	65	IN (0x0001)	false
Jan 10, 2025 01:14:29.895248890 CET	192.168.2.7	1.1.1.1	0xfb0b	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:29.895329952 CET	192.168.2.7	1.1.1.1	0x44a4	Standard query (0)	announce-sign.es	65	IN (0x0001)	false
Jan 10, 2025 01:14:31.918082952 CET	192.168.2.7	1.1.1.1	0x158d	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:32.932840109 CET	192.168.2.7	1.1.1.1	0x158d	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:33.934828997 CET	192.168.2.7	1.1.1.1	0x158d	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:35.949870110 CET	192.168.2.7	1.1.1.1	0x158d	Standard query (0)	announce-sign.es	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 01:13:17.068376064 CET	1.1.1.1	192.168.2.7	0x3221	No error (0)	www.google.com	142.250.181.228	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:17.068517923 CET	1.1.1.1	192.168.2.7	0x8619	No error (0)	www.google.com		65	IN (0x0001)	false
Jan 10, 2025 01:13:19.747298002 CET	1.1.1.1	192.168.2.7	0xa47c	No error (0)	ameyokonet.jp	133.130.72.11	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:36.919610977 CET	1.1.1.1	192.168.2.7	0x87da	No error (0)	google.com	172.217.18.14	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:36.920886993 CET	8.8.8.8	192.168.2.7	0xd33a	No error (0)	google.com	172.217.168.78	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:53.065790892 CET	1.1.1.1	192.168.2.7	0x9986	No error (0)	google.com	216.58.206.78	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:13:53.066258907 CET	8.8.8.8	192.168.2.7	0x3cef	No error (0)	google.com	172.217.168.78	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:11.753658056 CET	1.1.1.1	192.168.2.7	0x5587	No error (0)	google.com	172.217.16.142	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:11.754333019 CET	8.8.8.8	192.168.2.7	0x24fd	No error (0)	google.com	172.217.168.78	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:28.515446901 CET	1.1.1.1	192.168.2.7	0x6cdd	No error (0)	google.com	172.217.23.110	A (IP address)	IN (0x0001)	false
Jan 10, 2025 01:14:28.515997887 CET	8.8.8.8	192.168.2.7	0x277c	No error (0)	google.com	172.217.168.78	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

https:

ameyokonet.jp

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49746	133.130.72.11	80	2516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 01:13:19.753087997 CET	478	OUT	GET /entity/360001472 HTTP/1.1 Host: ameyokonet.jp Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: https://www.google.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 10, 2025 01:13:21.018506050 CET	475	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 00:13:20 GMT Server: Apache/2.2.31 Location: http://ameyokonet.jp/entity/360001472/ Content-Length: 246 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 6d 65 79 6f 6b 6f 6e 65 74 2e 6a 70 2f 65 6e 74 69 74 79 2f 33 36 30 30 30 31 34 37 32 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://ameyokonet.jp/entity/360001472/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49747	133.130.72.11	80	2516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 01:13:21.021873951 CET	479	OUT	GET /entity/360001472/ HTTP/1.1 Host: ameyokonet.jp Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: https://www.google.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 10, 2025 01:13:21.682008028 CET	297	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 00:13:21 GMT Server: Apache/2.2.31 X-Powered-By: PHP/5.5.28 Connection: close Transfer-Encoding: chunked Content-Type: text/html Data Raw: 36 64 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 22 68 74 74 70 73 3a 2f 2f 61 6e 6e 6f 75 6e 63 65 2d 73 69 67 6e 2e 65 73 2f 61 63 63 6f 75 6e 74 2e 69 6e 74 75 69 74 2e 63 6f 6d 22 3c 2f 73 63 72 69 70 74 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d<script type="text/javascript">window.location.href = "https://announce-sign.es/account.intuit.com"</script>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49724	142.250.181.228	443	2516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 00:13:18 UTC	951	OUT	GET /url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCKLRzQEIitPNAQik1s0BCPTWzQEIp9jNAQj5wNQVGPXJzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 00:13:18 UTC	1404	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 00:13:18 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-oKb_cN4csXtW7eCx5l--2w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Server: gws X-XSS-Protection: 0 Set-Cookie: NID=520=LZQKc7MTDPqFyTKZ4hUKa_cPsBy8OXJ0UkO-NkqPGpHyMVBUL5PFR-9ZfLmRDspJZHMW9dD9_Jd0ZIR3x_hn6IFYCHmOCpQbbIgl9EueqSkUUs7VaBbYE4KZdADkE7x0GBW5JHSpqvrurs3MJzo_9nx1Sp82_sAGiPvzBIcHkmxG2GayL8jP7EBiqacbAFTXHtIc; expires=Sat, 12-Jul-2025 00:13:18 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-10 00:13:18 UTC	714	IN	Data Raw: 32 63 33 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 3e 20 20 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 6f 4b 62 5f 63 4e 34 63 73 58 74 57 37 65 43 78 35 6c 2d 2d 32 77 22 3e 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 76 61 72 20 64 3d 2f 5e 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 0a 28 74 68 69 73 7c 7c 73 65 6c 66 29 2e 67 6f 6f 67 6c 65 2e 6e 61 76 69 67 61 74 65 54 6f 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 63 2c 62 29 7b 21 2f 5c 2f Data Ascii: 2c3<html lang="en"> <head> <meta content="origin" name="referrer"> <script nonce="oKb_cN4csXtW7eCx5l--2w">window.google = {};(function(){var d=/^\s(?!javascript:)(?:[\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;(this\|\|self).google.navigateTo=function(a,c,b){!/\/
2025-01-10 00:13:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5336, Parent PID: 5808

General

Target ID:	3
Start time:	19:13:05
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2516, Parent PID: 5336

General

Target ID:	6
Start time:	19:13:10
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1924,i,17618142120864592884,626483772498086810,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7140, Parent PID: 5808

General

Target ID:	10
Start time:	19:13:17
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 42

Chrome Cache Entry: 43

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5336, Parent PID: 5808

General

Chronological Activities

Analysis Process: chrome.exePID: 2516, Parent PID: 5336

General

Chronological Activities

Analysis Process: chrome.exePID: 7140, Parent PID: 5808

General

Chronological Activities

Disassembly

Windows Analysis Report
https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=http://ameyokonet.jp/entity/360001472&ved=2ahUKEwjci_7__ueKAxWERqQEHaArJ4UQFnoECBkQAQ&usg=AOvVaw2Q-HRaXM61Y25vKtqSRkMy