Edit tour

Windows Analysis Report
http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10

Overview

General Information

Sample URL:	http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10
Analysis ID:	1586346
Tags:	urlscan
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious URL

HTML body contains low number of good links

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,16602930227236961276,9513286687473577204,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Address: gin_throttle_mw_7200000000_8.46.123.189X-Ratelimit-Limit: 500X-Ratelimit-Remaining: 498X-Ratelimit-Reset: 1736383453Date: Wed, 08 Jan 2025 23:44:14 GMTContent-Length: 0

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: http://topmarktingplace.com
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: http://topmarktingplace.com

Source: http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10	HTTP Parser: No favicon
Source: http://topmarktingplace.com/t/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10	HTTP Parser: No favicon
Source: http://topmarktingplace.com/news?q=This%20link%20is%20locked!	HTTP Parser: No favicon
Source: http://topmarktingplace.com/news?q=This%20link%20is%20locked!	HTTP Parser: No favicon
Source: http://topmarktingplace.com/	HTTP Parser: No favicon
Source: http://topmarktingplace.com/	HTTP Parser: No favicon
Source: http://topmarktingplace.com/	HTTP Parser: No favicon
Source: http://topmarktingplace.com/	HTTP Parser: No favicon
Source: http://topmarktingplace.com/	HTTP Parser: No favicon
Source: http://topmarktingplace.com/	HTTP Parser: No favicon
Source: http://topmarktingplace.com/	HTTP Parser: No favicon
Source: http://topmarktingplace.com/	HTTP Parser: No favicon
Source: http://topmarktingplace.com/about	HTTP Parser: No favicon
Source: http://topmarktingplace.com/news	HTTP Parser: No favicon

Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="author".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="author".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="author".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="author".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="author".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="author".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="author".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="author".. found

Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://topmarktingplace.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50004 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10 HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /t/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10 HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /news?q=This%20link%20is%20locked! HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://topmarktingplace.com/t/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://topmarktingplace.com/news?q=This%20link%20is%20locked!Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/styles.css HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://topmarktingplace.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /about HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://topmarktingplace.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/about_styles.css HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://topmarktingplace.com/aboutAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://topmarktingplace.com/aboutAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /news HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://topmarktingplace.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: topmarktingplace.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://topmarktingplace.com/newsAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_52.3.dr, chromecache_51.3.dr	String found in binary or memory: <content:encoded><p>Authorities in Mexico are offering state protection to famed regional Mexican singer Natanael Cano and other artists after <a href="https://www.foxnews.com/category/topic/mexican-cartel-violence" target="_blank" rel="noopener">a drug cartel in northern Mexico</a> publicly threatened them, prosecutors confirmed to The Associated Press on Tuesday.</p><p>Photos of a banner threatening the lives of Cano, a singer of corridos, a musical genre often linked to drug cartel violence, and several other artists in the Sonora region circulated on social media over the weekend.</p><p>The banner appeared to be signed by "Jalisco Matasalas" a group within a faction of the Sinaloa Cartel known as the "Chapitos," which sowed terror in northern Mexico in recent months in a bloody power struggle. The gang accused the singers of "financially helping" a rival gang known as "Salazares."</p><p><a href="https://www.foxnews.com/us/ice-removes-notorious-drug-cartel-leader-from-us" target="_blank" rel="noopener"><strong>ICE REMOVES NOTORIOUS DRUG CARTEL LEADER FROM US</strong></a></p><p>"This is the last time you will receive a warning, just in time for you to cut the crap. Mind your own business," the banner read. "If you don't heed this warning, you will be shot."</p><p>The Sonoran Prosecutor's Office on Tuesday told the AP that the threatening message was found hanging from a school and that they had opened an investigation.</p><p>Allan de la Rosa, a spokesperson for the prosecutors, said authorities offered state protection to the artists to "prevent any aggression related to the direct threat displayed on the banner." He did not elaborate on the nature of the protection.</p><p>Cano's communications team did not immediately respond to a request for comment.</p><p>Corridos, made up of ballads from <a href="https://www.foxnews.com/category/world/world-regions/location-mexico" target="_blank" rel="noopener">northern Mexico</a>, is a musical genre that has long been linked to drug violence, but they also depict the harsh realities many Mexicans face living under narco violence. The genre, along with Mexican regional music, is experiencing a resurgence with younger artists like Cano and Peso Pluma blending classic styles with other genres like trap music.</p><p>Over the past five years, streaming of Mexican music has grown 400% on Spotify and in 2023 Mexican artist Peso Pluma bested Taylor Swift as the most streamed artist on YouTube.</p><p>Such artists have long faced sharp criticisms from authorities and threats from drug gangs.</p><p>In 2023, Peso Pluma equals www.yout
Source: chromecache_52.3.dr, chromecache_51.3.dr	String found in binary or memory: <a href="https://www.youtube.com/watch?v=Dck8eZCpglc" target="_blank" rel="nofollow noopener">90-minute interview</a> with popular podcast host Jordan Peterson.</p><p><a href="https://www.foxnews.com/world/canadas-trudeau-announces-resignation-following-party-pressure-amid-criticisms-trump-budget-handling" target="_blank" rel="noopener"><strong>CANADA equals www.youtube.com (Youtube)
Source: chromecache_52.3.dr, chromecache_51.3.dr	String found in binary or memory: <a href="https://www.youtube.com/watch?v=Dtf1Afdz-jg" target="_blank" rel="nofollow noopener">CTV News</a>, before Christmas.</p><p>The incoming Trump administration will almost assuredly deal with a Poilievre government as the Conservatives are poised to win the next Canadian election, which could come as early as this spring. When the House of Commons resumes sitting on March 24, the opposition parties are likely to defeat the minority Liberal government in a vote of no-confidence, which would trigger a national vote.</p><p>In his Peterson interview, Poilievre acknowledged that Trump equals www.youtube.com (Youtube)
Source: chromecache_52.3.dr, chromecache_51.3.dr	String found in binary or memory: <rss xmlns:media="http://search.yahoo.com/mrss/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"> equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: topmarktingplace.com
Source: global traffic	DNS traffic detected: DNS query: feeds.foxnews.com
Source: global traffic	DNS traffic detected: DNS query: moxie.foxnews.com
Source: global traffic	DNS traffic detected: DNS query: www.foxnews.com

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,16602930227236961276,9513286687473577204,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,16602930227236961276,9513286687473577204,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.212.132	www.google.com	United States	15169	GOOGLEUS	false
185.126.115.108	topmarktingplace.com	Ukraine	41018	OMNILANCEhttpomnilancecomUA	true
239.255.255.250	unknown	Reserved	unknown	unknown	false

IP
192.168.2.8
192.168.2.7
192.168.2.6

Name	Malicious	Antivirus Detection	Reputation
http://topmarktingplace.com/about	false		unknown
http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10	true		unknown
http://topmarktingplace.com/	false		unknown
http://topmarktingplace.com/assets/styles.css	false	Avira URL Cloud: malware	unknown

Name	Source	Malicious	Reputation
https://www.foxnews.com/politics/trumps-tariff-threats-go-beyond-trade-agreement-advance-american-in	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/wife-us-hostage-keith-siegel-holiday-miracle-we-need-get-them-back&quo	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/01/931/523/tibet-earthqu	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/category/topic/venezuelan-political-crisis"	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/kim-jong-uns-big-guns-spotted-russian-front-lines-report	chromecache_51.3.dr	false	high
https://www.foxnews.com/category/world/world-regions/china"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/venezuelan-dictator-deploys-bizarre-distraction-country-remains-turmoi	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/at-least-6-workers-killed-more-trapped-in-india-mine-collapse"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/elephant-rips-handler-half-thailand-working-extreme-heat-report"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/us/iranian-men-charged-connection-fatal-drone-strike-killed-three-us-soldier	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/tech/china-rolls-out-its-crime-fighting-ball-chase-down-criminals"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/us/utah-brothers-survive-avalanche-after-one-pulls-other-out-snow-burial&quo	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/us/st-louis-zoo-elephant-dies-lost-dog-agitates-herd"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/health/cdc-monitoring-possible-spike-hmpv-cases-china"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/politics/biden-administration-imposes-sanctions-against-venezuelan-president	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/world-economic-forum-kick-davos-switzerland-global-elites-likely-face-	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.jpost.com/breaking-news/article-836258"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/elon-musk-demands-uk-act-grooming-gang-scandal-amid-growing-calls-prob	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/uk-pm-starmer-hits-back-against-musk-attacks-child-grooming-gangs&quot	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/venezuelan-opposition-leader-who-claimed-victory-over-maduro-meets-bid	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/venezuelas-maduro-start-third-term-office-amid-rigged-election-blatant	chromecache_51.3.dr	false	high
https://www.foxnews.com/category/world/world-regions/location-mexico"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/politics/canadian-ministers-head-florida-talks-incoming-trump-administration	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.voanews.com/a/us-says-forces-struck-houthi-weapons-stores-in-yemen-/7929429.html"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/category/person/joe-biden"	chromecache_51.3.dr	false	high
https://www.reuters.com/world/middle-east/iran-dramatically-increasing-enrichment-near-bomb-grade-ia	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://global.fncstatic.com/static/orion/styles/img/fox-news/logos/fox-news-desktop.png	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxbusiness.com/fox-news-world/trudeau-brink-ally-finance-minister-abruptly-quits-over-t	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/canadian-finance-minister-resigns-trudeau-governments-popularity-floun	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.understandingwar.org/backgrounder/russian-offensive-campaign-assessment-january-6-2025&q	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/israelis-look-trump-amid-debate-gazas-future-going-enable-things-were-	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/earthquake-50-miles-from-mount-everest-leaves-least-95-dead-tibet	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/israel-launches-strikes-yemen-houthi-military-targets-idf-says"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/category/person/benjamin-netanyahu"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/01/931/523/west-bank-att	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/politics/trump-weighs-political-turmoil-great-state-canada-trolls-governor-j	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/trudeau-isnt-snowballs-chance-hell-canada-become-part-us	chromecache_51.3.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/12/931/523/trump-trudeau	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/iran-hides-missile-drone-program-under-guise-commercial-front-evade-sa	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/georgian-pm-praises-countrys-protest-crackdown-despite-us-condemnation	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/politics/trump-plans-reverse-bidens-ban-oil-gas-drilling-us-coast"	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/manchester-asian-grooming-scandal"	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/mexico-offers-protection-famed-singer-after-drug-cartel-death-threats	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/qatar-returns-hamas-israel-negotiations-trump-envoy-looks-make-inroads	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/09/931/523/AP24241789084	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.reuters.com/world/americas/special-election-loss-adds-misery-cahttps://www.reuters.com/w	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/media/justin-trudeaus-resignation-met-gleeful-reaction-from-conservatives-on	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/politics/trump-says-us-subsidies-canada-make-no-sense-suggests-canadians-wan	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/congo-execute-170-people-convicted-armed-robbery-official-says	chromecache_51.3.dr	false	high
https://www.bbc.com/news/articles/c86wz0vd1dwo"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/3-americans-congo-sentenced-death-after-coup-attempt"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/3-killed-west-bank-shooting-spree-including-israeli-police-officer-rep	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/two-americans-arrested-venezuela-eve-maduro-inauguration-over-terroris	chromecache_51.3.dr	false	high
https://www.foxnews.com/politics/trump-meets-italian-pm-giorgia-meloni-his-mar-a-lago-resort"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2024/12/931/523/trudeau-trump	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/01/931/523/mexico-natana	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://pubsubhubbub.appspot.com/	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/category/world/world-regions/canada"	chromecache_51.3.dr	false	high
https://www.foxnews.com/category/world/uk-politics"	chromecache_51.3.dr	false	high
https://www.foxnews.com/category/world/world-regions/italy"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/irans-nuclear-program-nearing-the-point-no-return-frances-macron-says&	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.timesofisrael.com/3-israelis-killed-8-wounded-in-west-bank-terror-shooting-idf-hunting-f	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://globalnews.ca/video/10279746/trudeau-says-poilievre-wants-to-make-canada-great-again-in-comp	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/13-young-miners-feared-dead-in-indias-remote-northeast"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/israeli-pm-office-denies-reports-hamas-has-list-hostages-release-event	chromecache_51.3.dr	false	high
https://www.foxnews.com/video/6366455260112"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/politics/us-swaps-maduro-ally-venezuela-10-americans-including-fat-leonard&q	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/jake-sullivan-says-netanyahu-ready-do-deal-hamas-said-concede-israel-c	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/category/topic/mexican-cartel-violence"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
http://search.yahoo.com/mrss/	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/politics/trump-suggests-canada-become-51st-state-after-trudeau-said-tariff-w	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/category/world/world-regions/israel"	chromecache_51.3.dr	false	high
https://www.foxnews.com/politics/who-giorgia-meloni-trump-hosts-italian-pm-mar-a-lago"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/us-sanctions-21-more-maduro-allies-accused-post-election-repression-ve	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/bipartisan-lawmakers-introduce-georgian-nightmare-non-recognition-act-	chromecache_51.3.dr	false	high
https://www.youtube.com/watch?v=Dck8eZCpglc"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/category/world/world-regions/middle-east"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/politics/trump-trolling-canada-51st-state-could-boost-democrats-blue-state-b	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/video/6366709135112"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/category/world/world-regions/africa"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/iran-executes-over-1000-prisoners-2024-highest-total-30-years-report-s	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/us-strikes-underground-houthi-weapons-depots-used-hit-american-ships	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/uk-lawmakers-vote-against-inquiry-rape-gang-scandal-musk-keeps-up-pres	chromecache_51.3.dr	false	high
https://www.foxnews.com/category/world/mount-everest"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/category/travel/general/camping-hiking"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/01/931/523/afghanarrival	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/controversial-founder-french-far-right-jean-marie-le-pen-dies-aged-96	chromecache_51.3.dr	false	high
https://www.foxnews.com/world/ukraine-how-war-shifted-2024"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2025/01/931/523/472087173_116	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://x.com/Archer83Able/status/1857075934274171021">to	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/us/2-dead-after-search-sasquatch-washington-national-forest"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2023/07/931/523/drc_flag.jpg?	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/category/politics/foreign-policy/human-rights"	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/indias-capital-introduces-stricter-anti-pollution-measures-toxic-smog-	chromecache_52.3.dr, chromecache_51.3.dr	false	high
https://www.foxnews.com/world/israel-kills-hamas-commander-who-led-heinous-oct-7-attack-kibbutz-nir-	chromecache_52.3.dr, chromecache_51.3.dr	false	high

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586346
Start date and time:	2025-01-09 00:43:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.win@16/21@16/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Input	Output
URL: http://topmarktingplace.com Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": false }
URL: http://topmarktingplace.com
URL: http://topmarktingplace.com/4KCrhO42616HeLs1324axl... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script exhibits several moderate-risk behaviors, including redirecting the user to a modified URL and checking for bot/crawler user agents. While the intent is not entirely clear, the combination of URL manipulation and conditional redirection warrants further investigation." }
let e=new URL(window.location.href);e.pathname="/t"+e.pathname;let o=e.toString();navigator.cookieEnabled&&!function(e){for(var o=["googlebot","bingbot","yandexbot","duckduckbot","slurp","baiduspider","facebot","ia_archiver"],t=e.toLowerCase(),n=0;n<o.length;n++)if(t.indexOf(o[n])>-1)return!0;return!1}(navigator.userAgent)?setTimeout((function(){document.location.href=o}),1e3):console.log("bt");
URL: http://topmarktingplace.com/... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript code appears to be a simple countdown timer and email subscription functionality, which are common and benign web development practices. There are no indicators of high-risk behaviors, such as dynamic code execution, data exfiltration, or redirects to suspicious domains. The code is straightforward and does not exhibit any suspicious or malicious characteristics." }
const launchDate = new Date('2023-05-01T00:00:00').getTime(); const daysElement = document.getElementById('days'); const hoursElement = document.getElementById('hours'); const minutesElement = document.getElementById('minutes'); const secondsElement = document.getElementById('seconds'); function updateCountdown() { const currentTime = new Date().getTime(); const timeRemaining = launchDate - currentTime; const days = Math.floor(timeRemaining / (1000 * 60 * 60 * 24)); const hours = Math.floor((timeRemaining % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); const minutes = Math.floor((timeRemaining % (1000 * 60 * 60)) / (1000 * 60)); const seconds = Math.floor((timeRemaining % (1000 * 60)) / 1000); daysElement.textContent = days.toString().padStart(2, '0'); hoursElement.textContent = hours.toString().padStart(2, '0'); minutesElement.textContent = minutes.toString().padStart(2, '0'); secondsElement.textContent = seconds.toString().padStart(2, '0'); } function submitForm(event) { event.preventDefault(); const email = document.getElementById('email').value; document.getElementById('subscription-message').textContent = `Thank you for subscribing, ${email}!`; } updateCountdown(); setInterval(updateCountdown, 1000);
URL: http://topmarktingplace.com/news?q=This%20link%20i... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript code appears to be a simple RSS feed reader that fetches and displays news items from a given RSS feed URL. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is straightforward and does not exhibit any suspicious behavior. It is likely a legitimate implementation of an RSS feed display functionality." }
const fetchRSSFeed = async (url) => { const response = await fetch(url); const text = await response.text(); const parser = new DOMParser(); const xml = parser.parseFromString(text, "application/xml"); return xml; }; const displayNewsItems = (xml) => { const newsItemsContainer = document.getElementById("news-items"); const items = xml.querySelectorAll("item"); items.forEach((item) => { const titleElement = item.querySelector("title"); const guidElement = item.querySelector("guid"); const descriptionElement = item.querySelector("description"); const contentElement = item.querySelector("content\\:encoded"); const title = titleElement ? titleElement.textContent : "Untitled"; const guid = guidElement ? guidElement.textContent : "#"; const description = descriptionElement ? descriptionElement.textContent : "No description available."; const content = contentElement ? contentElement.textContent : "No content available."; const newsItem = document.createElement("div"); newsItem.classList.add("news-item"); newsItem.innerHTML = `
URL: http://topmarktingplace.com/t/4KCrhO42616HeLs1324a... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script uses a setTimeout function to redirect the user to a news page with a suspicious query parameter after a 1-second delay. This behavior is considered a moderate risk, as it could potentially lead to a redirect to a malicious or suspicious domain. However, without more context about the script's purpose and the target domain, it's difficult to determine the true intent. Further investigation may be necessary." }
setTimeout(function(){ window.location.href = '/news?q=This link is locked!'; console.log('redirecting to /news?q=This link is locked!'); }, 1000);
URL: http://topmarktingplace.com/news?q=This%20link%20i... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript code appears to be a legitimate RSS feed reader that fetches and displays news items from the Fox News World RSS feed. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code uses standard web APIs like `fetch` and `DOMParser` to retrieve and parse the RSS feed, and it simply displays the news items on the page. This script is likely benign and poses a low risk." }
const fetchRSSFeed = async (url) => { const response = await fetch(url); const text = await response.text(); const parser = new DOMParser(); const xml = parser.parseFromString(text, "application/xml"); return xml; }; const displayNewsItems = (xml) => { const newsItemsContainer = document.getElementById("news-items"); const items = xml.querySelectorAll("item"); items.forEach((item) => { const titleElement = item.querySelector("title"); const guidElement = item.querySelector("guid"); const descriptionElement = item.querySelector("description"); const contentElement = item.querySelector("content\\:encoded"); const title = titleElement ? titleElement.textContent : "Untitled"; const guid = guidElement ? guidElement.textContent : "#"; const description = descriptionElement ? descriptionElement.textContent : "No description available."; const content = contentElement ? contentElement.textContent : "No content available."; const newsItem = document.createElement("div"); newsItem.classList.add("news-item"); newsItem.innerHTML = ` <h2><a href="${guid}" target="_blank">${title}</a></h2> <p>${description}</p> <div>${content}</div> `; newsItemsContainer.appendChild(newsItem); }); }; (async () => { const foxNewsWorldRSSFeed = "https://feeds.foxnews.com/foxnews/world"; const xml = await fetchRSSFeed(foxNewsWorldRSSFeed); displayNewsItems(xml); document.getElementById("msg").textContent = new URLSearchParams(window.location.search).get("q"); })();
URL: http://topmarktingplace.com/news?q=This%20link%20is%20locked! Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/news?q=This%20link%20is%20locked! Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "UK lawmakers vote against inquiry into 'rape gang scandal' as Musk keeps up pressure", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/news?q=This%20link%20is%20locked! Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: http://topmarktingplace.com/news?q=This%20link%20is%20locked! Model: Joe Sandbox AI	{ "brands": [ "Fox News" ] }
	{ "brands": [ "Fox News" ] }
URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Our Website is Coming Soon!", "prominent_button_name": "Subscribe", "text_input_field_labels": [ "zyfwbn@pitv.com" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "brands": [ "Fox News" ] }
	{ "brands": [ "Fox News" ] }
URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Our Website is Coming Soon!", "prominent_button_name": "Subscribe", "text_input_field_labels": ["zyfwbn@pitv.com"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "brands": [ "Fox News" ] }
	{ "brands": [ "Fox News" ] }
URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Our Website is Coming Soon!", "prominent_button_name": "Subscribe", "text_input_field_labels": ["zyfwbn@pitv.com"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "brands": [ "Fox News" ] }
	{ "brands": [ "Fox News" ] }
URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Our Website is Coming Soon!", "prominent_button_name": "Subscribe", "text_input_field_labels": ["rghd30@bvnpicc.org"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "brands": [ "Fox News" ] }
	{ "brands": [ "Fox News" ] }
URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Our Website is Coming Soon!", "prominent_button_name": "Subscribe", "text_input_field_labels": ["rghd30@bvnpicc.org"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Our Website is Coming Soon!", "prominent_button_name": "Subscribe", "text_input_field_labels": ["rghd30@bvnpicc.org"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "brands": [ "Fox News" ] }
	{ "brands": [ "Fox News" ] }
URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "brands": [ "Fox News" ] }
	{ "brands": [ "Fox News" ] }
URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Our Website is Coming Soon!", "prominent_button_name": "Subscribe", "text_input_field_labels": [ "8amler@djy.net" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "brands": [ "Fox News" ] }
	{ "brands": [ "Fox News" ] }
URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Our Website is Coming Soon!", "prominent_button_name": "Subscribe", "text_input_field_labels": [ "8amler@djy.net" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/about Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Click here to learn more about how our email marketing solutions can help your business grow and thrive.", "prominent_button_name": "Back to the main page", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/ Model: Joe Sandbox AI	{ "brands": [ "Fox News" ] }
	{ "brands": [ "Fox News" ] }
URL: http://topmarktingplace.com/news Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "UK lawmakers vote against inquiry into 'rape gang scandal' as Musk keeps up pressure", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://topmarktingplace.com/about Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: http://topmarktingplace.com/news Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	714
Entropy (8bit):	4.640934656505668
Encrypted:	false
SSDEEP:	12:U068a0fvM2SMGRDGW4Q1bTNKqkFk80MFr+jF35PHtXFGSECp3t6FGSECpa6FGSEI:UkvMuGRKePcV1YF3LX8SECVt68SEC06l
MD5:	4BE8EF55271B17CF4B27C93F9C21044F
SHA1:	9D0DA00EC2C6BD31D3EECCF4F97B9D9DFB409822
SHA-256:	48796E60D0E2924366A3E3BBFC06A948C1D631AB0B8DFA27E2CA9F8EE58053E7
SHA-512:	B7ACE1CA1DE39D61154D26C0306AA5EF64E64C08FA1B15EE406CA887D23D59DF30A3FC73E143C8C87B5F71291F9B918DE207DEF1C77AF91046C7564E60CE4517
Malicious:	false
Reputation:	low
URL:	http://topmarktingplace.com/assets/about_styles.css
Preview:	body {. font-family: Arial, sans-serif;. background-color: #f0f0f0;. display: flex;. justify-content: center;. align-items: center;. height: 100vh;. margin: 0;. padding: 0;.}...container {. width: 80%;. margin: auto;. overflow: hidden;. padding: 0 2rem;. background-color: #fff;. padding: 2rem;. border-radius: 5px;. box-shadow: 0 1px 3px rgba(0, 0, 0, 0.12), 0 1px 2px rgba(0, 0, 0, 0.24);.}..h1 {. font-size: 2rem;. color: #333;. margin-bottom: 1rem;.}..p {. font-size: 1rem;. color: #333;. margin-bottom: 1rem;.}..ul {. font-size: 1rem;. color: #333;. margin-bottom: 1rem;. padding-left: 1.5rem;.}..li {. margin-bottom: 0.5rem;.}.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 00:44:01.369755983 CET	49674	443	192.168.2.6	173.222.162.64
Jan 9, 2025 00:44:01.369757891 CET	49673	443	192.168.2.6	173.222.162.64
Jan 9, 2025 00:44:01.666732073 CET	49672	443	192.168.2.6	173.222.162.64
Jan 9, 2025 00:44:07.615032911 CET	49712	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:07.615050077 CET	443	49712	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:07.615098000 CET	49712	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:07.615748882 CET	49712	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:07.615766048 CET	443	49712	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:08.431044102 CET	443	49712	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:08.431145906 CET	49712	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:08.436755896 CET	49712	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:08.436785936 CET	443	49712	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:08.437012911 CET	443	49712	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:08.439090014 CET	49712	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:08.439194918 CET	49712	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:08.439203978 CET	443	49712	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:08.439291000 CET	49712	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:08.483325958 CET	443	49712	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:08.614584923 CET	443	49712	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:08.614759922 CET	443	49712	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:08.614872932 CET	49712	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:08.614938021 CET	49712	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:08.614953041 CET	443	49712	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:10.978146076 CET	49674	443	192.168.2.6	173.222.162.64
Jan 9, 2025 00:44:10.978147030 CET	49673	443	192.168.2.6	173.222.162.64
Jan 9, 2025 00:44:11.275023937 CET	49672	443	192.168.2.6	173.222.162.64
Jan 9, 2025 00:44:11.752140999 CET	49718	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:44:11.752182007 CET	443	49718	216.58.212.132	192.168.2.6
Jan 9, 2025 00:44:11.752370119 CET	49718	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:44:11.752587080 CET	49718	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:44:11.752595901 CET	443	49718	216.58.212.132	192.168.2.6
Jan 9, 2025 00:44:12.433619976 CET	443	49718	216.58.212.132	192.168.2.6
Jan 9, 2025 00:44:12.433970928 CET	49718	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:44:12.433979034 CET	443	49718	216.58.212.132	192.168.2.6
Jan 9, 2025 00:44:12.435059071 CET	443	49718	216.58.212.132	192.168.2.6
Jan 9, 2025 00:44:12.435115099 CET	49718	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:44:12.439541101 CET	49718	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:44:12.439599037 CET	443	49718	216.58.212.132	192.168.2.6
Jan 9, 2025 00:44:12.492842913 CET	49718	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:44:12.492868900 CET	443	49718	216.58.212.132	192.168.2.6
Jan 9, 2025 00:44:12.539727926 CET	49718	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:44:13.023051023 CET	443	49706	173.222.162.64	192.168.2.6
Jan 9, 2025 00:44:13.023228884 CET	49706	443	192.168.2.6	173.222.162.64
Jan 9, 2025 00:44:13.138751984 CET	49731	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:13.138928890 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:13.143652916 CET	80	49731	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:13.143678904 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:13.143765926 CET	49731	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:13.143778086 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:13.144176006 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:13.149033070 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:13.845746994 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:13.894087076 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:13.926665068 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:13.931508064 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:14.178864002 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:14.229650974 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:14.920742035 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:14.925596952 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:15.253298998 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:15.296919107 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:16.018050909 CET	49750	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:16.018070936 CET	443	49750	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:16.018148899 CET	49750	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:16.018837929 CET	49750	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:16.018847942 CET	443	49750	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:16.305514097 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:16.310290098 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:16.534507036 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:16.534523964 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:16.534535885 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:16.534579992 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:16.586616039 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:16.608201981 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:16.651227951 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:16.795981884 CET	443	49750	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:16.796071053 CET	49750	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:16.799478054 CET	49750	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:16.799485922 CET	443	49750	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:16.799732924 CET	443	49750	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:16.801740885 CET	49750	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:16.801825047 CET	49750	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:16.801831007 CET	443	49750	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:16.802010059 CET	49750	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:16.843333960 CET	443	49750	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:16.974123001 CET	443	49750	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:16.974253893 CET	443	49750	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:16.974464893 CET	49750	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:16.974905014 CET	49750	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:16.974920988 CET	443	49750	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:22.388928890 CET	443	49718	216.58.212.132	192.168.2.6
Jan 9, 2025 00:44:22.389003992 CET	443	49718	216.58.212.132	192.168.2.6
Jan 9, 2025 00:44:22.389107943 CET	49718	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:44:23.917139053 CET	49718	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:44:23.917164087 CET	443	49718	216.58.212.132	192.168.2.6
Jan 9, 2025 00:44:29.657916069 CET	49842	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:29.657958031 CET	443	49842	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:29.658150911 CET	49842	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:29.658677101 CET	49842	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:29.658689022 CET	443	49842	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:30.473087072 CET	443	49842	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:30.473157883 CET	49842	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:30.479305983 CET	49842	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:30.479321957 CET	443	49842	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:30.479624987 CET	443	49842	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:30.481676102 CET	49842	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:30.481677055 CET	49842	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:30.481698036 CET	443	49842	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:30.481811047 CET	49842	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:30.527328014 CET	443	49842	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:30.667819023 CET	443	49842	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:30.667947054 CET	443	49842	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:30.668004990 CET	49842	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:30.668159008 CET	49842	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:30.668175936 CET	443	49842	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:34.187854052 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:34.192616940 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:34.399985075 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:34.400012016 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:34.400027037 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:34.400134087 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:34.440555096 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:34.491909981 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:34.537384987 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:34.712414026 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:34.717220068 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:34.924215078 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:34.924232960 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:34.924282074 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:45.123667955 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:45.128485918 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:45.335180044 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:45.335197926 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:45.335297108 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:45.350300074 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:45.355158091 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:45.563442945 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:45.604545116 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:52.314668894 CET	49975	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:52.314723969 CET	443	49975	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:52.314801931 CET	49975	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:52.315438986 CET	49975	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:52.315460920 CET	443	49975	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:53.176795959 CET	443	49975	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:53.176956892 CET	49975	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:53.178950071 CET	49975	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:53.178961039 CET	443	49975	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:53.179227114 CET	443	49975	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:53.181400061 CET	49975	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:53.181466103 CET	49975	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:53.181469917 CET	443	49975	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:53.181618929 CET	49975	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:53.227328062 CET	443	49975	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:53.351182938 CET	443	49975	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:53.351264000 CET	443	49975	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:53.351381063 CET	49975	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:53.351680994 CET	49975	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:44:53.351695061 CET	443	49975	40.113.110.67	192.168.2.6
Jan 9, 2025 00:44:57.070866108 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:57.078231096 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:57.285731077 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:57.285748005 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:57.285861015 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:44:57.285887957 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:57.326200008 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:58.149463892 CET	49731	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:44:58.154280901 CET	80	49731	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:09.265852928 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:45:09.270730019 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:09.635925055 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:09.635947943 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:09.635968924 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:09.635982037 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:09.636051893 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:45:09.636104107 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:45:11.808125973 CET	50003	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:45:11.808183908 CET	443	50003	216.58.212.132	192.168.2.6
Jan 9, 2025 00:45:11.808248997 CET	50003	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:45:11.808579922 CET	50003	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:45:11.808592081 CET	443	50003	216.58.212.132	192.168.2.6
Jan 9, 2025 00:45:12.464890957 CET	443	50003	216.58.212.132	192.168.2.6
Jan 9, 2025 00:45:12.465342045 CET	50003	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:45:12.465364933 CET	443	50003	216.58.212.132	192.168.2.6
Jan 9, 2025 00:45:12.465718985 CET	443	50003	216.58.212.132	192.168.2.6
Jan 9, 2025 00:45:12.466191053 CET	50003	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:45:12.466259956 CET	443	50003	216.58.212.132	192.168.2.6
Jan 9, 2025 00:45:12.509497881 CET	50003	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:45:13.955686092 CET	49731	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:45:13.960824966 CET	80	49731	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:13.960928917 CET	49731	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:45:16.659585953 CET	50004	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:45:16.659648895 CET	443	50004	40.113.110.67	192.168.2.6
Jan 9, 2025 00:45:16.659893036 CET	50004	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:45:16.660751104 CET	50004	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:45:16.660778046 CET	443	50004	40.113.110.67	192.168.2.6
Jan 9, 2025 00:45:17.459640980 CET	443	50004	40.113.110.67	192.168.2.6
Jan 9, 2025 00:45:17.459733009 CET	50004	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:45:17.462089062 CET	50004	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:45:17.462107897 CET	443	50004	40.113.110.67	192.168.2.6
Jan 9, 2025 00:45:17.462449074 CET	443	50004	40.113.110.67	192.168.2.6
Jan 9, 2025 00:45:17.464262009 CET	50004	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:45:17.464338064 CET	50004	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:45:17.464350939 CET	443	50004	40.113.110.67	192.168.2.6
Jan 9, 2025 00:45:17.464509964 CET	50004	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:45:17.507333040 CET	443	50004	40.113.110.67	192.168.2.6
Jan 9, 2025 00:45:17.639441013 CET	443	50004	40.113.110.67	192.168.2.6
Jan 9, 2025 00:45:17.639524937 CET	443	50004	40.113.110.67	192.168.2.6
Jan 9, 2025 00:45:17.639616966 CET	50004	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:45:17.639980078 CET	50004	443	192.168.2.6	40.113.110.67
Jan 9, 2025 00:45:17.639996052 CET	443	50004	40.113.110.67	192.168.2.6
Jan 9, 2025 00:45:21.406989098 CET	50005	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:45:21.407777071 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:45:21.411849976 CET	80	50005	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:21.411969900 CET	50005	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:45:21.412595987 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:21.621134043 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:21.621151924 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:21.621164083 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:21.621300936 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:45:21.711837053 CET	80	49732	185.126.115.108	192.168.2.6
Jan 9, 2025 00:45:21.765165091 CET	49732	80	192.168.2.6	185.126.115.108
Jan 9, 2025 00:45:22.371582031 CET	443	50003	216.58.212.132	192.168.2.6
Jan 9, 2025 00:45:22.371668100 CET	443	50003	216.58.212.132	192.168.2.6
Jan 9, 2025 00:45:22.371726990 CET	50003	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:45:23.916950941 CET	50003	443	192.168.2.6	216.58.212.132
Jan 9, 2025 00:45:23.916985989 CET	443	50003	216.58.212.132	192.168.2.6

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 00:44:07.566968918 CET	53	62201	1.1.1.1	192.168.2.6
Jan 9, 2025 00:44:07.587902069 CET	53	64215	1.1.1.1	192.168.2.6
Jan 9, 2025 00:44:08.567944050 CET	53	60881	1.1.1.1	192.168.2.6
Jan 9, 2025 00:44:11.744108915 CET	60609	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:11.744241953 CET	49742	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:11.750855923 CET	53	60609	1.1.1.1	192.168.2.6
Jan 9, 2025 00:44:11.750983000 CET	53	49742	1.1.1.1	192.168.2.6
Jan 9, 2025 00:44:13.124828100 CET	65039	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:13.125921965 CET	64554	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:13.136302948 CET	53	64554	1.1.1.1	192.168.2.6
Jan 9, 2025 00:44:13.136317015 CET	53	65039	1.1.1.1	192.168.2.6
Jan 9, 2025 00:44:16.613122940 CET	59922	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:16.613500118 CET	50474	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:16.636435032 CET	53	50474	1.1.1.1	192.168.2.6
Jan 9, 2025 00:44:17.237083912 CET	50170	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:17.237329960 CET	59256	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:18.707585096 CET	51173	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:18.707783937 CET	51177	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:18.722302914 CET	50574	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:18.723473072 CET	54886	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:44:25.502476931 CET	53	49403	1.1.1.1	192.168.2.6
Jan 9, 2025 00:44:34.967617035 CET	53	50745	1.1.1.1	192.168.2.6
Jan 9, 2025 00:44:44.526937962 CET	53	53489	1.1.1.1	192.168.2.6
Jan 9, 2025 00:45:07.050369978 CET	53	63616	1.1.1.1	192.168.2.6
Jan 9, 2025 00:45:07.599999905 CET	53	57851	1.1.1.1	192.168.2.6
Jan 9, 2025 00:45:19.545490026 CET	61779	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:45:19.545727015 CET	61217	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:45:21.293119907 CET	51986	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:45:21.293965101 CET	59908	53	192.168.2.6	1.1.1.1
Jan 9, 2025 00:45:21.301403046 CET	53	51986	1.1.1.1	192.168.2.6
Jan 9, 2025 00:45:21.303232908 CET	53	59908	1.1.1.1	192.168.2.6

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 9, 2025 00:44:16.636532068 CET	192.168.2.6	1.1.1.1	c248	(Port unreachable)	Destination Unreachable
Jan 9, 2025 00:44:18.775412083 CET	192.168.2.6	1.1.1.1	c273	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-01-08 23:44:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 65 53 64 6f 44 79 33 6a 30 4b 63 34 35 63 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 39 34 61 38 38 64 38 65 66 39 32 63 38 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8eSdoDy3j0Kc45cP.1Context: 7394a88d8ef92c85
2025-01-08 23:44:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-08 23:44:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 38 65 53 64 6f 44 79 33 6a 30 4b 63 34 35 63 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 39 34 61 38 38 64 38 65 66 39 32 63 38 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 2b 63 55 38 52 45 52 46 52 4e 43 49 67 30 74 5a 45 6c 42 67 73 66 4e 35 43 31 51 50 4a 56 55 65 46 5a 2f 55 6b 6e 34 59 67 77 67 69 4a 71 42 69 72 4e 63 5a 31 58 56 62 31 49 68 51 4d 6c 76 33 61 6b 39 35 64 37 48 76 4f 76 53 63 62 39 52 49 79 77 46 42 53 51 35 6f 71 36 49 54 4a 41 73 51 67 46 57 63 31 36 51 63 50 74 74 6e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 8eSdoDy3j0Kc45cP.2Context: 7394a88d8ef92c85<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ+cU8RERFRNCIg0tZElBgsfN5C1QPJVUeFZ/Ukn4YgwgiJqBirNcZ1XVb1IhQMlv3ak95d7HvOvScb9RIywFBSQ5oq6ITJAsQgFWc16QcPttn
2025-01-08 23:44:08 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 65 53 64 6f 44 79 33 6a 30 4b 63 34 35 63 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 39 34 61 38 38 64 38 65 66 39 32 63 38 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8eSdoDy3j0Kc45cP.3Context: 7394a88d8ef92c85<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-08 23:44:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-08 23:44:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 38 69 4a 50 6f 59 50 67 30 75 57 39 6d 47 47 33 45 34 48 63 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: J8iJPoYPg0uW9mGG3E4HcA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-08 23:44:16 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 7a 66 6e 4d 44 45 64 42 45 61 79 4c 68 6e 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 63 36 37 39 30 61 39 37 63 36 31 37 63 39 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: dzfnMDEdBEayLhnA.1Context: 4c6790a97c617c98
2025-01-08 23:44:16 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-08 23:44:16 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 64 7a 66 6e 4d 44 45 64 42 45 61 79 4c 68 6e 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 63 36 37 39 30 61 39 37 63 36 31 37 63 39 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 2b 63 55 38 52 45 52 46 52 4e 43 49 67 30 74 5a 45 6c 42 67 73 66 4e 35 43 31 51 50 4a 56 55 65 46 5a 2f 55 6b 6e 34 59 67 77 67 69 4a 71 42 69 72 4e 63 5a 31 58 56 62 31 49 68 51 4d 6c 76 33 61 6b 39 35 64 37 48 76 4f 76 53 63 62 39 52 49 79 77 46 42 53 51 35 6f 71 36 49 54 4a 41 73 51 67 46 57 63 31 36 51 63 50 74 74 6e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: dzfnMDEdBEayLhnA.2Context: 4c6790a97c617c98<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ+cU8RERFRNCIg0tZElBgsfN5C1QPJVUeFZ/Ukn4YgwgiJqBirNcZ1XVb1IhQMlv3ak95d7HvOvScb9RIywFBSQ5oq6ITJAsQgFWc16QcPttn
2025-01-08 23:44:16 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 7a 66 6e 4d 44 45 64 42 45 61 79 4c 68 6e 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 63 36 37 39 30 61 39 37 63 36 31 37 63 39 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: dzfnMDEdBEayLhnA.3Context: 4c6790a97c617c98<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-08 23:44:16 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-08 23:44:16 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 79 51 67 65 70 6b 6f 34 7a 6b 69 77 77 41 6d 59 41 64 44 66 73 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: yQgepko4zkiwwAmYAdDfsQ.0Payload parsing failed.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 45

Chrome Cache Entry: 46

Chrome Cache Entry: 47

Chrome Cache Entry: 48

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Windows Analysis Report
http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10

Timestamp	Bytes transferred	Direction	Data
2025-01-08 23:44:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 35 53 6d 66 6b 71 35 7a 30 69 64 56 6f 6f 4f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 61 65 63 64 37 37 36 64 36 35 39 65 30 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 15Smfkq5z0idVooO.1Context: 84aecd776d659e04
2025-01-08 23:44:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-08 23:44:30 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 35 53 6d 66 6b 71 35 7a 30 69 64 56 6f 6f 4f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 61 65 63 64 37 37 36 64 36 35 39 65 30 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 2b 63 55 38 52 45 52 46 52 4e 43 49 67 30 74 5a 45 6c 42 67 73 66 4e 35 43 31 51 50 4a 56 55 65 46 5a 2f 55 6b 6e 34 59 67 77 67 69 4a 71 42 69 72 4e 63 5a 31 58 56 62 31 49 68 51 4d 6c 76 33 61 6b 39 35 64 37 48 76 4f 76 53 63 62 39 52 49 79 77 46 42 53 51 35 6f 71 36 49 54 4a 41 73 51 67 46 57 63 31 36 51 63 50 74 74 6e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 15Smfkq5z0idVooO.2Context: 84aecd776d659e04<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ+cU8RERFRNCIg0tZElBgsfN5C1QPJVUeFZ/Ukn4YgwgiJqBirNcZ1XVb1IhQMlv3ak95d7HvOvScb9RIywFBSQ5oq6ITJAsQgFWc16QcPttn
2025-01-08 23:44:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 35 53 6d 66 6b 71 35 7a 30 69 64 56 6f 6f 4f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 61 65 63 64 37 37 36 64 36 35 39 65 30 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 15Smfkq5z0idVooO.3Context: 84aecd776d659e04<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-08 23:44:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-08 23:44:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 75 6a 6e 58 4f 4a 43 54 50 55 69 56 75 65 39 4d 47 64 43 32 47 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ujnXOJCTPUiVue9MGdC2Gg.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-08 23:44:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6a 2b 6f 62 48 68 44 46 2b 45 57 73 5a 68 65 55 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 39 39 64 37 64 38 37 61 63 32 62 33 66 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: j+obHhDF+EWsZheU.1Context: 3a99d7d87ac2b3fe
2025-01-08 23:44:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-08 23:44:53 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6a 2b 6f 62 48 68 44 46 2b 45 57 73 5a 68 65 55 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 39 39 64 37 64 38 37 61 63 32 62 33 66 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 2b 63 55 38 52 45 52 46 52 4e 43 49 67 30 74 5a 45 6c 42 67 73 66 4e 35 43 31 51 50 4a 56 55 65 46 5a 2f 55 6b 6e 34 59 67 77 67 69 4a 71 42 69 72 4e 63 5a 31 58 56 62 31 49 68 51 4d 6c 76 33 61 6b 39 35 64 37 48 76 4f 76 53 63 62 39 52 49 79 77 46 42 53 51 35 6f 71 36 49 54 4a 41 73 51 67 46 57 63 31 36 51 63 50 74 74 6e Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: j+obHhDF+EWsZheU.2Context: 3a99d7d87ac2b3fe<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ+cU8RERFRNCIg0tZElBgsfN5C1QPJVUeFZ/Ukn4YgwgiJqBirNcZ1XVb1IhQMlv3ak95d7HvOvScb9RIywFBSQ5oq6ITJAsQgFWc16QcPttn
2025-01-08 23:44:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6a 2b 6f 62 48 68 44 46 2b 45 57 73 5a 68 65 55 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 39 39 64 37 64 38 37 61 63 32 62 33 66 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: j+obHhDF+EWsZheU.3Context: 3a99d7d87ac2b3fe<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-08 23:44:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-08 23:44:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 72 6b 2b 31 37 57 72 4f 5a 55 79 34 77 7a 30 6f 4c 78 44 47 52 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: rk+17WrOZUy4wz0oLxDGRA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-08 23:45:17 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 77 58 77 61 65 53 7a 6c 56 55 4b 77 38 57 48 49 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 34 61 38 62 34 38 35 35 64 65 30 66 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: wXwaeSzlVUKw8WHI.1Context: c44a8b4855de0f0
2025-01-08 23:45:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-08 23:45:17 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 77 58 77 61 65 53 7a 6c 56 55 4b 77 38 57 48 49 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 34 61 38 62 34 38 35 35 64 65 30 66 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 2b 63 55 38 52 45 52 46 52 4e 43 49 67 30 74 5a 45 6c 42 67 73 66 4e 35 43 31 51 50 4a 56 55 65 46 5a 2f 55 6b 6e 34 59 67 77 67 69 4a 71 42 69 72 4e 63 5a 31 58 56 62 31 49 68 51 4d 6c 76 33 61 6b 39 35 64 37 48 76 4f 76 53 63 62 39 52 49 79 77 46 42 53 51 35 6f 71 36 49 54 4a 41 73 51 67 46 57 63 31 36 51 63 50 74 74 6e 5a Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: wXwaeSzlVUKw8WHI.2Context: c44a8b4855de0f0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ+cU8RERFRNCIg0tZElBgsfN5C1QPJVUeFZ/Ukn4YgwgiJqBirNcZ1XVb1IhQMlv3ak95d7HvOvScb9RIywFBSQ5oq6ITJAsQgFWc16QcPttnZ
2025-01-08 23:45:17 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 77 58 77 61 65 53 7a 6c 56 55 4b 77 38 57 48 49 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 34 61 38 62 34 38 35 35 64 65 30 66 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: wXwaeSzlVUKw8WHI.3Context: c44a8b4855de0f0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-08 23:45:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-08 23:45:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 46 71 6a 63 4c 61 75 4c 55 36 37 4f 37 37 64 71 61 69 35 70 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4FqjcLauLU67O77dqai5pQ.0Payload parsing failed.

Target ID:	1
Start time:	18:44:02
Start date:	08/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	18:44:06
Start date:	08/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,16602930227236961276,9513286687473577204,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	18:44:12
Start date:	08/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://topmarktingplace.com/4KCrhO42616HeLs1324axlafysauc110UGQLALGLNEZCHJM22589XDWY17548d10"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre