Edit tour

Windows Analysis Report
https://form.fillout.com/t/emEtLm993dus

Overview

General Information

Sample URL:	https://form.fillout.com/t/emEtLm993dus
Analysis ID:	1587287
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Phishing site or detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML title does not match URL

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 1592 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 6776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2196,i,876691574228186086,369967215887521989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2208 /prefetch:11 MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 5108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://form.fillout.com/t/emEtLm993dus" MD5: 290DF23002E9B52249B5549F0C668A86)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: https://form.fillout.com/t/emEtLm993dus	Joe Sandbox AI: Page contains button: 'VIEW DOCUMENT HERE' Source: '0.0.pages.csv'
Source: https://form.fillout.com/t/emEtLm993dus	Joe Sandbox AI: Page contains button: 'VIEW DOCUMENT HERE' Source: '0.1.pages.csv'

AI detected suspicious Javascript

Source: 0.19..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://form.fillout.com/_next/static/chunks/1818-... The provided JavaScript snippet demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script appears to be related to SVG manipulation and loading, the presence of these concerning behaviors suggests a medium to high risk level. Further investigation would be necessary to determine the full extent of the potential security risks.

Source: Chrome DOM: 0.1	OCR Text: Hydraulic Crane Specialists, Inc. VIEW DOCUMENT HERE Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe, provides a professional trusted solution for Digital Transaction ManagementTM.
Source: Chrome DOM: 0.0	OCR Text: Hydraulic Crane Specialists, Inc. VIEW DOCUMENT HERE Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe, provides a professional trusted solution for Digital Transaction Managementl*.

Source: https://form.fillout.com/t/emEtLm993dus	HTTP Parser: No <meta name="author".. found
Source: https://form.fillout.com/t/emEtLm993dus	HTTP Parser: No <meta name="author".. found

Source: https://form.fillout.com/t/emEtLm993dus	HTTP Parser: No <meta name="copyright".. found
Source: https://form.fillout.com/t/emEtLm993dus	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:49798 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 98.64.238.3
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 98.64.238.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.209.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.209.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.209.135
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.163
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.209.135
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.192
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.158.192
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.209.135
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.209.135
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.163
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /country-flag-icons/3x2/US.svg HTTP/1.1Host: purecatamphetamine.github.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://form.fillout.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /country-flag-icons/3x2/US.svg HTTP/1.1Host: purecatamphetamine.github.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cache-Control: max-age = 3600Connection: Keep-AliveAccept: /If-Modified-Since: Mon, 12 Feb 2024 22:07:27 GMTIf-None-Match: "65ca969f-2cd"User-Agent: Microsoft-CryptoAPI/10.0Host: x1.c.lencr.org

Source: global traffic	DNS traffic detected: DNS query: form.fillout.com
Source: global traffic	DNS traffic detected: DNS query: rsms.me
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.fillout.com
Source: global traffic	DNS traffic detected: DNS query: images.fillout.com
Source: global traffic	DNS traffic detected: DNS query: purecatamphetamine.github.io
Source: global traffic	DNS traffic detected: DNS query: build.fillout.com

Source: chromecache_239.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwaPGR_p.woff2)
Source: chromecache_239.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ.woff2)
Source: chromecache_239.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
Source: chromecache_239.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
Source: chromecache_239.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2)
Source: chromecache_239.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2196,i,876691574228186086,369967215887521989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2208 /prefetch:11
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://form.fillout.com/t/emEtLm993dus"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2196,i,876691574228186086,369967215887521989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2208 /prefetch:11	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	Malicious	Antivirus Detection	Reputation
https://form.fillout.com/t/emEtLm993dus	true		unknown
https://purecatamphetamine.github.io/country-flag-icons/3x2/US.svg	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.0.150	images.fillout.com	United States	13335	CLOUDFLARENETUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
185.199.111.153	unknown	Netherlands	54113	FASTLYUS	false
104.21.58.14	rsms.me	United States	13335	CLOUDFLARENETUS	false
104.26.1.150	build.fillout.com	United States	13335	CLOUDFLARENETUS	false
185.199.108.153	purecatamphetamine.github.io	Netherlands	54113	FASTLYUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587287
Start date and time:	2025-01-10 04:18:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://form.fillout.com/t/emEtLm993dus
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@17/213@24/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 21070
Category:	dropped
Size (bytes):	8157
Entropy (8bit):	7.973331231720689
Encrypted:	false
SSDEEP:	192:LVlkHTVElUXE4wJJx5Y64KDaZb9aa8R/buiSDiZwDSj:LVlkHREKk+8+0bsDiZhj
MD5:	482A8FF9E7C0B205996C111840217441
SHA1:	8D6BACBE08C658F05C7F6DB186A2BA634417EB1B
SHA-256:	E85EDFC4DAE02F66F0BE5CBCAFF1A5D159808440B11ED7CF8C9FD39651458339
SHA-512:	AAC42E876AA4FFEC15749F95D242F5A0C4194292340700F9A583D510E829E07AC158707221B7D4ADE52B216B653E85C6C0E841A57B41DE3A3B8BD75375BABDC3
Malicious:	false
Reputation:	low
Preview:	...........<.v.8.."k..rM.v2.......O\|..t.m{.(.......>b.....$gwg.m..q..B.N....h.}......o..nx:.{+kg.......uu....7...L.I..y(.K..+.S...+k..v..V..0..H.."...\.d"?W2..S.&n...?D.&..&...!..T...@d...\W...7....D..C.!..G...J..p...O.....@&.S..n6..E2..0.......I.BL"..3.p6.B..\%.B%-1........h.j.N.$.@.P...`3....%d".Z..v.9."%[.7.v...!Uw"U..nm'^...v.U....3..K.dZk..\|.j...WCp...j....jS"....~Z...<.Mlg.rZ...&..Z...x.v..t!...._d...z.Wo..RR95..JZ..j..W."....H....{D@.g'.z.;.K66........[.Y_..53\|kT.r..4Y.T.I...;Ig....m....`ry.:...U9}@<'..........\...z.z}.^....W....N..Nz .9...Q...zR.....N....oz..jg..m.Z...S@...9a\+.....<.s.....o...y)\.z.-=J.E...@.t..."..L...=..$...V.;..iH...V........h.g...@.0..+$aTW...%.i.n.S.R.I.yZM1...r..,.V.......D.`..#.6h..vA}.z....f...........s.I .\|.m+..h.....ZWm....Ha.(.<.....2.v.$..H`.....PB:...T......R..}/d.]Fr....5*.....?..3..F......B...1'...J.)e...!7.s_'Q.Q..?"..].\|D...#.n<.....)e.(../A.(".1. .,.PDc0...V.C.P..D..DJ^.l<...

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 04:19:30.182710886 CET	53	63061	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:30.211994886 CET	53	50455	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:31.298619032 CET	56382	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:31.298779011 CET	55197	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:31.308826923 CET	53	56382	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:31.309823036 CET	53	55197	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:31.420368910 CET	53	61314	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:32.708334923 CET	61380	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:32.708498955 CET	52459	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:32.715470076 CET	53	61380	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:32.715483904 CET	53	52459	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:33.501293898 CET	61675	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:33.501455069 CET	53842	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:33.509872913 CET	53	61675	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:33.511843920 CET	53	53842	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:34.274976015 CET	52788	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:34.275166988 CET	64349	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:34.281861067 CET	53	64349	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:34.281879902 CET	53	52788	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:34.387267113 CET	50787	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:34.387509108 CET	56194	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:34.407555103 CET	53	56194	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:34.559056997 CET	61383	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:34.559262037 CET	49829	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:34.568028927 CET	53	61383	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:34.568648100 CET	53	49829	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:34.585136890 CET	53	59054	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:36.892666101 CET	53	54265	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:36.969821930 CET	52678	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:36.970166922 CET	59161	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:36.978259087 CET	53	52678	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:37.005146027 CET	53	59161	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:37.163777113 CET	53337	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:37.164210081 CET	64033	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:37.171847105 CET	53	53337	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:37.172437906 CET	53	64033	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:37.410350084 CET	58843	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:37.410538912 CET	63005	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:37.442238092 CET	53	63005	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:37.985306025 CET	61218	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:37.985483885 CET	55359	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:37.992364883 CET	53	61218	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:37.992466927 CET	53	55359	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:38.558963060 CET	63832	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:38.559115887 CET	53289	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:38.568001986 CET	53	63832	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:38.569735050 CET	53	53289	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:40.179153919 CET	57007	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:40.179373026 CET	62150	53	192.168.2.24	1.1.1.1
Jan 10, 2025 04:19:40.188374996 CET	53	57007	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:40.191651106 CET	53	62150	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:48.410073042 CET	53	63667	1.1.1.1	192.168.2.24
Jan 10, 2025 04:19:59.264476061 CET	53	57465	1.1.1.1	192.168.2.24
Jan 10, 2025 04:20:07.221496105 CET	53	64900	1.1.1.1	192.168.2.24
Jan 10, 2025 04:20:29.611780882 CET	53	53674	1.1.1.1	192.168.2.24
Jan 10, 2025 04:20:29.829916954 CET	53	54151	1.1.1.1	192.168.2.24
Jan 10, 2025 04:21:00.805387974 CET	53	55465	1.1.1.1	192.168.2.24

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 04:20:11.928901911 CET	200	OUT	GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Jan 10, 2025 04:20:12.542469978 CET	223	IN	HTTP/1.1 304 Not Modified Date: Fri, 10 Jan 2025 02:46:00 GMT Expires: Fri, 10 Jan 2025 03:36:00 GMT Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding Age: 2052

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 04:20:12.563734055 CET	227	OUT	GET / HTTP/1.1 Cache-Control: max-age = 3600 Connection: Keep-Alive Accept: / If-Modified-Since: Mon, 12 Feb 2024 22:07:27 GMT If-None-Match: "65ca969f-2cd" User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.c.lencr.org
Jan 10, 2025 04:20:13.208604097 CET	1023	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-crl Last-Modified: Fri, 13 Dec 2024 18:01:23 GMT ETag: "675c7673-2de" Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 04:20:13 GMT Date: Fri, 10 Jan 2025 03:20:13 GMT Content-Length: 734 Connection: keep-alive Data Raw: 30 82 02 da 30 81 c3 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 17 0d 32 34 31 32 31 31 30 30 30 30 30 30 5a 17 0d 32 35 31 31 31 30 32 33 35 39 35 39 5a a0 40 30 3e 30 1f 06 03 55 1d 23 04 18 30 16 80 14 79 b4 59 e6 7b b6 e5 e4 01 73 80 08 88 c8 1a 58 f6 e9 9b 6e 30 0a 06 03 55 1d 14 04 03 02 01 69 30 0f 06 03 55 1d 1c 01 01 ff 04 05 30 03 82 01 ff 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 03 82 02 01 00 25 d9 d5 af d1 d6 2f 91 05 35 50 65 d7 ad 13 d8 3b 73 d1 3f 5e 09 69 7f d7 82 29 12 c5 82 d0 96 fe 5f 07 a4 fe f5 92 dc e4 e2 8a 1a 2a 29 c5 eb 97 c8 85 a5 44 9b 9d ba 7b 05 2b 3f e3 3c 18 1c de 8d 37 f6 27 b5 e7 9b ef 45 e7 57 0e c1 f9 07 a5 95 44 fe e1 de 7f 9d e1 31 8c f8 1b 4f 18 5d f8 3d d7 5b e6 e2 03 a6 cb 71 0d ef 7a fe e0 8e f4 5d 1c c5 [TRUNCATED] Data Ascii: 000H0O10UUS1)0'U Internet Security Research Group10UISRG Root X1241211000000Z251110235959Z@0>0U#0yY{sXn0Ui0U00H%/5Pe;s?^i)_)D{+?<7'EWD1O]=[qz]"2t@^+(zULdQpK?W)pqxW[6[V7?36_s$BwT+xw_]df_nu}yIqC`sVuP,@`\|T+`/Pm w[!:O%'w9enSkbv}gGL")V 2kzr/xx}8i]oA,^i=pt>#6&7$_?k/( kAslBQDhXh~N T/BF?QCGwsS:

Timestamp	Bytes transferred	Direction	Data
2025-01-10 03:19:37 UTC	624	OUT	GET /country-flag-icons/3x2/US.svg HTTP/1.1 Host: purecatamphetamine.github.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://form.fillout.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-01-10 03:19:37 UTC	744	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1352 Server: GitHub.com Content-Type: image/svg+xml permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Tue, 09 Jul 2024 13:30:38 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "668d3b7e-548" expires: Thu, 09 Jan 2025 11:33:11 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 47B6:3FDE35:1352D1F:14C5552:677FB19F Accept-Ranges: bytes Age: 318 Date: Fri, 10 Jan 2025 03:19:37 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740060-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1736479178.920729,VS0,VE3 Vary: Accept-Encoding X-Fastly-Request-ID: 507f114e58fa403bce0f6a7720e1dbe3089bceb3
2025-01-10 03:19:37 UTC	1352	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 31 33 20 33 34 32 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 46 46 46 22 20 64 3d 22 4d 30 20 30 68 35 31 33 76 33 34 32 48 30 7a 22 2f 3e 3c 67 20 66 69 6c 6c 3d 22 23 44 38 30 30 32 37 22 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 35 32 2e 36 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 31 30 35 2e 32 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 31 35 37 2e 38 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 32 31 30 2e 35 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 32 36 33 2e 31 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 33 31 35 2e 37 68 35 31 33 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 513 342"><path fill="#FFF" d="M0 0h513v342H0z"/><g fill="#D80027"><path d="M0 0h513v26.3H0zM0 52.6h513v26.3H0zM0 105.2h513v26.3H0zM0 157.8h513v26.3H0zM0 210.5h513v26.3H0zM0 263.1h513v26.3H0zM0 315.7h513

Timestamp	Bytes transferred	Direction	Data
2025-01-10 03:19:38 UTC	387	OUT	GET /country-flag-icons/3x2/US.svg HTTP/1.1 Host: purecatamphetamine.github.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-01-10 03:19:39 UTC	743	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1352 Server: GitHub.com Content-Type: image/svg+xml permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Tue, 09 Jul 2024 13:30:38 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "668d3b7e-548" expires: Mon, 06 Jan 2025 12:52:06 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F35B:359572:12299A2:14A4796:677BCF9E Accept-Ranges: bytes Age: 0 Date: Fri, 10 Jan 2025 03:19:39 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890075-NYC X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1736479179.974722,VS0,VE44 Vary: Accept-Encoding X-Fastly-Request-ID: 685212ee52ae14d6ae63fff183ad3f90f7eaffb1
2025-01-10 03:19:39 UTC	1352	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 31 33 20 33 34 32 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 46 46 46 22 20 64 3d 22 4d 30 20 30 68 35 31 33 76 33 34 32 48 30 7a 22 2f 3e 3c 67 20 66 69 6c 6c 3d 22 23 44 38 30 30 32 37 22 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 35 32 2e 36 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 31 30 35 2e 32 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 31 35 37 2e 38 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 32 31 30 2e 35 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 32 36 33 2e 31 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 33 31 35 2e 37 68 35 31 33 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 513 342"><path fill="#FFF" d="M0 0h513v342H0z"/><g fill="#D80027"><path d="M0 0h513v26.3H0zM0 52.6h513v26.3H0zM0 105.2h513v26.3H0zM0 157.8h513v26.3H0zM0 210.5h513v26.3H0zM0 263.1h513v26.3H0zM0 315.7h513

Timestamp	Bytes transferred	Direction	Data
2025-01-10 03:20:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 73 58 33 34 73 2f 35 72 2f 45 53 4e 41 46 70 4c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 35 34 33 65 31 61 62 33 34 31 30 30 37 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: sX34s/5r/ESNAFpL.1Context: 89543e1ab341007c
2025-01-10 03:20:39 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2025-01-10 03:20:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 73 58 33 34 73 2f 35 72 2f 45 53 4e 41 46 70 4c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 35 34 33 65 31 61 62 33 34 31 30 30 37 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 61 67 31 4a 50 32 39 2b 42 7a 4d 39 54 66 4b 46 68 4d 47 70 4e 6f 47 63 35 35 53 44 6b 70 6d 2f 6b 44 31 34 75 56 65 37 66 37 5a 44 6a 6d 64 42 63 7a 76 75 71 45 36 79 70 6f 62 72 45 56 51 31 73 75 73 55 54 2f 49 36 44 4e 72 51 72 52 47 61 4e 74 65 6e 59 50 6b 77 2b 55 76 2f 58 37 30 4e 35 69 5a 6d 2b 78 43 43 65 39 4c 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: sX34s/5r/ESNAFpL.2Context: 89543e1ab341007c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbag1JP29+BzM9TfKFhMGpNoGc55SDkpm/kD14uVe7f7ZDjmdBczvuqE6ypobrEVQ1susUT/I6DNrQrRGaNtenYPkw+Uv/X70N5iZm+xCCe9L6
2025-01-10 03:20:39 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 73 58 33 34 73 2f 35 72 2f 45 53 4e 41 46 70 4c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 35 34 33 65 31 61 62 33 34 31 30 30 37 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: sX34s/5r/ESNAFpL.3Context: 89543e1ab341007c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 03:20:40 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 03:20:40 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 6b 39 56 35 79 51 53 45 30 6d 74 35 43 64 34 64 42 62 67 79 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Dk9V5yQSE0mt5Cd4dBbgyA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-10 03:20:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 4d 61 54 44 30 31 64 61 59 30 69 54 74 6c 2f 75 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 64 39 63 61 36 33 33 31 63 30 32 61 62 35 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: MaTD01daY0iTtl/u.1Context: 2d9ca6331c02ab5b
2025-01-10 03:20:41 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2025-01-10 03:20:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4d 61 54 44 30 31 64 61 59 30 69 54 74 6c 2f 75 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 64 39 63 61 36 33 33 31 63 30 32 61 62 35 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 61 67 31 4a 50 32 39 2b 42 7a 4d 39 54 66 4b 46 68 4d 47 70 4e 6f 47 63 35 35 53 44 6b 70 6d 2f 6b 44 31 34 75 56 65 37 66 37 5a 44 6a 6d 64 42 63 7a 76 75 71 45 36 79 70 6f 62 72 45 56 51 31 73 75 73 55 54 2f 49 36 44 4e 72 51 72 52 47 61 4e 74 65 6e 59 50 6b 77 2b 55 76 2f 58 37 30 4e 35 69 5a 6d 2b 78 43 43 65 39 4c 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: MaTD01daY0iTtl/u.2Context: 2d9ca6331c02ab5b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbag1JP29+BzM9TfKFhMGpNoGc55SDkpm/kD14uVe7f7ZDjmdBczvuqE6ypobrEVQ1susUT/I6DNrQrRGaNtenYPkw+Uv/X70N5iZm+xCCe9L6
2025-01-10 03:20:41 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4d 61 54 44 30 31 64 61 59 30 69 54 74 6c 2f 75 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 64 39 63 61 36 33 33 31 63 30 32 61 62 35 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: MaTD01daY0iTtl/u.3Context: 2d9ca6331c02ab5b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 03:20:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 03:20:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 67 39 63 39 4f 42 6e 4a 6b 53 4b 4e 77 46 65 50 31 78 78 64 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qg9c9OBnJkSKNwFeP1xxdQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-10 03:20:50 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 78 7a 7a 45 46 57 31 4b 62 45 75 4f 6f 62 37 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 62 31 34 64 31 38 34 33 35 62 35 39 66 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: xzzEFW1KbEuOob7A.1Context: e0b14d18435b59f3
2025-01-10 03:20:50 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2025-01-10 03:20:50 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 78 7a 7a 45 46 57 31 4b 62 45 75 4f 6f 62 37 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 62 31 34 64 31 38 34 33 35 62 35 39 66 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 61 67 31 4a 50 32 39 2b 42 7a 4d 39 54 66 4b 46 68 4d 47 70 4e 6f 47 63 35 35 53 44 6b 70 6d 2f 6b 44 31 34 75 56 65 37 66 37 5a 44 6a 6d 64 42 63 7a 76 75 71 45 36 79 70 6f 62 72 45 56 51 31 73 75 73 55 54 2f 49 36 44 4e 72 51 72 52 47 61 4e 74 65 6e 59 50 6b 77 2b 55 76 2f 58 37 30 4e 35 69 5a 6d 2b 78 43 43 65 39 4c 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: xzzEFW1KbEuOob7A.2Context: e0b14d18435b59f3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbag1JP29+BzM9TfKFhMGpNoGc55SDkpm/kD14uVe7f7ZDjmdBczvuqE6ypobrEVQ1susUT/I6DNrQrRGaNtenYPkw+Uv/X70N5iZm+xCCe9L6
2025-01-10 03:20:50 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 78 7a 7a 45 46 57 31 4b 62 45 75 4f 6f 62 37 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 62 31 34 64 31 38 34 33 35 62 35 39 66 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: xzzEFW1KbEuOob7A.3Context: e0b14d18435b59f3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 03:20:50 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 03:20:50 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 35 70 43 55 2b 65 71 4d 55 36 56 7a 68 43 61 33 33 54 5a 5a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: L5pCU+eqMU6VzhCa33TZZQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-10 03:21:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 6e 65 41 6a 49 2b 4b 35 43 55 69 71 49 51 4b 2b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 65 62 61 66 61 62 34 65 62 33 64 31 61 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: neAjI+K5CUiqIQK+.1Context: 65ebafab4eb3d1af
2025-01-10 03:21:06 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2025-01-10 03:21:06 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6e 65 41 6a 49 2b 4b 35 43 55 69 71 49 51 4b 2b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 65 62 61 66 61 62 34 65 62 33 64 31 61 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 61 67 31 4a 50 32 39 2b 42 7a 4d 39 54 66 4b 46 68 4d 47 70 4e 6f 47 63 35 35 53 44 6b 70 6d 2f 6b 44 31 34 75 56 65 37 66 37 5a 44 6a 6d 64 42 63 7a 76 75 71 45 36 79 70 6f 62 72 45 56 51 31 73 75 73 55 54 2f 49 36 44 4e 72 51 72 52 47 61 4e 74 65 6e 59 50 6b 77 2b 55 76 2f 58 37 30 4e 35 69 5a 6d 2b 78 43 43 65 39 4c 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: neAjI+K5CUiqIQK+.2Context: 65ebafab4eb3d1af<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbag1JP29+BzM9TfKFhMGpNoGc55SDkpm/kD14uVe7f7ZDjmdBczvuqE6ypobrEVQ1susUT/I6DNrQrRGaNtenYPkw+Uv/X70N5iZm+xCCe9L6
2025-01-10 03:21:06 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6e 65 41 6a 49 2b 4b 35 43 55 69 71 49 51 4b 2b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 35 65 62 61 66 61 62 34 65 62 33 64 31 61 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: neAjI+K5CUiqIQK+.3Context: 65ebafab4eb3d1af<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 03:21:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 03:21:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 52 7a 30 59 44 6c 4d 77 73 55 79 77 77 49 48 65 7a 55 53 2b 37 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Rz0YDlMwsUywwIHezUS+7g.0Payload parsing failed.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://form.fillout.com/t/emEtLm993dus

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Windows Analysis Report
https://form.fillout.com/t/emEtLm993dus

Timestamp	Bytes transferred	Direction	Data
2025-01-10 03:21:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 50 2f 4d 70 6e 63 63 42 39 55 4b 69 69 6a 72 78 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 38 36 66 32 38 64 61 39 64 31 65 32 38 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: P/MpnccB9UKiijrx.1Context: 9686f28da9d1e286
2025-01-10 03:21:25 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2025-01-10 03:21:25 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 50 2f 4d 70 6e 63 63 42 39 55 4b 69 69 6a 72 78 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 38 36 66 32 38 64 61 39 64 31 65 32 38 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 61 67 31 4a 50 32 39 2b 42 7a 4d 39 54 66 4b 46 68 4d 47 70 4e 6f 47 63 35 35 53 44 6b 70 6d 2f 6b 44 31 34 75 56 65 37 66 37 5a 44 6a 6d 64 42 63 7a 76 75 71 45 36 79 70 6f 62 72 45 56 51 31 73 75 73 55 54 2f 49 36 44 4e 72 51 72 52 47 61 4e 74 65 6e 59 50 6b 77 2b 55 76 2f 58 37 30 4e 35 69 5a 6d 2b 78 43 43 65 39 4c 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: P/MpnccB9UKiijrx.2Context: 9686f28da9d1e286<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbag1JP29+BzM9TfKFhMGpNoGc55SDkpm/kD14uVe7f7ZDjmdBczvuqE6ypobrEVQ1susUT/I6DNrQrRGaNtenYPkw+Uv/X70N5iZm+xCCe9L6
2025-01-10 03:21:25 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 50 2f 4d 70 6e 63 63 42 39 55 4b 69 69 6a 72 78 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 38 36 66 32 38 64 61 39 64 31 65 32 38 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: P/MpnccB9UKiijrx.3Context: 9686f28da9d1e286<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-10 03:21:25 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-10 03:21:25 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 52 31 42 66 6a 70 79 71 44 45 57 79 4e 6f 41 55 68 38 66 33 50 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: R1BfjpyqDEWyNoAUh8f3Pg.0Payload parsing failed.

Target ID:	0
Start time:	22:19:27
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6dd7a0000
File size:	3'001'952 bytes
MD5 hash:	290DF23002E9B52249B5549F0C668A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	22:19:28
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2196,i,876691574228186086,369967215887521989,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2208 /prefetch:11
Imagebase:	0x7ff6dd7a0000
File size:	3'001'952 bytes
MD5 hash:	290DF23002E9B52249B5549F0C668A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	22:19:29
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://form.fillout.com/t/emEtLm993dus"
Imagebase:	0x7ff6dd7a0000
File size:	3'001'952 bytes
MD5 hash:	290DF23002E9B52249B5549F0C668A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre