Windows Analysis Report
https://webmail.tallermultimarcassfk.com/

Overview

General Information

Sample URL:	https://webmail.tallermultimarcassfk.com/
Analysis ID:	1522251
Tags:	urlscan
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

HTML body contains low number of good links

Classification

Signatures

Phishing

AI detected phishing page

Source: https://webmail.tallermultimarcassfk.com/

LLM: Score: 9 Reasons: The URL 'tallermultimarcassfk.com' does not match the legitimate domain 'roundcube.net'., The domain 'tallermultimarcassfk.com' appears unrelated to Roundcube Webmail., The presence of 'webmail' as a subdomain is a common tactic used in phishing attempts to mimic legitimate webmail services., Roundcube Webmail is a known brand, and its legitimate domain is 'roundcube.net'., The URL contains extra words and characters that are not associated with the legitimate Roundcube domain. DOM: 0.0.pages.csv

HTML body contains low number of good links

Source: https://webmail.tallermultimarcassfk.com/

HTTP Parser: Number of links: 0

Source: https://webmail.tallermultimarcassfk.com/

HTTP Parser: <input type="password" .../> found

Source: https://webmail.tallermultimarcassfk.com/

HTTP Parser: No <meta name="author".. found

Source: https://webmail.tallermultimarcassfk.com/

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49766 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /skins/elastic/deps/bootstrap.min.css?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/styles/styles.min.css?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /plugins/jqueryui/themes/elastic/jquery-ui.min.css?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/jquery.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/common.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/app.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/jstz.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /plugins/jqueryui/js/jquery-ui.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/common.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/images/logo.svg?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/deps/bootstrap.bundle.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/jquery.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/app.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/jstz.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/ui.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/fonts/roboto-v29-regular.woff2 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://webmail.tallermultimarcassfk.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://webmail.tallermultimarcassfk.com/skins/elastic/styles/styles.min.css?s=1725059161Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/fonts/fa-solid-900.woff2 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://webmail.tallermultimarcassfk.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://webmail.tallermultimarcassfk.com/skins/elastic/styles/styles.min.css?s=1725059161Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /plugins/jqueryui/js/jquery-ui.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/images/logo.svg?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/deps/bootstrap.bundle.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/ui.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /skins/elastic/images/favicon.ico?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/images/favicon.ico?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c

Source: global traffic	DNS traffic detected: DNS query: webmail.tallermultimarcassfk.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_67.2.dr, chromecache_76.2.dr	String found in binary or memory: http://creativecommons.org/licenses/by-sa/3.0/
Source: chromecache_84.2.dr, chromecache_85.2.dr, chromecache_64.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_64.2.dr	String found in binary or memory: http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgConten
Source: chromecache_84.2.dr, chromecache_85.2.dr	String found in binary or memory: https://bugs.jqueryui.com/ticket/8593
Source: chromecache_69.2.dr, chromecache_66.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jstimezonedetect/1.0.7/jstz.min.js
Source: chromecache_75.2.dr, chromecache_79.2.dr, chromecache_68.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_73.2.dr, chromecache_63.2.dr	String found in binary or memory: https://github.com/jquery/jquery/tree/3.5.1
Source: chromecache_75.2.dr, chromecache_79.2.dr, chromecache_68.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_75.2.dr, chromecache_68.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49766 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@16/39@6/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2032,i,17783583094423800786,4365591173513125173,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://webmail.tallermultimarcassfk.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2032,i,17783583094423800786,4365591173513125173,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
94.130.92.83	webmail.tallermultimarcassfk.com	Germany	24940	HETZNER-ASDE	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.6

Contacted Domains

Name	IP	Active
webmail.tallermultimarcassfk.com	94.130.92.83	true
www.google.com	172.217.18.4	true
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true

Contacted URLs

Name	Malicious	Reputation
https://webmail.tallermultimarcassfk.com/skins/elastic/fonts/roboto-v29-regular.woff2	true	unknown
https://webmail.tallermultimarcassfk.com/skins/elastic/images/logo.svg?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/skins/elastic/styles/styles.min.css?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/program/js/common.min.js?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/plugins/jqueryui/js/jquery-ui.min.js?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/	true	unknown
https://webmail.tallermultimarcassfk.com/plugins/jqueryui/themes/elastic/jquery-ui.min.css?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/program/js/app.min.js?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/skins/elastic/ui.min.js?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/program/js/jstz.min.js?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/skins/elastic/deps/bootstrap.bundle.min.js?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/skins/elastic/deps/bootstrap.min.css?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/skins/elastic/fonts/fa-solid-900.woff2	true	unknown
https://webmail.tallermultimarcassfk.com/skins/elastic/images/favicon.ico?s=1725059161	true	unknown
https://webmail.tallermultimarcassfk.com/program/js/jquery.min.js?s=1725059161	true	unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 63	ASCII text, with very long lines (64001)	82229FCA667F868F77759D78EDAAECAF	12F2612174D39A99B21379AF57B5374AB4EFDB55	5641ED21773230A8110279658ABAC57BB5B4ABC7BF4091946C5E61E8F0021F55
Chrome Cache Entry: 64	ASCII text, with very long lines (26371)	7E848D774E13122792027C11B994C19C	276DF81DE919D3614FBB970A6DBDBB7A0570E40C	AAD541BCBD68B5EA0300C91B804637A2706E983A46D93546B109E6F322869107
Chrome Cache Entry: 65	ASCII text, with very long lines (11621)	171ACEE682D399411764B83FA04FEBB6	B2A11F6A8C6007B8681EACB5A5AFE7BC2F4418DE	061F93B16D52F124D1DF7B15BA43942736B743F733C77A7CB82B8D2D2AE0FD03
Chrome Cache Entry: 66	ASCII text, with very long lines (12309)	B5EE3CE2023C717FFF34CFE5D3B82599	36F532887C2BF6BC7BDD06E68E96EAFE2051A5F7	716ECE8DEB8412F7EC95AB395C92F6515BB8D8B792FD7480C014CDC6F063452A
Chrome Cache Entry: 67	HTML document, ASCII text, with very long lines (60849)	F57B38B0DB094535A5E1AAC30E0B70B3	E37DE1251A4FD851AA9B71FBAD6446E1B8DCDD2A	C7BE38B0D3DD4FD6954591E7C517D88FA0570535F46FFD91A43B7F5405767888
Chrome Cache Entry: 68	ASCII text, with very long lines (65299)	3FB9784331BA8D606CA6E0877B9466A3	2C8DDE7EA3CEE76F061C06BB64F9F00497F893F3	19B51730C10082760E6D9B82C1342E60855F98D2666C64E4EB758D26B1A0C840
Chrome Cache Entry: 69	ASCII text, with very long lines (12309)	B5EE3CE2023C717FFF34CFE5D3B82599	36F532887C2BF6BC7BDD06E68E96EAFE2051A5F7	716ECE8DEB8412F7EC95AB395C92F6515BB8D8B792FD7480C014CDC6F063452A
Chrome Cache Entry: 70	Web Open Font Format (Version 2), TrueType, length 50240, version 1.0	184A2A669CF798F8D80BCFBA041C3ECF	B8DBBF83B27B5E4F5588F997685B2CCFECF97FF6	659A8DEE04B272C247129FF6513D23C16F4F9C183B5D64E7347815AF8861A2A4
Chrome Cache Entry: 71	ASCII text, with no line terminators	5C541F3EAEB4AFBDFCA528EFDFCBEC1A	36E1348141AD3EB51C19E852F973B838DC71E9E0	78767F0A7A2976BFA4A0EE77045691CDEE1B0A1285D5B3C5FBE4D3AEB07A6788
Chrome Cache Entry: 72	Web Open Font Format (Version 2), TrueType, length 75440, version 329.-1049	B5CF8AE26748570D8FB95A47F46B69E1	07BED153D47F9129A944EE54DD72952DEED074C8	CD398BE1A91817126CEF10224738E624358EDF6F08043ABAD7E60C1AAECCC8D0
Chrome Cache Entry: 73	ASCII text, with very long lines (64001)	82229FCA667F868F77759D78EDAAECAF	12F2612174D39A99B21379AF57B5374AB4EFDB55	5641ED21773230A8110279658ABAC57BB5B4ABC7BF4091946C5E61E8F0021F55
Chrome Cache Entry: 74	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel	924A68D347C80D0E502157E83812BB23	1622A7CAA5A0CFA28A96CF10043D6E7B63B491E3	7B30E499996EC4631848D3509D803D9311F5D71999212F2F4C1CA7AF8F24EB69
Chrome Cache Entry: 75	ASCII text, with very long lines (65299)	3FB9784331BA8D606CA6E0877B9466A3	2C8DDE7EA3CEE76F061C06BB64F9F00497F893F3	19B51730C10082760E6D9B82C1342E60855F98D2666C64E4EB758D26B1A0C840
Chrome Cache Entry: 76	HTML document, ASCII text, with very long lines (60849)	F57B38B0DB094535A5E1AAC30E0B70B3	E37DE1251A4FD851AA9B71FBAD6446E1B8DCDD2A	C7BE38B0D3DD4FD6954591E7C517D88FA0570535F46FFD91A43B7F5405767888
Chrome Cache Entry: 77	ASCII text, with very long lines (64152)	BB75521CC54DD5AE1E7DE75F6D628DD9	5B99305A6CC75680818AA8C13AC8E7B7D488C6A1	5F16D36B0CC8AED12F47E795458FDC45B4F8D60B69177A19AA7D1924DAE6315D
Chrome Cache Entry: 78	SVG Scalable Vector Graphics image	DDEFFD34EAE92B1B9B9C636636E4B9C8	19CB881A5D08D31DB933DA6440595767D0A02D94	2B2D9C7A82F92976268B03E13C61F64EAD91A3C63B97C59CEF2ACBF501F67618
Chrome Cache Entry: 79	ASCII text, with very long lines (65326)	C19C75612682A6FA2491C27DEE895ACC	7344D84F61735EB9653B729E71D81B3431AD803C	3CB5B7AE5053D743996378C35733560214D3D896ADE5C0DE0D8B13A97F43039E
Chrome Cache Entry: 80	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel	924A68D347C80D0E502157E83812BB23	1622A7CAA5A0CFA28A96CF10043D6E7B63B491E3	7B30E499996EC4631848D3509D803D9311F5D71999212F2F4C1CA7AF8F24EB69
Chrome Cache Entry: 81	ASCII text, with very long lines (65536), with no line terminators	9FB7568FED3BEE7B1976FF43E4AE1CCC	FEC75502A25D4485C8FC236AFC9C4222922EBF8D	96D078EC9395C96D6758949E5ABA41015F9B1C0C8F1DD0881B7D746DD92C7540
Chrome Cache Entry: 82	ASCII text, with very long lines (11621)	171ACEE682D399411764B83FA04FEBB6	B2A11F6A8C6007B8681EACB5A5AFE7BC2F4418DE	061F93B16D52F124D1DF7B15BA43942736B743F733C77A7CB82B8D2D2AE0FD03
Chrome Cache Entry: 83	SVG Scalable Vector Graphics image	DDEFFD34EAE92B1B9B9C636636E4B9C8	19CB881A5D08D31DB933DA6440595767D0A02D94	2B2D9C7A82F92976268B03E13C61F64EAD91A3C63B97C59CEF2ACBF501F67618
Chrome Cache Entry: 84	Unicode text, UTF-8 text, with very long lines (64399)	01B00DC27E3831F4F8093FC111890E6E	B9B8F114C58D3EA37F75216550A0F6C5022885F9	45B30930D5752603CDFF2D24AA942B5BBAE3168F62E74E092CD9405FF10127F7
Chrome Cache Entry: 85	Unicode text, UTF-8 text, with very long lines (64399)	01B00DC27E3831F4F8093FC111890E6E	B9B8F114C58D3EA37F75216550A0F6C5022885F9	45B30930D5752603CDFF2D24AA942B5BBAE3168F62E74E092CD9405FF10127F7
Chrome Cache Entry: 86	ASCII text, with very long lines (64152)	BB75521CC54DD5AE1E7DE75F6D628DD9	5B99305A6CC75680818AA8C13AC8E7B7D488C6A1	5F16D36B0CC8AED12F47E795458FDC45B4F8D60B69177A19AA7D1924DAE6315D

Phishing

AI detected phishing page

Source: https://webmail.tallermultimarcassfk.com/

HTML body contains low number of good links

Source: https://webmail.tallermultimarcassfk.com/

HTTP Parser: Number of links: 0

Source: https://webmail.tallermultimarcassfk.com/

HTTP Parser: <input type="password" .../> found

Source: https://webmail.tallermultimarcassfk.com/

HTTP Parser: No <meta name="author".. found

Source: https://webmail.tallermultimarcassfk.com/

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49766 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /skins/elastic/deps/bootstrap.min.css?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/styles/styles.min.css?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /plugins/jqueryui/themes/elastic/jquery-ui.min.css?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/jquery.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/common.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/app.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/jstz.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /plugins/jqueryui/js/jquery-ui.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/common.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/images/logo.svg?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/deps/bootstrap.bundle.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/jquery.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/app.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /program/js/jstz.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/ui.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/fonts/roboto-v29-regular.woff2 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://webmail.tallermultimarcassfk.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://webmail.tallermultimarcassfk.com/skins/elastic/styles/styles.min.css?s=1725059161Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/fonts/fa-solid-900.woff2 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://webmail.tallermultimarcassfk.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://webmail.tallermultimarcassfk.com/skins/elastic/styles/styles.min.css?s=1725059161Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /plugins/jqueryui/js/jquery-ui.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/images/logo.svg?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/deps/bootstrap.bundle.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/ui.min.js?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /skins/elastic/images/favicon.ico?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://webmail.tallermultimarcassfk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c
Source: global traffic	HTTP traffic detected: GET /skins/elastic/images/favicon.ico?s=1725059161 HTTP/1.1Host: webmail.tallermultimarcassfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: roundcube_sessid=nu6rltk90uhqib0ip9llh56o1c

Source: global traffic	DNS traffic detected: DNS query: webmail.tallermultimarcassfk.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_67.2.dr, chromecache_76.2.dr	String found in binary or memory: http://creativecommons.org/licenses/by-sa/3.0/
Source: chromecache_84.2.dr, chromecache_85.2.dr, chromecache_64.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_64.2.dr	String found in binary or memory: http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgConten
Source: chromecache_84.2.dr, chromecache_85.2.dr	String found in binary or memory: https://bugs.jqueryui.com/ticket/8593
Source: chromecache_69.2.dr, chromecache_66.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jstimezonedetect/1.0.7/jstz.min.js
Source: chromecache_75.2.dr, chromecache_79.2.dr, chromecache_68.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_73.2.dr, chromecache_63.2.dr	String found in binary or memory: https://github.com/jquery/jquery/tree/3.5.1
Source: chromecache_75.2.dr, chromecache_79.2.dr, chromecache_68.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_75.2.dr, chromecache_68.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49766 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@16/39@6/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2032,i,17783583094423800786,4365591173513125173,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://webmail.tallermultimarcassfk.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2032,i,17783583094423800786,4365591173513125173,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1522251
Product:	CloudBasic
Start time:	15:21:24
Start date:	29.09.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://webmail.tallermultimarcassfk.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://webmail.tallermultimarcassfk.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://webmail.tallermultimarcassfk.com/