Edit tour

Windows Analysis Report
http://188.114.96.3

Overview

General Information

Sample URL:	http://188.114.96.3
Analysis ID:	1638462
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected Powershell download and execute

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,6173184686010921257,3047257492745393520,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2112 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2040,i,6173184686010921257,3047257492745393520,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6740 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://188.114.96.3" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_293	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T12:14:54.355441+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	61869	172.66.0.227	443	TCP
2025-03-14T12:14:54.577403+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	61875	172.66.0.227	443	TCP
2025-03-14T12:14:55.309954+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	61898	104.18.27.193	443	TCP

HTTP traffic detected: POST /api/v1/event HTTP/1.1Host: sparrow.cloudflare.comConnection: keep-aliveContent-Length: 87sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/jsonSparrow-Source-Key: c771f0e4b54944bebf4261d44bd79a1esec-ch-ua-mobile: ?0Accept: */*Origin: http://188.114.96.3Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: http://188.114.96.3/	HTTP Parser: No favicon
Source: http://188.114.96.3/	HTTP Parser: No favicon
Source: https://www.cloudflare.com/what-is-cloudflare/	HTTP Parser: No favicon
Source: https://www.cloudflare.com/what-is-cloudflare/	HTTP Parser: No favicon
Source: https://www.cloudflare.com/what-is-cloudflare/	HTTP Parser: No favicon
Source: https://www.cloudflare.com/what-is-cloudflare/	HTTP Parser: No favicon
Source: https://www.cloudflare.com/what-is-cloudflare/	HTTP Parser: No favicon
Source: https://www.cloudflare.com/what-is-cloudflare/	HTTP Parser: No favicon
Source: https://www.cloudflare.com/under-attack-hotline/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 142.250.185.68:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.31.78:443 -> 192.168.2.4:61745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.4:61754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.2.57:443 -> 192.168.2.4:61758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.3.57:443 -> 192.168.2.4:61760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.96:443 -> 192.168.2.4:61761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.96:443 -> 192.168.2.4:61762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.96:443 -> 192.168.2.4:61764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:61763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.124.96:443 -> 192.168.2.4:61766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.79.73:443 -> 192.168.2.4:61776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.96:443 -> 192.168.2.4:61777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.30.78:443 -> 192.168.2.4:61782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.96:443 -> 192.168.2.4:61783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.4:61781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.96:443 -> 192.168.2.4:61790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.96:443 -> 192.168.2.4:61796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:61801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.97.114:443 -> 192.168.2.4:61821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.105.89:443 -> 192.168.2.4:61822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.96.114:443 -> 192.168.2.4:61829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.140:443 -> 192.168.2.4:61841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.16.5:443 -> 192.168.2.4:61846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.71.105:443 -> 192.168.2.4:61847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.17.149.140:443 -> 192.168.2.4:61837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.14:443 -> 192.168.2.4:61840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.93.114:443 -> 192.168.2.4:61850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.164.129:443 -> 192.168.2.4:61839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.75.120.157:443 -> 192.168.2.4:61845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.230.208:443 -> 192.168.2.4:61842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.245.46.44:443 -> 192.168.2.4:61844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.22.242.136:443 -> 192.168.2.4:61843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.132:443 -> 192.168.2.4:61848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.110.155:443 -> 192.168.2.4:61852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.132:443 -> 192.168.2.4:61854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.140.62.17:443 -> 192.168.2.4:61855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.206.41.94:443 -> 192.168.2.4:61863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.174.68:443 -> 192.168.2.4:61864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.198.23.205:443 -> 192.168.2.4:61858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.0.227:443 -> 192.168.2.4:61869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.16.5:443 -> 192.168.2.4:61871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.16.5:443 -> 192.168.2.4:61870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.203.49.17:443 -> 192.168.2.4:61857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.14:443 -> 192.168.2.4:61865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.22.242.97:443 -> 192.168.2.4:61868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.0.227:443 -> 192.168.2.4:61875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.96.71.22:443 -> 192.168.2.4:61877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.252.237.254:443 -> 192.168.2.4:61861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.66.102.85:443 -> 192.168.2.4:61876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.140:443 -> 192.168.2.4:61880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.174.68:443 -> 192.168.2.4:61884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.35.0.120:443 -> 192.168.2.4:61879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.146.215:443 -> 192.168.2.4:61885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.146.215:443 -> 192.168.2.4:61886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.229:443 -> 192.168.2.4:61890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.220.103.163:443 -> 192.168.2.4:61891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.132:443 -> 192.168.2.4:61888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.146.215:443 -> 192.168.2.4:61896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.193:443 -> 192.168.2.4:61898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.0.227:443 -> 192.168.2.4:61903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.14:443 -> 192.168.2.4:61901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.229.221.52:443 -> 192.168.2.4:61899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.140.62.17:443 -> 192.168.2.4:61900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.220.103.163:443 -> 192.168.2.4:61906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.54.107:443 -> 192.168.2.4:61904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.22.242.136:443 -> 192.168.2.4:61905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.173.144.139:443 -> 192.168.2.4:61897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.36.181:443 -> 192.168.2.4:61912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.66.102.98:443 -> 192.168.2.4:61909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.205.94:443 -> 192.168.2.4:61910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.194:443 -> 192.168.2.4:61915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.28.144.124:443 -> 192.168.2.4:61916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.87.64.105:443 -> 192.168.2.4:61923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.5.50:443 -> 192.168.2.4:61928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.200.35:443 -> 192.168.2.4:61930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.5.50:443 -> 192.168.2.4:61934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.93.114:443 -> 192.168.2.4:61940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.93.114:443 -> 192.168.2.4:61941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.93.114:443 -> 192.168.2.4:61942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.93.114:443 -> 192.168.2.4:61944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.193:443 -> 192.168.2.4:61956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.134:443 -> 192.168.2.4:61949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.134:443 -> 192.168.2.4:61948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.140.62.27:443 -> 192.168.2.4:61951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.155.153.17:443 -> 192.168.2.4:61957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.173.144.165:443 -> 192.168.2.4:61955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.201.35:443 -> 192.168.2.4:61962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.96.114:443 -> 192.168.2.4:61963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.96.114:443 -> 192.168.2.4:61964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.4.50:443 -> 192.168.2.4:61966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.198:443 -> 192.168.2.4:61967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.96.114:443 -> 192.168.2.4:61975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.134:443 -> 192.168.2.4:61974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.140.62.27:443 -> 192.168.2.4:61977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.66:443 -> 192.168.2.4:61983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.98:443 -> 192.168.2.4:61992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.134:443 -> 192.168.2.4:62007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.134:443 -> 192.168.2.4:62011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.96:443 -> 192.168.2.4:62028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.4:62044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.110.155:443 -> 192.168.2.4:62041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.102:443 -> 192.168.2.4:62039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.110.155:443 -> 192.168.2.4:62043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.110.155:443 -> 192.168.2.4:62042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.96:443 -> 192.168.2.4:62059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.110.155:443 -> 192.168.2.4:62049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.134:443 -> 192.168.2.4:62064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.4:62087 version: TLS 1.2

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:61875 -> 172.66.0.227:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:61869 -> 172.66.0.227:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:61898 -> 104.18.27.193:443

Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 188.114.96.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222

Source: chromecache_214.2.dr	String found in binary or memory: -->`;document.body.appendChild(d);};{\n!function(e,t,n,s,u,a){e.twq\|\|(s=e.twq=function(){s.exe?s.exe.apply(s,arguments):s.queue.push(arguments);\n},s.version='1.1',s.queue=[],u=t.createElement(n),u.async=!0,u.src='https://static.ads-twitter.com/uwt.js',\na=t.getElementsByTagName(n)[0],a.parentNode.insertBefore(u,a))}(window,document,'script');\n// Insert Twitter Advertiser ID\ntwq('config','nvldc', {\n restricted_data_use: 'restrict_optimization' // or 'off'\n});\n};{const d = document.createElement('div');d.innerHTML = ``;document.body.appendChild(d);};{\n(function() {\n var didInit = false;\n function initMunchkin() {\n if(didInit === false) {\n didInit = true;\n Munchkin.init('713-XSC-918');\n }\n }\n var s = document.createElement('script');\n s.type = 'text/javascript';\n s.async = true;\n s.src = '//munchkin.marketo.net/munchkin-beta.js';\n s.onreadystatechange = function() {\n if (this.readyState == 'complete' \|\| this.readyState == 'loaded') {\n initMunchkin();\n }\n };\n s.onload = initMunchkin;\n document.getElementsByTagName('head')[0].appendChild(s);\n})();\n};{const d = document.createElement('div');d.innerHTML = ``;document.body.appendChild(d);};{const el = document.createElement('script');Object.entries(JSON.parse(decodeURIComponent(`%7B%22type%22%3A%22text%2Fjavascript%22%2C%22src%22%3A%22https%3A%2F%2Fcdn.bizible.com%2Fscripts%2Fbizible.js%22%2C%22async%22%3A%22%22%2C%22onload%22%3A%22%7Bdocument.dispatchEvent(new%20Event(%5C%22loaded-5fcb56dd-2d3e-4871-b91b-8719fdda87dd%5C%22))%7D%22%2C%22order-id%22%3A%225fcb56dd-2d3e-4871-b91b-8719fdda87dd%22%7D`))).forEach(([k, v]) => {el.setAttribute(k, v);});document.head.appendChild(el);};{const d = document.createElement('div');d.innerHTML = `<!-- Qualified -->\n\n\n<!-- End Qualified -->`;document.body.appendChild(d);};{\n(function(w,q){w['QualifiedObject']=q;w[q]=w[q]\|\|function(){\n(w[q].q=w[q].q\|\|[]).push(arguments)};})(window,'qualified')\n\n};{const el = document.createElement('script');Object.entries(JSON.parse(decodeURIComponent(`%7B%22async%22%3A%22%22%2C%22src%22%3A%22https%3A%2F%2Fjs.qualified.com%2Fqualified.js%3Ftoken%3D37pXYrro6wCZbsU7%22%2C%22onload%22%3A%22%7Bdocument.dispatchEvent(new%20Event(%5C%22loaded-b6004541-84f1-43ce-9a69-e3d17383b446%5C%22))%7D%22%2C%22order-id%22%3A%22b6004541-84f1-43ce-9a69-e3d17383b446%22%7D`))).forEach(([k, v]) => {el.setAttribute(k, v);});document.head.appendChild(el);}})(window,document)"],"f":[["https://px.ads.linkedin.com/collect/?fmt=js&v=2&url=https%3A%2F%2Fwww.cloudflare.com%2Fwhat-is-cloudflare%2F&time=1741950892398&pid=28851&conversionId=13043044",{"credentials":"include","keepalive":true,"mode":"no-cors"}],["https://alb.reddit.com/rp.gif?event=PageVisit&id=t2_1upmecjq&ts=1741950892398&uuid=6a55be58-5582-40e6-83d3-cec22b5e00ab&integration=reddit&opt_out=0&v=rdt_65e23bc4&sh=1024&sw=1280",{"mode":"no-cors","keepalive":true,"credentials":"include"}]]})})(window,document)}catch(e){throw fetch("/static/
Source: chromecache_214.2.dr	String found in binary or memory: -->`;document.body.appendChild(d);};{\n!function(e,t,n,s,u,a){e.twq\|\|(s=e.twq=function(){s.exe?s.exe.apply(s,arguments):s.queue.push(arguments);\n},s.version='1.1',s.queue=[],u=t.createElement(n),u.async=!0,u.src='https://static.ads-twitter.com/uwt.js',\na=t.getElementsByTagName(n)[0],a.parentNode.insertBefore(u,a))}(window,document,'script');\n// Insert Twitter Advertiser ID\ntwq('config','nvldc', {\n restricted_data_use: 'restrict_optimization' // or 'off'\n});\n};{const d = document.createElement('div');d.innerHTML = ``;document.body.appendChild(d);};{\n(function() {\n var didInit = false;\n function initMunchkin() {\n if(didInit === false) {\n didInit = true;\n Munchkin.init('713-XSC-918');\n }\n }\n var s = document.createElement('script');\n s.type = 'text/javascript';\n s.async = true;\n s.src = '//munchkin.marketo.net/munchkin-beta.js';\n s.onreadystatechange = function() {\n if (this.readyState == 'complete' \|\| this.readyState == 'loaded') {\n initMunchkin();\n }\n };\n s.onload = initMunchkin;\n document.getElementsByTagName('head')[0].appendChild(s);\n})();\n};{const d = document.createElement('div');d.innerHTML = ``;document.body.appendChild(d);};{const el = document.createElement('script');Object.entries(JSON.parse(decodeURIComponent(`%7B%22type%22%3A%22text%2Fjavascript%22%2C%22src%22%3A%22https%3A%2F%2Fcdn.bizible.com%2Fscripts%2Fbizible.js%22%2C%22async%22%3A%22%22%2C%22onload%22%3A%22%7Bdocument.dispatchEvent(new%20Event(%5C%22loaded-5fcb56dd-2d3e-4871-b91b-8719fdda87dd%5C%22))%7D%22%2C%22order-id%22%3A%225fcb56dd-2d3e-4871-b91b-8719fdda87dd%22%7D`))).forEach(([k, v]) => {el.setAttribute(k, v);});document.head.appendChild(el);};{const d = document.createElement('div');d.innerHTML = `<!-- Qualified -->\n\n\n<!-- End Qualified -->`;document.body.appendChild(d);};{\n(function(w,q){w['QualifiedObject']=q;w[q]=w[q]\|\|function(){\n(w[q].q=w[q].q\|\|[]).push(arguments)};})(window,'qualified')\n\n};{const el = document.createElement('script');Object.entries(JSON.parse(decodeURIComponent(`%7B%22async%22%3A%22%22%2C%22src%22%3A%22https%3A%2F%2Fjs.qualified.com%2Fqualified.js%3Ftoken%3D37pXYrro6wCZbsU7%22%2C%22onload%22%3A%22%7Bdocument.dispatchEvent(new%20Event(%5C%22loaded-b6004541-84f1-43ce-9a69-e3d17383b446%5C%22))%7D%22%2C%22order-id%22%3A%22b6004541-84f1-43ce-9a69-e3d17383b446%22%7D`))).forEach(([k, v]) => {el.setAttribute(k, v);});document.head.appendChild(el);}})(window,document)"],"f":[["https://px.ads.linkedin.com/collect/?fmt=js&v=2&url=https%3A%2F%2Fwww.cloudflare.com%2Fwhat-is-cloudflare%2F&time=1741950892398&pid=28851&conversionId=13043044",{"credentials":"include","keepalive":true,"mode":"no-cors"}],["https://alb.reddit.com/rp.gif?event=PageVisit&id=t2_1upmecjq&ts=1741950892398&uuid=6a55be58-5582-40e6-83d3-cec22b5e00ab&integration=reddit&opt_out=0&v=rdt_65e23bc4&sh=1024&sw=1280",{"mode":"no-cors","keepalive":true,"credentials":"include"}]]})})(window,document)}catch(e){throw fetch("/static/
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: ](https://www.youtube.com/watch?v=B4QI0VzbkHk) commercial during Super Bowl 2022. The advertisement resulted in over 150,000 website visits equals www.youtube.com (Youtube)
Source: chromecache_249.2.dr, chromecache_307.2.dr, chromecache_191.2.dr	String found in binary or memory: return f}BG.K="internal.enableAutoEventOnTimer";var bc=wa(["data-gtm-yt-inspected-"]),DG=["www.youtube.com","www.youtube-nocookie.com"],EG,FG=!1; equals www.youtube.com (Youtube)
Source: chromecache_191.2.dr	String found in binary or memory: var QF=function(a,b,c,d,e){var f=MC("fsl",c?"nv.mwt":"mwt",0),g;g=c?MC("fsl","nv.ids",[]):MC("fsl","ids",[]);if(!g.length)return!0;var k=RC(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);Q(121);if(m==="https://www.facebook.com/tr/")return Q(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!zB(k,BB(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: performance.radar.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: sparrow.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cf-assets.www.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: ot.www.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.logr-ingest.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: embed.cloudflarestream.com
Source: global traffic	DNS traffic detected: DNS query: iframe.cloudflarestream.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: tag.demandbase.com
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: alb.reddit.com
Source: global traffic	DNS traffic detected: DNS query: scout-cdn.salesloft.com
Source: global traffic	DNS traffic detected: DNS query: static.ads-twitter.com
Source: global traffic	DNS traffic detected: DNS query: munchkin.marketo.net
Source: global traffic	DNS traffic detected: DNS query: cdn.bizible.com
Source: global traffic	DNS traffic detected: DNS query: js.qualified.com
Source: global traffic	DNS traffic detected: DNS query: customer-eq7kiuol0tk9chox.cloudflarestream.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: adobedc.demdex.net
Source: global traffic	DNS traffic detected: DNS query: cloudflareinc.demdex.net
Source: global traffic	DNS traffic detected: DNS query: r.logr-ingest.com
Source: global traffic	DNS traffic detected: DNS query: di.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: cm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: scout.salesloft.com
Source: global traffic	DNS traffic detected: DNS query: cdn.bizibly.com
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: ws6.qualified.com
Source: global traffic	DNS traffic detected: DNS query: app.qualified.com
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: api.company-target.com
Source: global traffic	DNS traffic detected: DNS query: s.company-target.com
Source: global traffic	DNS traffic detected: DNS query: id.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: dsum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: partners.tremorhub.com
Source: global traffic	DNS traffic detected: DNS query: pixel.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: tag-logger.demandbase.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: 713-xsc-918.mktoresp.com
Source: global traffic	DNS traffic detected: DNS query: platform.dash.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: videodelivery.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: edge.adobedc.net
Source: global traffic	DNS traffic detected: DNS query: adservice.google.com
Source: global traffic	DNS traffic detected: DNS query: api.www.cloudflare.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 14 Mar 2025 11:13:52 GMTContent-Type: text/html; charset=UTF-8Content-Length: 7745Connection: closeaccept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcf-mitigated: challengecritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originserver-timing: chlray;desc="920358207a3242e3"x-content-options: nosniffx-frame-options: SAMEORIGIN
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 14 Mar 2025 11:14:48 GMTContent-Type: text/html; charset=UTF-8Content-Length: 7959Connection: closeaccept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcf-mitigated: challengecritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originserver-timing: chlray;desc="9203597acf9043f3"x-content-options: nosniffx-frame-options: SAMEORIGIN
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-request-id: 691198ab-1561-4e82-a9d6-89240171ddc5vary: Origindate: Fri, 14 Mar 2025 11:14:54 GMTx-konductor: 25.3.4:8abf704d4x-adobe-edge: IRL1;6server: jagcontent-length: 0strict-transport-security: max-age=31536000; includeSubDomainscache-control: no-cache, no-store, max-age=0, no-transform, privatex-xss-protection: 1; mode=blockx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-request-id: c236d881-096b-4ec6-a4bc-7b1e8bdfae1cvary: Origindate: Fri, 14 Mar 2025 11:14:57 GMTx-konductor: 25.3.4:8abf704d4x-adobe-edge: IRL1;6server: jagcontent-length: 0strict-transport-security: max-age=31536000; includeSubDomainscache-control: no-cache, no-store, max-age=0, no-transform, privatex-xss-protection: 1; mode=blockx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-request-id: 49a188d2-740c-43ef-af4e-9cfde1440b48vary: Origindate: Fri, 14 Mar 2025 11:14:58 GMTx-konductor: 25.3.4:8abf704d4x-adobe-edge: IRL1;6server: jagcontent-length: 0strict-transport-security: max-age=31536000; includeSubDomainscache-control: no-cache, no-store, max-age=0, no-transform, privatex-xss-protection: 1; mode=blockx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-request-id: 29e03108-d884-4739-8a4e-dcfc6a58cdffvary: Origindate: Fri, 14 Mar 2025 11:14:59 GMTx-konductor: 25.3.4:8abf704d4x-adobe-edge: IRL1;6server: jagcontent-length: 0strict-transport-security: max-age=31536000; includeSubDomainscache-control: no-cache, no-store, max-age=0, no-transform, privatex-xss-protection: 1; mode=blockx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 14 Mar 2025 11:15:06 GMTContent-Type: application/json; charset=UTF-8Content-Length: 24Connection: closeAccess-Control-Allow-Origin: https://www.cloudflare.comAccess-Control-Allow-Credentials: trueAccess-Control-Allow-Headers: Content-Type,AcceptAccess-Control-Allow-Methods: GET,POST,OPTIONSX-Robots-Tag: noindexReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MVSQhKyLwudo1f%2FBj9pYCNgb9tpy6JVviJxCVYk%2FefQ9Q1ps0tKAFTq3TJt8hHdKKlHllT%2FV2bnAJlijRY6Vwb8AVPQDzMQ9uQmCFuG0%2B2PqKUny2thcIYOnZMrVty3oLnYvCNPvNTU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 920359eb6d980f71-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-request-id: cb7adc8a-a2a2-4c50-8e69-666ca1063f9cvary: Origindate: Fri, 14 Mar 2025 11:15:05 GMTx-konductor: 25.3.4:8abf704d4x-adobe-edge: IRL1;6server: jagcontent-length: 0strict-transport-security: max-age=31536000; includeSubDomainscache-control: no-cache, no-store, max-age=0, no-transform, privatex-xss-protection: 1; mode=blockx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 14 Mar 2025 11:15:06 GMTContent-Type: application/json; charset=UTF-8Content-Length: 24Connection: closeAccess-Control-Allow-Origin: https://www.cloudflare.comAccess-Control-Allow-Credentials: trueAccess-Control-Allow-Headers: Content-Type,AcceptAccess-Control-Allow-Methods: GET,POST,OPTIONSX-Robots-Tag: noindexReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BmhstOEYv0E4TVQcMr1Z47slMkqiJivXlmROGGnAskvqmt2sEAmH7BVsA2ZuhlmwNCSPvN5yCYF8J0izRf22SH%2BspK%2FKzNs627WWw5OTwApIbQG5vHcNRAnD%2Fktce75kRgGmXCNcBlM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 920359ef1d1c4251-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-request-id: c78492be-0b3f-4fd5-a6e1-24973226f39dvary: Origindate: Fri, 14 Mar 2025 11:15:06 GMTx-konductor: 25.3.4:8abf704d4x-adobe-edge: IRL1;6server: jagcontent-length: 0strict-transport-security: max-age=31536000; includeSubDomainscache-control: no-cache, no-store, max-age=0, no-transform, privatex-xss-protection: 1; mode=blockx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-request-id: 7416b85a-3803-4235-b4c8-469855eb45f1vary: Origindate: Fri, 14 Mar 2025 11:15:08 GMTx-konductor: 25.3.4:8abf704d4x-adobe-edge: IRL1;6server: jagcontent-length: 0strict-transport-security: max-age=31536000; includeSubDomainscache-control: no-cache, no-store, max-age=0, no-transform, privatex-xss-protection: 1; mode=blockx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-request-id: a0ea8344-d910-430a-80be-8008a048aebevary: Origindate: Fri, 14 Mar 2025 11:15:08 GMTx-konductor: 25.3.4:8abf704d4x-adobe-edge: IRL1;6server: jagcontent-length: 0strict-transport-security: max-age=31536000; includeSubDomainscache-control: no-cache, no-store, max-age=0, no-transform, privatex-xss-protection: 1; mode=blockx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-request-id: cdb918ba-70b9-43be-be44-18fc6fdfaa2fvary: Origindate: Fri, 14 Mar 2025 11:15:09 GMTx-konductor: 25.3.4:8abf704d4x-adobe-edge: IRL1;6server: jagcontent-length: 0strict-transport-security: max-age=31536000; includeSubDomainscache-control: no-cache, no-store, max-age=0, no-transform, privatex-xss-protection: 1; mode=blockx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 14 Mar 2025 11:13:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Expires: Thu, 01 Jan 1970 00:00:01 GMTVary: Accept-EncodingServer: cloudflareCF-RAY: 9203581c5a05de92-EWRContent-Encoding: gzipData Raw: 38 33 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c5 58 5b 6f 1b 37 16 7e d7 af 38 e1 02 5a 09 10 35 1a 59 76 1c 69 a4 a2 eb b8 88 77 d3 c6 68 1c b4 41 51 18 9c e1 19 89 31 87 9c 92 94 64 c1 eb ff be e0 5c e4 d1 c5 6e 82 dd 45 f5 a0 e1 f5 f0 5c be 73 21 a3 57 6f 3f 5c dc 7c be be 84 85 cb e4 ac 15 bd a2 f4 37 91 82 74 70 75 09 af 7f 9f 41 e4 27 20 91 cc da 29 51 9a 7e b1 20 f0 0c b4 e4 02 09 48 a6 e6 53 82 8a 7e fa 48 66 10 bd fa 0d 15 17 e9 ef 94 3e 91 aa e8 00 1c 27 f5 fa db 48 9d bf 40 ea fc 1b 48 cd 5d 45 cd 0f 1c 93 f2 90 0a a5 bb 94 16 c8 f8 ac 15 39 e1 24 ce de 0a 83 89 83 ab 6b 60 49 82 d6 82 d2 0e 98 94 7a 8d 1c fe 0d 17 52 2f 79 2a 99 c1 28 28 37 b4 a2 0c 1d 83 64 c1 8c 45 37 25 9f 6e 7e a0 e7 04 82 7a 62 e1 5c 4e f1 8f a5 58 4d c9 85 56 0e 95 a3 37 9b 1c 09 24 65 6f 4a 1c de bb c0 33 3e d9 92 79 89 ca af f4 d3 f7 f4 42 67 39 73 22 96 4d 42 57 97 d3 4b 3e c7 c6 3e c5 32 9c 12 a3 63 ed 6c 63 a1 d2 42 71 bc ef 81 d2 a9 f6 c2 1d 6c 59 09 5c e7 da b8 c6 a6 b5 e0 6e 31 e5 b8 12 09 d2 a2 d3 13 4a 38 c1 24 b5 09 93 38 0d 4b 2a 52 a8 3b 30 28 a7 c4 ba 8d 44 bb 40 74 04 04 9f 92 24 bd 2d 87 68 62 2d 81 85 c1 74 4a 82 84 2b 9a cc 45 50 4e 05 19 13 aa 5f cc 07 b3 56 ab 15 d9 c4 88 dc cd 5a 9d 74 a9 12 27 b4 ea 74 1f 44 da e1 3a 59 66 a8 5c 9f 71 7e b9 42 e5 de 0b eb 50 a1 69 b7 d7 42 71 bd ee ff fa e3 fb 77 ce e5 3f e3 1f 4b b4 ae dd fe e7 c7 0f 3f 95 ff 7d eb 8c 50 73 91 6e ba 0f 2b 66 00 a7 5b da ac 1c 49 a6 5b fa 73 74 97 12 7d f3 1f 9b 2b de 21 68 8c 36 34 45 e4 31 4b ee a8 5d 9a 15 6e 48 b7 c7 bf 61 4b 01 2d d2 ed c5 53 85 6b d8 65 74 c2 a6 0f e8 05 1a 93 7a 07 24 52 24 77 c8 49 2f 37 3a 47 e3 04 da f1 43 41 f5 42 73 1c 87 83 c1 49 6f 81 32 4f 97 72 cc 7a 2b 34 56 68 35 0e 1f 1f 27 71 5f e7 a8 3a e4 fa c3 c7 1b d2 23 1e 47 76 1c 04 36 67 c6 e8 75 3f d9 e2 b9 9f e8 2c 60 b9 08 56 61 50 1c 4f ba 93 b8 6f d1 55 6c bd 43 c6 d1 74 76 31 dc 23 2c cf a5 48 98 d7 5d f0 c5 6a f5 cc ae 8f e5 79 f4 a3 5e 9a 04 e9 bf 70 43 7a 24 79 fd 3a 4c 07 38 8a 4f 47 6f 46 a3 18 e3 74 34 3c 0b f9 68 14 f3 d7 6f 58 88 a4 3b 69 79 62 8a 77 76 ad d6 61 dd ee 24 e9 17 6e ee cd ee 31 d0 d9 6a 8b 2e 04 e7 e8 39 e1 8d 25 06 33 bd c2 23 ab 1e 27 cf 42 a9 43 de 7e f8 b1 12 f8 bd 66 dc 5b a0 81 42 0f 14 f6 b5 56 27 dd de 0b a0 da 72 15 2f 9d d3 8a 6e d0 be 0c a9 fd 0d 4a 93 ee 84 6c c5 25 42 01 6b b7 3b ec 6b 34 d0 4b 8e 48 5e 40 6e 47 5c ec bc 1a 74 1f bb 3d fe b5 Data Ascii: 834X[o7~8Z5YviwhAQ1d\nE\s!Wo?\\|7tpuA' )Q~ HS~Hf>'H
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 14 Mar 2025 11:13:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Expires: Thu, 01 Jan 1970 00:00:01 GMTVary: Accept-EncodingServer: cloudflareCF-RAY: 920358217f26efa5-EWRContent-Encoding: gzipData Raw: 38 33 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c5 58 e9 6f 1b 37 16 ff ae bf e2 85 0b 68 25 40 d4 68 64 f9 88 34 52 d1 75 5c c4 bb 69 63 34 0e da a0 28 0c ce f0 8d c4 98 43 4e 49 4a b2 90 f5 ff be e0 1c f2 e8 b0 9b 60 77 51 7d d0 f0 7c 7c c7 ef 1d 64 f4 ea cd fb cb db 4f 37 57 b0 70 99 9c b5 a2 57 94 fe 26 52 90 0e ae af e0 fc f7 19 44 7e 02 12 c9 ac 9d 12 a5 e9 67 0b 02 cf 40 4b 2e 90 80 64 6a 3e 25 a8 e8 c7 0f 64 06 d1 ab df 50 71 91 fe 4e e9 13 a9 8a 0e c0 71 52 e7 df 46 ea e2 05 52 17 df 40 6a ee 2a 6a 7e e0 98 94 87 54 28 dd a5 b4 40 c6 67 ad c8 09 27 71 f6 46 18 4c 1c 5c df 00 4b 12 b4 16 94 76 c0 a4 d4 6b e4 f0 6f b8 94 7a c9 53 c9 0c 46 41 b9 a1 15 65 e8 18 24 0b 66 2c ba 29 f9 78 fb 03 bd 20 10 d4 13 0b e7 72 8a 7f 2c c5 6a 4a 2e b5 72 a8 1c bd dd e4 48 20 29 7b 53 e2 f0 c1 05 9e f1 c9 96 cc 4b 54 7e a5 1f bf a7 97 3a cb 99 13 b1 6c 12 ba be 9a 5e f1 39 36 f6 29 96 e1 94 18 1d 6b 67 1b 0b 95 16 8a e3 43 0f 94 4e b5 17 ee 60 cb 4a e0 3a d7 c6 35 36 ad 05 77 8b 29 c7 95 48 90 16 9d 9e 50 c2 09 26 a9 4d 98 c4 69 58 52 91 42 dd 83 41 39 25 d6 6d 24 da 05 a2 23 20 f8 94 24 e9 5d 39 44 13 6b 09 2c 0c a6 53 12 24 5c d1 64 2e 82 72 2a c8 98 50 fd 62 3e 98 b5 5a ad c8 26 46 e4 6e d6 ea a4 4b 95 38 a1 55 a7 fb 45 a4 1d ae 93 65 86 ca f5 19 e7 57 2b 54 ee 9d b0 0e 15 9a 76 7b 2d 14 d7 eb fe af 3f be 7b eb 5c fe 33 fe b1 44 eb da ed 7f 7e 78 ff 53 f9 df b7 ce 08 35 17 e9 a6 fb 65 c5 0c e0 74 4b 9b 95 23 c9 74 4b 7f 8e ee 4a a2 6f fe 63 73 cd 3b 04 8d d1 86 a6 88 3c 66 c9 3d b5 4b b3 c2 0d e9 f6 f8 37 6c 29 a0 45 ba bd 78 aa 70 0d bb 8c 4e d8 f4 0b 7a 81 c6 a4 de 01 89 14 c9 3d 72 d2 cb 8d ce d1 38 81 76 fc a5 a0 7a a9 39 8e c3 c1 e0 a4 b7 40 99 a7 4b 39 66 bd 15 1a 2b b4 1a 87 8f 8f 93 b8 af 73 54 1d 72 f3 fe c3 2d e9 11 8f 23 3b 0e 02 9b 33 63 f4 ba 9f 6c f1 dc 4f 74 16 b0 5c 04 ab 30 28 8e 27 dd 49 dc b7 e8 2a b6 de 22 e3 68 3a bb 18 ee 11 96 e7 52 24 cc eb 2e f8 6c b5 7a 66 d7 87 f2 3c fa 41 2f 4d 82 f4 5f b8 21 3d 92 9c 9f 87 e9 00 47 f1 e9 e8 f5 68 14 63 9c 8e 86 67 21 1f 8d 62 7e fe 9a 85 48 ba 93 96 27 a6 78 67 d7 6a 1d d6 ed 4e 92 7e e1 e6 de ec 1e 03 9d ad b6 e8 42 70 8e 9e 13 de 58 62 30 d3 2b 3c b2 ea 71 f2 2c 94 3a e4 cd fb 1f 2b 81 df 69 c6 bd 05 1a 28 f4 40 61 5f 6b 75 d2 ed bd 00 aa 2d 57 f1 d2 39 ad e8 06 ed cb 90 da df a0 34 e9 4e c8 56 5c 22 14 b0 76 bb c3 be 46 03 bd e4 88 e4 05 e4 76 c4 c5 ce ab 41 f7 b1 db e3 5f bb Data Ascii: 834Xo7h%@hd4Ru\ic4(CNIJ`wQ}\|\|dO7WpW&RD~g@K.dj>%dPqNqRF

Source: chromecache_142.2.dr, chromecache_282.2.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: chromecache_191.2.dr	String found in binary or memory: https://ad.doubleclick.net
Source: chromecache_249.2.dr, chromecache_191.2.dr	String found in binary or memory: https://ade.googlesyndication.com
Source: chromecache_191.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_214.2.dr	String found in binary or memory: https://alb.reddit.com/rp.gif?event=PageVisit&id=t2_1upmecjq&ts=1741950892398&uuid=6a55be58-5582-40e
Source: chromecache_195.2.dr, chromecache_308.2.dr	String found in binary or memory: https://api.www.cloudflare.com/api/v1
Source: chromecache_239.2.dr	String found in binary or memory: https://app.qualified.com
Source: chromecache_185.2.dr	String found in binary or memory: https://assets.adobedtm.com/extensions/EPc7341b33570d4c988798fc9f0093d4b2/AppMeasurement.js
Source: chromecache_250.2.dr	String found in binary or memory: https://assets.adobedtm.com/extensions/EPc7341b33570d4c988798fc9f0093d4b2/AppMeasurement_Module_Acti
Source: chromecache_153.2.dr	String found in binary or memory: https://assets.adobedtm.com/f597f8065f97/065ba81630d7/6d3ddf5fffa8/RC392ad6d4bbf94c7283b4eda6cbf689a
Source: chromecache_268.2.dr	String found in binary or memory: https://assets.adobedtm.com/f597f8065f97/065ba81630d7/6d3ddf5fffa8/RC55904e5e1abc4d38a5f1ac3dea0edaa
Source: chromecache_299.2.dr	String found in binary or memory: https://assets.adobedtm.com/f597f8065f97/065ba81630d7/launch-efab6d095ce0.js
Source: chromecache_249.2.dr, chromecache_307.2.dr, chromecache_191.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_202.2.dr, chromecache_204.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/0NY0QZdcIB62VMnG5JGH0/c3ed0daeb44e594adfd2ae259728
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/1R97toQVK94Lb8pvLQurcz/853a3d8281604a4cb48dc8095c4
Source: chromecache_217.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/1qyDEBnfSjGjDAj5V6Zo1g/f8c8126789bc16fa0329943b0d4
Source: chromecache_217.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/1rVmRBDX3KhZOe2FREoYOz/24f44a8dbe53111346d97dc59b7
Source: chromecache_202.2.dr, chromecache_204.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/201dX43zvXI17sQ3nI6OXz/29703f9fd2b3970392bf03c9429
Source: chromecache_217.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/2iaZGHR7NSRdBzpq8wiboE/de2d9d0f908ec37deea865b055a
Source: chromecache_202.2.dr, chromecache_204.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/30BqoxmJzq5iWu5Bb3Mbir/9206f60e10de0620653d76087fa
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/315wvQPkU3AcEnauttHpg7/ecda8d1d7314284ea83bae49699
Source: chromecache_217.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/35yeieyQns5B8WsFes9Z20/8bf36cbf9edf546c30cc9e3e082
Source: chromecache_217.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/3KPlWZN5s1sQQeavuAaMa4/cb02c2544821d099f24ee3270c3
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/3XLbCG57F12IbPP7UjpEav/7879ce7cadbb3fdf6664bf5a9f6
Source: chromecache_217.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/3jxszSMXRhwiwHDa1VPXFw/cc6439cd93a107bd0986bb6d5dc
Source: chromecache_217.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/3mYUDEjNlXbjQaceoFUhzU/378a4b79f7b51e7677fd6ab442e
Source: chromecache_202.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/3nTpfNMTgcdaABUbQ549ba/37f19f67202ee8a2d13087ae31c
Source: chromecache_149.2.dr, chromecache_152.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/42XkFj9Uywkm8Jahf62RtP/0563d91cc1fa54da2bf2c50bad8
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/4OOdISR8NhkOxU6s9Npcpf/8b5a52b17a04b3b9c3557f18b27
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/4ejaIgcWXX2kmkizJqbiUA/bcb1d6b9c4a93c5b25e3d0bac04
Source: chromecache_149.2.dr, chromecache_152.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/4sfL2iS6H10uq2waT6ehym/ad18b77fa469ce07f23d22e19ab
Source: chromecache_202.2.dr, chromecache_204.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/5V0mrvP2VBMtDDdjsBJJ7j/74022aa20c43d043b1378514d44
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/5qOkL7b52oII5tM50rXHvx/244e247fb24d4b337481750c11a
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/65Ipvsgw8nmGrS6S6DSMHw/6a79d44905be3517814e9e98a04
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/6bWnO822472EL2RMh16Lud/fec3ede9490277f6e9ce3135136
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/6dDSPSSsnB7C5aL2KHgZG7/7c548df6cd07a691d6b9042e2ee
Source: chromecache_300.2.dr, chromecache_150.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/6i8d186tH2iueYvgwVRaJf/ab27fd31033bdd31aea69065480
Source: chromecache_217.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/6wvLylL1UDvEfh7N5WBd32/b05450aa05d6c40af93bf04309e
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/7Mk2SxHLuetVVbIvaFsice/ab6902812d8e3e6499115005e4e
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/ILLvFjlVSKYB4Gp5utCeb/32fd2f9b0547d7c2b534d0d8cad1
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/JCr4eAfWxykD0y9hxczbi/078d166ea10543a33050ad8e5ed0
Source: chromecache_202.2.dr, chromecache_204.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/Til1jVHCvDVprSIJemrh1/8113304640f5500d43c1e01ba687
Source: chromecache_300.2.dr, chromecache_150.2.dr	String found in binary or memory: https://cf-assets.www.cloudflare.com/slt3lc6tev37/mJZqOomHta2MLLB73P8Hs/9378861761815b3adf7bcb7734d6
Source: chromecache_224.2.dr	String found in binary or memory: https://customer-eq7kiuol0tk9chox.cloudflarestream.com/embed/sdk-iframe-integration.fla9.latest.js?v
Source: chromecache_202.2.dr, chromecache_204.2.dr	String found in binary or memory: https://dash.cloudflare.com/sign-up
Source: chromecache_280.2.dr, chromecache_204.2.dr	String found in binary or memory: https://dash.cloudflare.com/sign-up/teams
Source: chromecache_280.2.dr, chromecache_204.2.dr	String found in binary or memory: https://dash.cloudflare.com/sign-up/workers
Source: chromecache_155.2.dr, chromecache_231.2.dr	String found in binary or memory: https://developers.marketo.com/MunchkinLicense.pdf
Source: chromecache_183.2.dr	String found in binary or memory: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1757848494&external_user_id=80651cb
Source: chromecache_202.2.dr	String found in binary or memory: https://github.com/jonsuh/hamburgers
Source: chromecache_293.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_191.2.dr	String found in binary or memory: https://google.com
Source: chromecache_191.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_224.2.dr	String found in binary or memory: https://iframe.cloudflarestream.com/oembed?url=https%3A%2F%2Fiframe.cloudflarestream.com%2Ff9b4aa59b
Source: chromecache_202.2.dr	String found in binary or memory: https://jonsuh.com/hamburgers
Source: chromecache_239.2.dr	String found in binary or memory: https://js.qualified.com
Source: chromecache_271.2.dr	String found in binary or memory: https://larsenwork.com/easing-gradients/#editor
Source: chromecache_271.2.dr	String found in binary or memory: https://medium.com/
Source: chromecache_191.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_249.2.dr, chromecache_307.2.dr, chromecache_191.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_183.2.dr	String found in binary or memory: https://partners.tremorhub.com/sync?UIDM=80651cbc-1a8f-4d5d-b588-3e2664832442
Source: chromecache_183.2.dr	String found in binary or memory: https://pixel.rubiconproject.com/tap.php?nid=5578&put=80651cbc-1a8f-4d5d-b588-3e2664832442&v
Source: chromecache_214.2.dr	String found in binary or memory: https://px.ads.linkedin.com/collect/?fmt=js&v=2&url=https%3A%2F%2Fwww.cloudflare.com%2Fwhat-is-cloud
Source: chromecache_214.2.dr	String found in binary or memory: https://px.ads.linkedin.com/collect/?pid=28851&fmt=gif
Source: chromecache_239.2.dr	String found in binary or memory: https://schedule.qualified.com
Source: chromecache_214.2.dr	String found in binary or memory: https://scout-cdn.salesloft.com/sl.js
Source: chromecache_255.2.dr, chromecache_160.2.dr	String found in binary or memory: https://scout.us4.salesloft.com
Source: chromecache_197.2.dr	String found in binary or memory: https://shadows.brumm.af/
Source: chromecache_214.2.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: chromecache_271.2.dr	String found in binary or memory: https://stackoverflow.com/questions/3683211/ipad-safari-mobile-seems-to-ignore-z-indexing-position-f
Source: chromecache_175.2.dr	String found in binary or memory: https://staging.mrk.cfdata.org/mrk/redwood-blade-repository/
Source: chromecache_214.2.dr	String found in binary or memory: https://static.ads-twitter.com/uwt.js
Source: chromecache_307.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_307.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_214.2.dr	String found in binary or memory: https://tag.demandbase.com/1be41a80498a5b73.min.js
Source: chromecache_249.2.dr, chromecache_307.2.dr, chromecache_191.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_197.2.dr	String found in binary or memory: https://tobiasahlin.com/blog/layered-smooth-box-shadows/
Source: chromecache_224.2.dr	String found in binary or memory: https://videodelivery.net/f9b4aa59b4a2fc5799f1232241000056/thumbnails/thumbnail.jpg?time=4s&height=7
Source: chromecache_195.2.dr, chromecache_308.2.dr	String found in binary or memory: https://www.cloudflare.com
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.cloudflare.com/application-services/)
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.cloudflare.com/application-services/solutions/)
Source: chromecache_202.2.dr	String found in binary or memory: https://www.cloudflare.com/connectivity-cloud/
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.cloudflare.com/ecommerce/).
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.cloudflare.com/learning/security/what-is-an-attack-surface/)
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.cloudflare.com/lp/forrester-tei-study-2024/
Source: chromecache_239.2.dr	String found in binary or memory: https://www.cloudflare.com/lp/multi-channel-phishing-demo?utm_medium=banner
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.cloudflare.com/lp/redefining-browser-isolation-security/
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.cloudflare.com/lp/say-goodbye-to-egress-fees/
Source: chromecache_280.2.dr, chromecache_178.2.dr, chromecache_312.2.dr, chromecache_204.2.dr	String found in binary or memory: https://www.cloudflare.com/network-services/solutions/enterprise-network-security/)
Source: chromecache_280.2.dr, chromecache_204.2.dr	String found in binary or memory: https://www.cloudflare.com/network/
Source: chromecache_280.2.dr, chromecache_204.2.dr	String found in binary or memory: https://www.cloudflare.com/plans/)
Source: chromecache_280.2.dr, chromecache_204.2.dr	String found in binary or memory: https://www.cloudflare.com/plans/enterprise/
Source: chromecache_280.2.dr, chromecache_204.2.dr	String found in binary or memory: https://www.cloudflare.com/plans/enterprise/contact/
Source: chromecache_280.2.dr, chromecache_204.2.dr	String found in binary or memory: https://www.cloudflare.com/privacy-and-compliance/
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.cloudflare.com/products/cloudflare-stream/)
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.cloudflare.com/products/zero-trust/threat-defense/)
Source: chromecache_260.2.dr, chromecache_184.2.dr	String found in binary or memory: https://www.cloudflare.com/saas/)
Source: chromecache_280.2.dr, chromecache_204.2.dr	String found in binary or memory: https://www.cloudflare.com/security/
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.forbes.com/sites/russellflannery/2021/11/13/ev-share-of-china-passenger-car-market-more-
Source: chromecache_191.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_249.2.dr, chromecache_191.2.dr	String found in binary or memory: https://www.google.com/gmp/conversion;
Source: chromecache_191.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_191.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_249.2.dr, chromecache_307.2.dr, chromecache_191.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_249.2.dr, chromecache_191.2.dr	String found in binary or memory: https://www.googletagmanager.com/dclk/ns/v1.js
Source: chromecache_249.2.dr, chromecache_307.2.dr, chromecache_191.2.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_307.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_178.2.dr, chromecache_312.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=B4QI0VzbkHk)

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,6173184686010921257,3047257492745393520,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2112 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://188.114.96.3"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2040,i,6173184686010921257,3047257492745393520,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6740 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,6173184686010921257,3047257492745393520,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2112 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2040,i,6173184686010921257,3047257492745393520,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6740 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://customer-eq7kiuol0tk9chox.cloudflarestream.com/f9b4aa59b4a2fc5799f1232241000056/manifest/video.mpd?parentOrigin=https%3A%2F%2Fwww.cloudflare.com	0%	Avira URL Cloud	safe
https://customer-eq7kiuol0tk9chox.cloudflarestream.com/embed/sdk-iframe-integration.fla9.latest.js?video=f9b4aa59b4a2fc5799f1232241000056	0%	Avira URL Cloud	safe
https://customer-eq7kiuol0tk9chox.cloudflarestream.com/f9b4aa59b4a2fc5799f1232241000056/video/360/seg_1.mp4?p=eyJ0eXBlIjoic2VnbWVudCIsInZpZGVvSUQiOiJmOWI0YWE1OWI0YTJmYzU3OTlmMTIzMjI0MTAwMDA1NiIsIm93bmVySUQiOjM3ODczOTcsImNyZWF0b3JJRCI6IiIsInNlZ21lbnREdXJhdGlvblNlY3MiOjQsInVzZVZPRE9URkUiOmZhbHNlLCJmcm9tTWV6emFuaW5lIjpmYWxzZSwic3RvcmFnZVByb3ZpZGVyIjoyLCJ0cmFjayI6IjA2NWFiOGU5MjFmZjEyMTAwY2MxYzU5YTBhOTY1ZGVkIiwicmVuZGl0aW9uIjoiMTM2ODUyOTEzIiwibXV4aW5nIjoiMTg3MzkwNjU0In0&s=w7wPexjCmFoOX8OMw6E1w5LDsyTCvEPDsjXDm8O9Qgk7w61nwqsJw4XDqMOUeic	0%	Avira URL Cloud	safe
https://customer-eq7kiuol0tk9chox.cloudflarestream.com/f9b4aa59b4a2fc5799f1232241000056/lifecycle	0%	Avira URL Cloud	safe
https://tobiasahlin.com/blog/layered-smooth-box-shadows/	0%	Avira URL Cloud	safe
https://customer-eq7kiuol0tk9chox.cloudflarestream.com/f9b4aa59b4a2fc5799f1232241000056/audio/131/seg_1.mp4?p=eyJ0eXBlIjoic2VnbWVudCIsInZpZGVvSUQiOiJmOWI0YWE1OWI0YTJmYzU3OTlmMTIzMjI0MTAwMDA1NiIsIm93bmVySUQiOjM3ODczOTcsImNyZWF0b3JJRCI6IiIsInNlZ21lbnREdXJhdGlvblNlY3MiOjQuMDEwNjY2NjY2NjY2NjY2LCJ1c2VWT0RPVEZFIjpmYWxzZSwiZnJvbU1lenphbmluZSI6ZmFsc2UsInN0b3JhZ2VQcm92aWRlciI6MiwidHJhY2siOiJiNWJkNGRlOTNlZGVmYjYzM2YyOTZiNTM4MDEyNzVlOSIsInJlbmRpdGlvbiI6IjEzNjg1Mjg5NyIsIm11eGluZyI6IjE4NzM5MDYzOCJ9&s=w4MUwrXDq2rCvsKscMOnw4hTwrxywqdvwrHCvzXDrXQ6w5PDncKDAMKWCxzDn0PDnMO2	0%	Avira URL Cloud	safe
https://customer-eq7kiuol0tk9chox.cloudflarestream.com/f9b4aa59b4a2fc5799f1232241000056/thumbnails/thumbnail.jpg?time=0.000s&duration=12.450s&height=108&imageCount=60	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
prod-default.lb.logrocket.network	104.198.23.205	true	false	high
s.dsp-prod.demandbase.com	34.96.71.22	true	false	high
e10776.b.akamaiedge.net	104.73.230.208	true	false	high
scout.us1.salesloft.com	52.206.41.94	true	false	high
platform.twitter.map.fastly.net	146.75.120.157	true	false	high
stats.g.doubleclick.net	142.250.110.155	true	false	high
ot.www.cloudflare.com	104.16.123.96	true	false	high
l-0005.l-msedge.net	13.107.42.14	true	false	high
t.co	172.66.0.227	true	false	high
performance.radar.cloudflare.com	104.18.31.78	true	false	high
www.google.com	142.250.185.68	true	false	high
partners-1864332697.us-east-1.elb.amazonaws.com	3.229.221.52	true	false	high
cf-assets.www.cloudflare.com	104.16.123.96	true	false	high
id.rlcdn.com	35.244.174.68	true	false	high
a798.dscd.akamai.net	2.22.242.136	true	false	high
platform.dash.cloudflare.com	104.18.5.50	true	false	high
s.twitter.com	172.66.0.227	true	false	high
videodelivery.net	104.16.200.35	true	false	high
cm.everesttech.net.akadns.net	34.252.237.254	true	false	high
analytics-alv.google.com	216.239.36.181	true	false	high
di.rlcdn.com	35.244.174.68	true	false	high
www.linkedin.com.cdn.cloudflare.net	172.64.146.215	true	false	high
cdn.logr-ingest.com	104.21.96.1	true	false	high
reddit.map.fastly.net	151.101.65.140	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
embed.cloudflarestream.com	104.16.97.114	true	false	high
td.doubleclick.net	142.250.185.194	true	false	high
a1916.dscg2.akamai.net	2.16.164.129	true	false	high
static.cloudflareinsights.com	104.16.79.73	true	false	high
pixel.rubiconproject.net.akadns.net	69.173.144.139	true	false	high
iframe.cloudflarestream.com	104.16.96.114	true	false	high
scout-cdn.salesloft.com.cdn.cloudflare.net	104.16.71.105	true	false	high
customer-eq7kiuol0tk9chox.cloudflarestream.com	104.16.93.114	true	false	high
adservice.google.com	142.250.185.66	true	false	high
sparrow.cloudflare.com	104.18.2.57	true	false	high
tag.demandbase.com	18.245.46.44	true	false	high
demdex.net.ssl.sc.omtrdc.net	63.140.62.17	true	false	high
api.www.cloudflare.com	104.16.123.96	true	false	high
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	52.17.149.140	true	false	high
tag-logger.demandbase.com	18.173.205.94	true	false	high

Name	Malicious	Antivirus Detection	Reputation
https://cm.everesttech.net/cm/dd?d_uuid=38436504959240961594461150054014680665	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/2iaZGHR7NSRdBzpq8wiboE/de2d9d0f908ec37deea865b055af42df/cloudflare-spectrum.png	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/6XVeELky7fceWRpfBvN8qr/4e13aa3d8dd73e1f091f3de966fdc9cb/logo_shopify_trusted-by_gray.svg	false		high
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015	false		high
https://cloudflareinc.demdex.net/dest5.html?d_nsid=0	false		high
https://sparrow.cloudflare.com/api/v1/event	false		high
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ffmt%3Djs%26v%3D2%26url%3Dhttps%253A%252F%252Fwww.cloudflare.com%252Fwhat-is-cloudflare%252F%26time%3D1741950892398%26pid%3D28851%26conversionId%3D13043044%26cookiesTest%3Dtrue%26liSync%3Dtrue	false		high
https://www.cloudflare.com/static/z/i.js	false		high
https://www.cloudflare.com/page-data/under-attack-hotline/page-data.json	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/2TfcZ86qvZor2xtI2z4Vvr/ef54112582296119f4296869c34ba025/logo_23andme_color_32px-wrapper.svg	false		high
https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=WfSqJjlqzfbUIjLwuE8xf8Yc_r71dR_G4zgunpq4MGPnAN-0WouzCw==&api-version=v3	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/920359e91b8e4366/1741950908607/Olldw9hfkMNTaTQ	false		high
https://www.cloudflare.com/page-data/plans/page-data.json	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/OMwO1Fr8BxHVum0iBbatc/979c1807f5810edc903d4b07c18e0cb0/logo_ibm_trusted-by_gray.svg	false		high
https://scout.salesloft.com/i	false		high
https://ws6.qualified.com/cable?wv=9&token=37pXYrro6wCZbsU7&vu=38641f60-7350-4a6b-983c-a3f997023c6a&wu=5a1d9191-33ab-4954-8755-73d35faddfba&ca=2025-03-14T11%3A14%3A52.769Z&tz=America%2FNew_York&bis=5&referrer=https%3A%2F%2Fwww.cloudflare.com%2F5xx-error-landing%2F&pv=1&fv=2025-03-14-6fd1b7ecaa&iml=false&bl=en-US&ic=true	false		high
https://customer-eq7kiuol0tk9chox.cloudflarestream.com/embed/sdk-iframe-integration.fla9.latest.js?video=f9b4aa59b4a2fc5799f1232241000056	false	Avira URL Cloud: safe	unknown
https://cf-assets.www.cloudflare.com/slt3lc6tev37/3nTpfNMTgcdaABUbQ549ba/37f19f67202ee8a2d13087ae31c46dba/what-makes-cloudflare-different-diagram.svg	false		high
https://embed.cloudflarestream.com/embed/sdk.latest.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/124355148:1741947339:uNb_IaKWfrC94H6e3GlRF2Gxnm3rz72cRNOJpNLvPXU/920359e91b8e4366/HVzY9U2WqmEOit.AIXr_81f_xIuYtY8JNNYiz5l001o-1741950905-1.1.1.1-k3ZkhS54V5PGJUf6sKxh9iZAxdlECVbA8XB.jqAQqNDJ07fLnyQqV9oYj0BLYF5D	false		high
https://customer-eq7kiuol0tk9chox.cloudflarestream.com/f9b4aa59b4a2fc5799f1232241000056/audio/131/seg_1.mp4?p=eyJ0eXBlIjoic2VnbWVudCIsInZpZGVvSUQiOiJmOWI0YWE1OWI0YTJmYzU3OTlmMTIzMjI0MTAwMDA1NiIsIm93bmVySUQiOjM3ODczOTcsImNyZWF0b3JJRCI6IiIsInNlZ21lbnREdXJhdGlvblNlY3MiOjQuMDEwNjY2NjY2NjY2NjY2LCJ1c2VWT0RPVEZFIjpmYWxzZSwiZnJvbU1lenphbmluZSI6ZmFsc2UsInN0b3JhZ2VQcm92aWRlciI6MiwidHJhY2siOiJiNWJkNGRlOTNlZGVmYjYzM2YyOTZiNTM4MDEyNzVlOSIsInJlbmRpdGlvbiI6IjEzNjg1Mjg5NyIsIm11eGluZyI6IjE4NzM5MDYzOCJ9&s=w4MUwrXDq2rCvsKscMOnw4hTwrxywqdvwrHCvzXDrXQ6w5PDncKDAMKWCxzDn0PDnMO2	false	Avira URL Cloud: safe	unknown
https://api.www.cloudflare.com/api/v1/marketo/form/1639	false		high
https://www.cloudflare.com/page-data/connectivity-cloud/page-data.json	false		high
https://challenges.cloudflare.com/turnstile/v0/b/c8ec7565fab7/api.js	false		high
https://assets.adobedtm.com/extensions/EPc7341b33570d4c988798fc9f0093d4b2/AppMeasurement.min.js	false		high
https://scout-cdn.salesloft.com/sl.js	false		high
https://cdn.bizible.com/ipv?_biz_r=https%3A%2F%2Fwww.cloudflare.com%2F5xx-error-landing%2F&_biz_h=-1777624096&_biz_u=bc8d5ce9d44a4dde846655d20e7148b5&_biz_l=https%3A%2F%2Fwww.cloudflare.com%2Fwhat-is-cloudflare%2F&_biz_t=1741950892708&_biz_i=Why%20Cloudflare%3F%20%7C%20Cloudflare&_biz_n=0&rnd=407821&cdn_o=a&_biz_z=1741950892709	false		high
https://www.cloudflare.com/5xx-error-landing/	false		high
https://www.cloudflare.com/page-data/what-is-cloudflare/page-data.json	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/Hrl9MJuJGcsYRLaNNcCpS/3ca96c403b9a0195da1a8502d79ef76c/performance-cloud-speed.svg	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/vypb1/0x4AAAAAAAaFLwutFA_ZjmEX/light/fbE/new/normal/auto/	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/5YRPa33UFrfL2zoZd2AXTq/658995f16c7ee4818875c254c18573d3/logo_zendesk_gray_32px-wrapper.svg	false		high
https://iframe.cloudflarestream.com/f9b4aa59b4a2fc5799f1232241000056?poster=https%3A%2F%2Fvideodelivery.net%2Ff9b4aa59b4a2fc5799f1232241000056%2Fthumbnails%2Fthumbnail.jpg%3Ftime%3D4s%26height%3D720&defaultTextTrack=en&letterboxColor=transparent&preload=metadata	false		high
https://px.ads.linkedin.com/collect/?fmt=js&v=2&url=https%3A%2F%2Fwww.cloudflare.com%2Fwhat-is-cloudflare%2F&time=1741950893034&pid=28851&conversionId=10249833&cookiesTest=true&liSync=true	false		high
https://customer-eq7kiuol0tk9chox.cloudflarestream.com/f9b4aa59b4a2fc5799f1232241000056/video/360/seg_1.mp4?p=eyJ0eXBlIjoic2VnbWVudCIsInZpZGVvSUQiOiJmOWI0YWE1OWI0YTJmYzU3OTlmMTIzMjI0MTAwMDA1NiIsIm93bmVySUQiOjM3ODczOTcsImNyZWF0b3JJRCI6IiIsInNlZ21lbnREdXJhdGlvblNlY3MiOjQsInVzZVZPRE9URkUiOmZhbHNlLCJmcm9tTWV6emFuaW5lIjpmYWxzZSwic3RvcmFnZVByb3ZpZGVyIjoyLCJ0cmFjayI6IjA2NWFiOGU5MjFmZjEyMTAwY2MxYzU5YTBhOTY1ZGVkIiwicmVuZGl0aW9uIjoiMTM2ODUyOTEzIiwibXV4aW5nIjoiMTg3MzkwNjU0In0&s=w7wPexjCmFoOX8OMw6E1w5LDsyTCvEPDsjXDm8O9Qgk7w61nwqsJw4XDqMOUeic	false	Avira URL Cloud: safe	unknown
https://adobedc.demdex.net/ee/v1/identity/acquire?configId=715c679b-19c8-4402-8093-423571ad58c4&requestId=691198ab-1561-4e82-a9d6-89240171ddc5	false		high
https://px.ads.linkedin.com/wa/	false		high
https://assets.adobedtm.com/extensions/EPc7341b33570d4c988798fc9f0093d4b2/AppMeasurement_Module_ActivityMap.min.js	false		high
https://www.cloudflare.com/cdn-cgi/rum?	false		high
https://www.cloudflare.com/page-data/sq/d/3199558980.json	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
18.66.102.98	unknown	United States	3	MIT-GATEWAYSUS	false
192.28.144.124	713-xsc-918.mktoresp.com	United States	15224	OMNITUREUS	false
104.18.3.57	unknown	United States	13335	CLOUDFLARENETUS	false
2.16.164.129	a1916.dscg2.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
142.250.185.102	unknown	United States	15169	GOOGLEUS	false
18.203.49.17	unknown	United States	16509	AMAZON-02US	false
18.173.205.94	tag-logger.demandbase.com	United States	3	MIT-GATEWAYSUS	false
2.19.105.89	e7808.dscg.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
104.198.23.205	prod-default.lb.logrocket.network	United States	15169	GOOGLEUS	false
2.22.242.97	unknown	European Union	20940	AKAMAI-ASN1EU	false
151.101.65.140	reddit.map.fastly.net	United States	54113	FASTLYUS	false
104.16.97.114	embed.cloudflarestream.com	United States	13335	CLOUDFLARENETUS	false
104.18.30.78	unknown	United States	13335	CLOUDFLARENETUS	false
172.64.146.215	www.linkedin.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
63.35.0.120	unknown	United States	16509	AMAZON-02US	false
18.245.46.44	tag.demandbase.com	United States	16509	AMAZON-02US	false
104.16.124.96	www.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.66	adservice.google.com	United States	15169	GOOGLEUS	false
162.159.140.229	unknown	United States	13335	CLOUDFLARENETUS	false
69.173.144.165	unknown	United States	26667	RUBICONPROJECTUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
104.16.201.35	unknown	United States	13335	CLOUDFLARENETUS	false
2.22.242.136	a798.dscd.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
34.96.71.22	s.dsp-prod.demandbase.com	United States	15169	GOOGLEUS	false
104.16.96.114	iframe.cloudflarestream.com	United States	13335	CLOUDFLARENETUS	false
104.73.230.208	e10776.b.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
104.18.4.50	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
63.140.62.17	demdex.net.ssl.sc.omtrdc.net	United States	15224	OMNITUREUS	false
13.107.42.14	l-0005.l-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.16.71.105	scout-cdn.salesloft.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
142.250.110.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.16.5	js.qualified.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.194	td.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.31.78	performance.radar.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.17.149.140	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
3.229.221.52	partners-1864332697.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
146.75.120.157	platform.twitter.map.fastly.net	Sweden	30051	SCCGOVUS	false
35.244.174.68	id.rlcdn.com	United States	15169	GOOGLEUS	false

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_307.2.dr	false		high
https://px.ads.linkedin.com/collect/?pid=28851&fmt=gif	chromecache_214.2.dr	false		high
https://www.cloudflare.com/application-services/)	chromecache_178.2.dr, chromecache_312.2.dr	false		high
https://www.cloudflare.com/saas/)	chromecache_260.2.dr, chromecache_184.2.dr	false		high
https://assets.adobedtm.com/extensions/EPc7341b33570d4c988798fc9f0093d4b2/AppMeasurement_Module_Acti	chromecache_250.2.dr	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/4sfL2iS6H10uq2waT6ehym/ad18b77fa469ce07f23d22e19ab	chromecache_149.2.dr, chromecache_152.2.dr	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/3mYUDEjNlXbjQaceoFUhzU/378a4b79f7b51e7677fd6ab442e	chromecache_217.2.dr	false		high
https://www.forbes.com/sites/russellflannery/2021/11/13/ev-share-of-china-passenger-car-market-more-	chromecache_178.2.dr, chromecache_312.2.dr	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/0NY0QZdcIB62VMnG5JGH0/c3ed0daeb44e594adfd2ae259728	chromecache_202.2.dr, chromecache_204.2.dr	false		high
https://developers.marketo.com/MunchkinLicense.pdf	chromecache_155.2.dr, chromecache_231.2.dr	false		high
https://www.cloudflare.com/privacy-and-compliance/	chromecache_280.2.dr, chromecache_204.2.dr	false		high
https://tobiasahlin.com/blog/layered-smooth-box-shadows/	chromecache_197.2.dr	false	Avira URL Cloud: safe	unknown
https://cf-assets.www.cloudflare.com/slt3lc6tev37/4ejaIgcWXX2kmkizJqbiUA/bcb1d6b9c4a93c5b25e3d0bac04	chromecache_178.2.dr, chromecache_312.2.dr	false		high
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_307.2.dr	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/3jxszSMXRhwiwHDa1VPXFw/cc6439cd93a107bd0986bb6d5dc	chromecache_217.2.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_293.2.dr	false		high
https://stackoverflow.com/questions/3683211/ipad-safari-mobile-seems-to-ignore-z-indexing-position-f	chromecache_271.2.dr	false		high
https://www.cloudflare.com/plans/)	chromecache_280.2.dr, chromecache_204.2.dr	false		high
https://staging.mrk.cfdata.org/mrk/redwood-blade-repository/	chromecache_175.2.dr	false		high
https://medium.com/	chromecache_271.2.dr	false		high
https://dash.cloudflare.com/sign-up/workers	chromecache_280.2.dr, chromecache_204.2.dr	false		high
https://www.youtube.com/watch?v=B4QI0VzbkHk)	chromecache_178.2.dr, chromecache_312.2.dr	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/315wvQPkU3AcEnauttHpg7/ecda8d1d7314284ea83bae49699	chromecache_178.2.dr, chromecache_312.2.dr	false		high
https://js.qualified.com	chromecache_239.2.dr	false		high
https://www.cloudflare.com/learning/security/what-is-an-attack-surface/)	chromecache_178.2.dr, chromecache_312.2.dr	false		high
https://videodelivery.net/f9b4aa59b4a2fc5799f1232241000056/thumbnails/thumbnail.jpg?time=4s&height=7	chromecache_224.2.dr	false		high
https://www.cloudflare.com/plans/enterprise/	chromecache_280.2.dr, chromecache_204.2.dr	false		high
https://assets.adobedtm.com/f597f8065f97/065ba81630d7/launch-efab6d095ce0.js	chromecache_299.2.dr	false		high
https://dash.cloudflare.com/sign-up	chromecache_202.2.dr, chromecache_204.2.dr	false		high
https://www.cloudflare.com/network/	chromecache_280.2.dr, chromecache_204.2.dr	false		high
https://app.qualified.com	chromecache_239.2.dr	false		high
https://dash.cloudflare.com/sign-up/teams	chromecache_280.2.dr, chromecache_204.2.dr	false		high
https://www.cloudflare.com/plans/enterprise/contact/	chromecache_280.2.dr, chromecache_204.2.dr	false		high
https://iframe.cloudflarestream.com/oembed?url=https%3A%2F%2Fiframe.cloudflarestream.com%2Ff9b4aa59b	chromecache_224.2.dr	false		high
https://px.ads.linkedin.com/collect/?fmt=js&v=2&url=https%3A%2F%2Fwww.cloudflare.com%2Fwhat-is-cloud	chromecache_214.2.dr	false		high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/6bWnO822472EL2RMh16Lud/fec3ede9490277f6e9ce3135136	chromecache_178.2.dr, chromecache_312.2.dr	false		high
https://jonsuh.com/hamburgers	chromecache_202.2.dr	false		high

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638462
Start date and time:	2025-03-14 12:12:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://188.114.96.3
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.evad.win@30/293@172/69

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	105521
Entropy (8bit):	7.987330424882781
Encrypted:	false
SSDEEP:	3072:Yj/KoaCmqSCLDGzoRfla+jDAHdcCmRTlgZiq7kvbO:eJDmqSDzQl/kHC1RTlWiqIO
MD5:	BA621ED2234F9585870B16B81773CF85
SHA1:	705B9734634F21199576F8F29BE0D144306FE6F1
SHA-256:	0FD06DF979674825FB23CF94C14C6CB659BB1C210E91DA50B06CBB74E11A1235
SHA-512:	857D2A7E5DDAFB89600781537BEA65F684356EEF1AFC8539A6C956A52BE528956173DC2C54D821FEC7439909BC466F0340182347C9687223D28270593E45B1B6
Malicious:	false
Reputation:	low
Preview:	....stypmsdh....msdhmsix...4sidx..........0....................................hmoof....mfhd...........Ptraf....tfhd...8....................tfdt................trun.......`...p...............................................?.......U.......................................................................................................J.......9.......&.......................................................................................^...............b.......!...............................y.......................................................u...............................q.......................................O.......`.......Q.......................8...............0.......&.......H.......T...............G......._.......C.......x...............N.......{.......5.......B.......?.......P.......m.......L...............K......./.......u.......+.......................a.......%.......[...............p.......R....... ...............d.......}mdat....gM@..P....................h............

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 14, 2025 12:13:49.714355946 CET	1.1.1.1	192.168.2.4	0xcb10	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:13:49.714451075 CET	1.1.1.1	192.168.2.4	0x7297	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 14, 2025 12:13:52.127863884 CET	1.1.1.1	192.168.2.4	0xb09a	No error (0)	performance.radar.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:13:52.167629957 CET	1.1.1.1	192.168.2.4	0x997d	No error (0)	performance.radar.cloudflare.com		104.18.31.78	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:13:52.167629957 CET	1.1.1.1	192.168.2.4	0x997d	No error (0)	performance.radar.cloudflare.com		104.18.30.78	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:07.098762989 CET	1.1.1.1	192.168.2.4	0x4318	No error (0)	sparrow.cloudflare.com		104.18.2.57	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:07.098762989 CET	1.1.1.1	192.168.2.4	0x4318	No error (0)	sparrow.cloudflare.com		104.18.3.57	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:07.101291895 CET	1.1.1.1	192.168.2.4	0x8dad	No error (0)	sparrow.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:08.473589897 CET	1.1.1.1	192.168.2.4	0x9638	No error (0)	sparrow.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:08.488246918 CET	1.1.1.1	192.168.2.4	0x8118	No error (0)	sparrow.cloudflare.com		104.18.3.57	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:08.488246918 CET	1.1.1.1	192.168.2.4	0x8118	No error (0)	sparrow.cloudflare.com		104.18.2.57	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:33.048026085 CET	1.1.1.1	192.168.2.4	0xa109	No error (0)	www.cloudflare.com		104.16.124.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:33.048026085 CET	1.1.1.1	192.168.2.4	0xa109	No error (0)	www.cloudflare.com		104.16.123.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:33.068388939 CET	1.1.1.1	192.168.2.4	0xa8c4	No error (0)	www.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:33.283103943 CET	1.1.1.1	192.168.2.4	0x60b7	No error (0)	www.cloudflare.com		104.16.123.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:33.283103943 CET	1.1.1.1	192.168.2.4	0x60b7	No error (0)	www.cloudflare.com		104.16.124.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:33.284162998 CET	1.1.1.1	192.168.2.4	0xf5e5	No error (0)	www.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:34.334290981 CET	1.1.1.1	192.168.2.4	0x2a12	No error (0)	cf-assets.www.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:34.334840059 CET	1.1.1.1	192.168.2.4	0xae38	No error (0)	cf-assets.www.cloudflare.com		104.16.123.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:34.334840059 CET	1.1.1.1	192.168.2.4	0xae38	No error (0)	cf-assets.www.cloudflare.com		104.16.124.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:34.335752964 CET	1.1.1.1	192.168.2.4	0x9a47	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:35.008996964 CET	1.1.1.1	192.168.2.4	0x6db8	No error (0)	cf-assets.www.cloudflare.com		104.16.124.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:35.008996964 CET	1.1.1.1	192.168.2.4	0x6db8	No error (0)	cf-assets.www.cloudflare.com		104.16.123.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:35.012166023 CET	1.1.1.1	192.168.2.4	0x402	No error (0)	cf-assets.www.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:46.108587027 CET	1.1.1.1	192.168.2.4	0x9757	No error (0)	static.cloudflareinsights.com		104.16.79.73	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:46.108587027 CET	1.1.1.1	192.168.2.4	0x9757	No error (0)	static.cloudflareinsights.com		104.16.80.73	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:46.139620066 CET	1.1.1.1	192.168.2.4	0x2f9b	No error (0)	static.cloudflareinsights.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:46.235136032 CET	1.1.1.1	192.168.2.4	0x2f21	No error (0)	www.cloudflare.com		104.16.123.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:46.235136032 CET	1.1.1.1	192.168.2.4	0x2f21	No error (0)	www.cloudflare.com		104.16.124.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:46.235600948 CET	1.1.1.1	192.168.2.4	0x99de	No error (0)	www.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:46.709125042 CET	1.1.1.1	192.168.2.4	0xf37c	No error (0)	performance.radar.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:46.709137917 CET	1.1.1.1	192.168.2.4	0xa020	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:46.709137917 CET	1.1.1.1	192.168.2.4	0xa020	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:46.709145069 CET	1.1.1.1	192.168.2.4	0x6fea	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:46.709702969 CET	1.1.1.1	192.168.2.4	0x10c4	No error (0)	performance.radar.cloudflare.com		104.18.30.78	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:46.709702969 CET	1.1.1.1	192.168.2.4	0x10c4	No error (0)	performance.radar.cloudflare.com		104.18.31.78	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:46.711996078 CET	1.1.1.1	192.168.2.4	0x3163	No error (0)	ot.www.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:46.712420940 CET	1.1.1.1	192.168.2.4	0x56cd	No error (0)	ot.www.cloudflare.com		104.16.123.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:46.712420940 CET	1.1.1.1	192.168.2.4	0x56cd	No error (0)	ot.www.cloudflare.com		104.16.124.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:48.029524088 CET	1.1.1.1	192.168.2.4	0xf0e5	No error (0)	ot.www.cloudflare.com		104.16.123.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:48.029524088 CET	1.1.1.1	192.168.2.4	0xf0e5	No error (0)	ot.www.cloudflare.com		104.16.124.96	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:48.032135010 CET	1.1.1.1	192.168.2.4	0x4aad	No error (0)	ot.www.cloudflare.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:48.879453897 CET	1.1.1.1	192.168.2.4	0xe8a	No error (0)	cdn.logr-ingest.com		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:48.879453897 CET	1.1.1.1	192.168.2.4	0xe8a	No error (0)	cdn.logr-ingest.com		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:48.879453897 CET	1.1.1.1	192.168.2.4	0xe8a	No error (0)	cdn.logr-ingest.com		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:48.879453897 CET	1.1.1.1	192.168.2.4	0xe8a	No error (0)	cdn.logr-ingest.com		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:48.879453897 CET	1.1.1.1	192.168.2.4	0xe8a	No error (0)	cdn.logr-ingest.com		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:48.879453897 CET	1.1.1.1	192.168.2.4	0xe8a	No error (0)	cdn.logr-ingest.com		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:48.879453897 CET	1.1.1.1	192.168.2.4	0xe8a	No error (0)	cdn.logr-ingest.com		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:48.880743980 CET	1.1.1.1	192.168.2.4	0xdb2e	No error (0)	cdn.logr-ingest.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:51.017508984 CET	1.1.1.1	192.168.2.4	0x135b	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 12:14:51.017508984 CET	1.1.1.1	192.168.2.4	0x135b	No error (0)	cn-assets.adobedtm.com.edgekey.net	e7808.dscg.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 12:14:51.017800093 CET	1.1.1.1	192.168.2.4	0x5e41	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 12:14:51.017800093 CET	1.1.1.1	192.168.2.4	0x5e41	No error (0)	cn-assets.adobedtm.com.edgekey.net	e7808.dscg.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 12:14:51.017800093 CET	1.1.1.1	192.168.2.4	0x5e41	No error (0)	e7808.dscg.akamaiedge.net		2.19.105.89	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.019332886 CET	1.1.1.1	192.168.2.4	0x9243	No error (0)	embed.cloudflarestream.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:51.021225929 CET	1.1.1.1	192.168.2.4	0xde5a	No error (0)	embed.cloudflarestream.com		104.16.97.114	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.021225929 CET	1.1.1.1	192.168.2.4	0xde5a	No error (0)	embed.cloudflarestream.com		104.16.93.114	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.021225929 CET	1.1.1.1	192.168.2.4	0xde5a	No error (0)	embed.cloudflarestream.com		104.16.95.114	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.021225929 CET	1.1.1.1	192.168.2.4	0xde5a	No error (0)	embed.cloudflarestream.com		104.16.94.114	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.021225929 CET	1.1.1.1	192.168.2.4	0xde5a	No error (0)	embed.cloudflarestream.com		104.16.96.114	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.822762966 CET	1.1.1.1	192.168.2.4	0x4401	No error (0)	iframe.cloudflarestream.com		104.16.96.114	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.822762966 CET	1.1.1.1	192.168.2.4	0x4401	No error (0)	iframe.cloudflarestream.com		104.16.93.114	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.822762966 CET	1.1.1.1	192.168.2.4	0x4401	No error (0)	iframe.cloudflarestream.com		104.16.95.114	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.822762966 CET	1.1.1.1	192.168.2.4	0x4401	No error (0)	iframe.cloudflarestream.com		104.16.97.114	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.822762966 CET	1.1.1.1	192.168.2.4	0x4401	No error (0)	iframe.cloudflarestream.com		104.16.94.114	A (IP address)	IN (0x0001)	false
Mar 14, 2025 12:14:51.824074030 CET	1.1.1.1	192.168.2.4	0x9432	No error (0)	iframe.cloudflarestream.com			65	IN (0x0001)	false
Mar 14, 2025 12:14:52.402693033 CET	1.1.1.1	192.168.2.4	0x7598	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 14, 2025 12:14:52.402693033 CET	1.1.1.1	192.168.2.4	0x7598	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Mar

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://188.114.96.3

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Windows Analysis Report
http://188.114.96.3