Edit tour

Windows Analysis Report
https://partner.booking.com/unsubscribe?TEj95orqZA=PEj2

Overview

General Information

Sample URL:	https://partner.booking.com/unsubscribe?TEj95orqZA=PEj2
Analysis ID:	1686572
Infos:

Detection

Score:	0
Range:	0 - 100
Confidence:	80%

Signatures

HTTP GET or POST without a user agent

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6384 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2132,i,3421115317419968361,8129033344633704142,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2184 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2132,i,3421115317419968361,8129033344633704142,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4372 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2132,i,3421115317419968361,8129033344633704142,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2996 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://partner.booking.com/unsubscribe?TEj95orqZA=PEj2" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: POST /9edb85b43c77/ee43442010a2/daa884903f46/verify HTTP/1.1host: 9edb85b43c77.5396bc6d.us-west-1.token.awswaf.comcontent-length: 10085sec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"content-type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0accept: */*origin: https://partner.booking.comsec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: emptyreferer: https://partner.booking.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=UTF-8content-length: 206178server: nginxdate: Sat, 10 May 2025 05:15:56 GMTstrict-transport-security: max-age=63072000vary: Accept-Encodingvary: X-Forwarded-Protox-content-type-options: nosniffx-drupal-dynamic-cache: UNCACHEABLE (no cacheability)content-language: en-usx-frame-options: ALLOW-FROM https://partner.booking.comx-generator: Drupal 10 (https://www.drupal.org)content-security-policy: frame-ancestors 'self' https://partner.ddev.site https://next-moderation.dqs.booking.com https://next-moderation.prod.booking.com https://booking.service-now.com; report-uri /report-csp-violation; upgrade-insecure-requestsx-xss-protection: 1; mode=blockx-varnish-storage: Mallocx-url: /unsubscribe?TEj95orqZA=PEj2x-host: partner.booking.comcache-control: max-age=0, privateexpires: 0x-varnish: 66204277via: 1.1 varnish (Varnish/6.6), 1.1 691a8ff961a1aa9ab272aed6ca2ddafe.cloudfront.net (CloudFront)x-varnish-cache: MISSx-cache: Error from cloudfrontx-amz-cf-pop: LAX50-C1alt-svc: h3=":443"; ma=86400x-amz-cf-id: gwWVqIbwhLVVnGXGf3ndOyhwRTJwYEZbu7zdZ86o0jRk0uuuB302Ng==age: 0referrer-policy: strict-origin-when-cross-origin

Source: https://partner.booking.com/unsubscribe?TEj95orqZA=PEj2	HTTP Parser: No favicon
Source: https://partner.booking.com/unsubscribe?TEj95orqZA=PEj2	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 192.178.49.164:443 -> 192.168.2.5:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.210.109:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.210.109:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.147.94:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.147.94:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.147.94:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.87.42:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.87.42:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.87.42:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.147.60:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.214.123:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.167.192.63:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.0.114:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.155.119:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.86.42:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.167.192.63:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.155.119:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.167.192.63:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.214.123:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.210.109:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.178.49.164:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.144.134.128:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.241.80:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.50:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.141.157:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.36.181:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.198.242.208:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.8.30.44:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.8.30.44:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.71:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.210.109:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.156.210:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.23.12:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.23.12:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.8.30.44:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.144.134.1:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.144.134.1:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.144.134.1:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.50:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.178.49.164:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.8.30.44:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.8.30.44:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.144.134.1:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.156.210:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.144.134.1:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.144.134.1:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.144.134.1:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.8.30.44:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.23.12:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.156.210:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.193.173.108:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.254:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.71:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.32.137:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.144.134.1:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.6.229:443 -> 192.168.2.5:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.208.240:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.174.100:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.6.229:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.209.240:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.6.229:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.49.183.126:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49786 version: TLS 1.2

Source: global traffic	HTTP traffic detected: GET /tr/?id=137657823624702&ev=SubscribedButtonClick&dl=https%3A%2F%2Fpartner.booking.com%2Funsubscribe%3FTEj95orqZA%3DPEj2&rl=https%3A%2F%2Fpartner.booking.com%2Funsubscribe%3FTEj95orqZA%3DPEj2&if=false&ts=1746854173538&cd[buttonFeatures]=%7B%22classList%22%3A%22bui-button__text%22%2C%22destination%22%3A%22https%3A%2F%2Fpartner.booking.com%2Fen-us%2F404-page-not-found%22%2C%22id%22%3A%22%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22Search%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22span%22%2C%22type%22%3Anull%7D&cd[buttonText]=Search&cd[formFeatures]=%5B%7B%22id%22%3A%22edit-search-keyword%22%2C%22name%22%3A%22search_keyword%22%2C%22tag%22%3A%22input%22%2C%22placeholder%22%3A%22Search%20the%20Partner%20Hub%22%2C%22inputType%22%3A%22text%22%2C%22valueMeaning%22%3A%22empty%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22content_type_facet%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%2C%22valueMeaning%22%3A%22empty%22%7D%2C%7B%22id%22%3A%22edit-submit%22%2C%22name%22%3A%22op%22%2C%22tag%22%3A%22button%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22%22%2C%22tag%22%3A%22button%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22form_build_id%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22form_id%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%7D%5D&cd[pageFeatures]=%7B%22title%22%3A%22404%20Page%20not%20found%20%7C%20Booking.com%20for%20Partners%2
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=137657823624702&ev=SubscribedButtonClick&dl=https%3A%2F%2Fpartner.booking.com%2Funsubscribe%3FTEj95orqZA%3DPEj2&rl=https%3A%2F%2Fpartner.booking.com%2Funsubscribe%3FTEj95orqZA%3DPEj2&if=false&ts=1746854173538&cd[buttonFeatures]=%7B%22classList%22%3A%22bui-button__text%22%2C%22destination%22%3A%22https%3A%2F%2Fpartner.booking.com%2Fen-us%2F404-page-not-found%22%2C%22id%22%3A%22%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22Search%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22span%22%2C%22type%22%3Anull%7D&cd[buttonText]=Search&cd[formFeatures]=%5B%7B%22id%22%3A%22edit-search-keyword%22%2C%22name%22%3A%22search_keyword%22%2C%22tag%22%3A%22input%22%2C%22placeholder%22%3A%22Search%20the%20Partner%20Hub%22%2C%22inputType%22%3A%22text%22%2C%22valueMeaning%22%3A%22empty%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22content_type_facet%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%2C%22valueMeaning%22%3A%22empty%22%7D%2C%7B%22id%22%3A%22edit-submit%22%2C%22name%22%3A%22op%22%2C%22tag%22%3A%22button%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22%22%2C%22tag%22%3A%22button%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22form_build_id%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22form_id%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%7D%5D&cd[pageFeatures]=%7B%22title%22%3A%22404%20Page%20not%20found%20
Source: global traffic	HTTP traffic detected: GET /tr/?id=137657823624702&ev=SubscribedButtonClick&dl=https%3A%2F%2Fpartner.booking.com%2Funsubscribe%3FTEj95orqZA%3DPEj2&rl=https%3A%2F%2Fpartner.booking.com%2Funsubscribe%3FTEj95orqZA%3DPEj2&if=false&ts=1746854173538&cd[buttonFeatures]=%7B%22classList%22%3A%22bui-button__text%22%2C%22destination%22%3A%22https%3A%2F%2Fpartner.booking.com%2Fen-us%2F404-page-not-found%22%2C%22id%22%3A%22%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22Search%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22span%22%2C%22type%22%3Anull%7D&cd[buttonText]=Search&cd[formFeatures]=%5B%7B%22id%22%3A%22edit-search-keyword%22%2C%22name%22%3A%22search_keyword%22%2C%22tag%22%3A%22input%22%2C%22placeholder%22%3A%22Search%20the%20Partner%20Hub%22%2C%22inputType%22%3A%22text%22%2C%22valueMeaning%22%3A%22empty%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22content_type_facet%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%2C%22valueMeaning%22%3A%22empty%22%7D%2C%7B%22id%22%3A%22edit-submit%22%2C%22name%22%3A%22op%22%2C%22tag%22%3A%22button%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22%22%2C%22tag%22%3A%22button%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22form_build_id%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22form_id%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%7D%5D&cd[pageFeatures]=%7B%22title%22%3A%22404%20Page%20not%20found%20%7C%20Booking.com%20for%20Partners%2
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=137657823624702&ev=SubscribedButtonClick&dl=https%3A%2F%2Fpartner.booking.com%2Funsubscribe%3FTEj95orqZA%3DPEj2&rl=https%3A%2F%2Fpartner.booking.com%2Funsubscribe%3FTEj95orqZA%3DPEj2&if=false&ts=1746854173538&cd[buttonFeatures]=%7B%22classList%22%3A%22bui-button__text%22%2C%22destination%22%3A%22https%3A%2F%2Fpartner.booking.com%2Fen-us%2F404-page-not-found%22%2C%22id%22%3A%22%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22Search%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22span%22%2C%22type%22%3Anull%7D&cd[buttonText]=Search&cd[formFeatures]=%5B%7B%22id%22%3A%22edit-search-keyword%22%2C%22name%22%3A%22search_keyword%22%2C%22tag%22%3A%22input%22%2C%22placeholder%22%3A%22Search%20the%20Partner%20Hub%22%2C%22inputType%22%3A%22text%22%2C%22valueMeaning%22%3A%22empty%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22content_type_facet%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%2C%22valueMeaning%22%3A%22empty%22%7D%2C%7B%22id%22%3A%22edit-submit%22%2C%22name%22%3A%22op%22%2C%22tag%22%3A%22button%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22%22%2C%22tag%22%3A%22button%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22form_build_id%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%7D%2C%7B%22id%22%3A%22%22%2C%22name%22%3A%22form_id%22%2C%22tag%22%3A%22input%22%2C%22inputType%22%3A%22hidden%22%7D%5D&cd[pageFeatures]=%7B%22title%22%3A%22404%20Page%20not%20found%20

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.71

Source: chromecache_216.1.dr	String found in binary or memory: Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},mm:function(){e=rb()},de:function(){d()}}};var bc=wa(["data-gtm-yt-inspected-"]),jI=["www.youtube.com","www.youtube-nocookie.com"],kI,lI=!1; equals www.youtube.com (Youtube)
Source: chromecache_170.1.dr	String found in binary or memory: a.getAttribute("type")&&e.preventDefault();a.removeEventListener("beforescriptexecute",c)}))}function A(a){var c=a.src\|\|"",b=q(c);(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.removeAttribute("src"),a.setAttribute("data-src",c)))}var u=JSON.parse('[{"Tag":"https://www.google-analytics.com/analytics.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://cdn.mouseflow.com/projects/b18d32a2-ec35-41cf-9425-b945bb4c2fa5.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/embed/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://lonrtp1-cdn.marketo.com/rtp-api/v1/rtp.js","CategoryId":["C0002","C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/setuid?","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/main.a8916e10414ef10dd8f8.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://gum.criteo.com/sync?","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.linkedin.com/px/li_sync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/bounce","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/main.0b2b9315dfa1c7a31a02.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/criteodsp","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.targeting.unrulymedia.com/csync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/shared/commons.9b20dd57c6f12e1beb80.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://px.ads.linkedin.com/collect","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://contextual.media.net/cksync.php?","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://secure.adnxs.com/setuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/iframe_api","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.min.js","CategoryId":["C0002","C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/getuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://dynamic.criteo.com/js/ld/ld.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://dpm.demdex.net/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://px.ads.linkedin.com/attribution_trigger","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://lonrtp1.marketo.com/gw1/msg","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/setuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://munchkin.marketo.net/munchkin.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://visitor.omnitagjs.com/visitor/sync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/en_US/fbevents.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googletagma
Source: chromecache_170.1.dr	String found in binary or memory: a.getAttribute("type")&&e.preventDefault();a.removeEventListener("beforescriptexecute",c)}))}function A(a){var c=a.src\|\|"",b=q(c);(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.removeAttribute("src"),a.setAttribute("data-src",c)))}var u=JSON.parse('[{"Tag":"https://www.google-analytics.com/analytics.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://cdn.mouseflow.com/projects/b18d32a2-ec35-41cf-9425-b945bb4c2fa5.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/embed/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://lonrtp1-cdn.marketo.com/rtp-api/v1/rtp.js","CategoryId":["C0002","C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/setuid?","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/main.a8916e10414ef10dd8f8.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://gum.criteo.com/sync?","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.linkedin.com/px/li_sync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/bounce","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/main.0b2b9315dfa1c7a31a02.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/criteodsp","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.targeting.unrulymedia.com/csync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/shared/commons.9b20dd57c6f12e1beb80.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://px.ads.linkedin.com/collect","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://contextual.media.net/cksync.php?","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://secure.adnxs.com/setuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/iframe_api","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.min.js","CategoryId":["C0002","C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/getuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://dynamic.criteo.com/js/ld/ld.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://dpm.demdex.net/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://px.ads.linkedin.com/attribution_trigger","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://lonrtp1.marketo.com/gw1/msg","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/setuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://munchkin.marketo.net/munchkin.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://visitor.omnitagjs.com/visitor/sync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/en_US/fbevents.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googletagma
Source: chromecache_170.1.dr	String found in binary or memory: a.getAttribute("type")&&e.preventDefault();a.removeEventListener("beforescriptexecute",c)}))}function A(a){var c=a.src\|\|"",b=q(c);(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.removeAttribute("src"),a.setAttribute("data-src",c)))}var u=JSON.parse('[{"Tag":"https://www.google-analytics.com/analytics.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://cdn.mouseflow.com/projects/b18d32a2-ec35-41cf-9425-b945bb4c2fa5.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/embed/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://lonrtp1-cdn.marketo.com/rtp-api/v1/rtp.js","CategoryId":["C0002","C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/setuid?","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/main.a8916e10414ef10dd8f8.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://gum.criteo.com/sync?","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.linkedin.com/px/li_sync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/bounce","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/main.0b2b9315dfa1c7a31a02.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://sync.1rx.io/usersync/criteodsp","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sync.targeting.unrulymedia.com/csync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/shared/commons.9b20dd57c6f12e1beb80.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://px.ads.linkedin.com/collect","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://contextual.media.net/cksync.php?","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://secure.adnxs.com/setuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/iframe_api","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.min.js","CategoryId":["C0002","C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/getuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://dynamic.criteo.com/js/ld/ld.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://dpm.demdex.net/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://px.ads.linkedin.com/attribution_trigger","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://lonrtp1.marketo.com/gw1/msg","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ib.adnxs.com/setuid","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://munchkin.marketo.net/munchkin.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://visitor.omnitagjs.com/visitor/sync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/en_US/fbevents.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googletagma
Source: chromecache_218.1.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var h=XE(a,c,e);P(121);if(h["gtm.elementUrl"]==="https://www.facebook.com/tr/")return P(122),!0;if(d&&f){for(var m=Bb(b,g.length),n=0;n<g.length;++n)g[n](h,m);return m.done}for(var p=0;p<g.length;++p)g[p](h,function(){});return!0},$E=function(){var a=[],b=function(c){return gb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_216.1.dr	String found in binary or memory: if(!(f\|\|g\|\|h\|\|m.length\|\|n.length))return;var q={Ti:f,Ri:g,Si:h,Bj:m,Cj:n,Mf:p,Yb:e},r=y.YT;if(r)return r.ready&&r.ready(d),e;var t=y.onYouTubeIframeAPIReady;y.onYouTubeIframeAPIReady=function(){t&&t();d()};C(function(){for(var u=A.getElementsByTagName("script"),v=u.length,w=0;w<v;w++){var x=u[w].getAttribute("src");if(uI(x,"iframe_api")\|\|uI(x,"player_api"))return e}for(var z=A.getElementsByTagName("iframe"),B=z.length,D=0;D<B;D++)if(!lI&&sI(z[D],q.Mf))return tc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_218.1.dr	String found in binary or memory: ku();Lo(function(){a();Io(b)\|\|Tm(a,b)},b)},ku=function(){return[N.m.V,N.m.W]},lu=/^(?:www\.)?google(?:\.com?)?(?:\.[a-z]{2}t?)?$/,mu=/^www\.googleadservices\.com$/,qu=/^gad_source[_=](\d+)$/;function vu(){return To("dedupe_gclid",function(){return Jr()})};var wu=/^(www\.)?google(\.com?)?(\.[a-z]{2}t?)?$/,xu=/^www.googleadservices.com$/;function yu(a){a\|\|(a=zu());return a.Rp?!1:a.Qo\|\|a.Ro\|\|a.Uo\|\|a.So\|\|a.Nf\|\|a.Do\|\|a.To\|\|a.Io?!0:!1}function zu(){var a={},b=os(!0);a.Rp=!!b._up;var c=Jt();a.Qo=c.aw!==void 0;a.Ro=c.dc!==void 0;a.Uo=c.wbraid!==void 0;a.So=c.gbraid!==void 0;a.To=c.gclsrc==="aw.ds";a.Nf=iu().Nf;var d=A.referrer?mk(sk(A.referrer),"host"):"";a.Io=wu.test(d);a.Do=xu.test(d);return a};function Au(a){var b=window,c=b.webkit;delete b.webkit;a(b.webkit);b.webkit=c}function Bu(a){var b={action:"gcl_setup"};if("CWVWebViewMessage"in a.messageHandlers)return a.messageHandlers.CWVWebViewMessage.postMessage({command:"awb",payload:b}),!0;var c=a.messageHandlers.awb;return c?(c.postMessage(b),!0):!1};function Cu(){return["ad_storage","ad_user_data"]}function Du(a){if(H(38)&&!Jn(En.rl)&&"webkit"in window&&window.webkit.messageHandlers){var b=function(){try{Au(function(c){c&&("CWVWebViewMessage"in c.messageHandlers\|\|"awb"in c.messageHandlers)&&(In(En.rl,function(d){d.gclid&&Nt(d.gclid,a)}),Bu(c)\|\|P(178))})}catch(c){P(177)}};Sm(function(){lt(Cu())?b():Tm(b,Cu())},Cu())}};var Eu=["https://www.google.com","https://www.youtube.com","https://m.youtube.com"]; equals www.youtube.com (Youtube)
Source: chromecache_214.1.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(b){var c=typeof a.URL==="function"?a.URL:a.webkitURL;c=new c(b);c=c.hostname.endsWith(".facebook.com")&&c.pathname=="/signals/iwl.js";if(!c)throw new Error("Disallowed script URL");return b}})}}catch(a){}return null}e.exports=function(a,d,e){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a+"&access_token="+e;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_214.1.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_214.1.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/",TOPICS_API_ENDPOINT:"https://www.facebook.com/privacy_sandbox/topics/registration/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_218.1.dr	String found in binary or memory: return f}hI.N="internal.enableAutoEventOnTimer";var bc=wa(["data-gtm-yt-inspected-"]),jI=["www.youtube.com","www.youtube-nocookie.com"],kI,lI=!1; equals www.youtube.com (Youtube)
Source: chromecache_218.1.dr	String found in binary or memory: var wH=function(a,b,c,d,e){var f=uE("fsl",c?"nv.mwt":"mwt",0),g;g=c?uE("fsl","nv.ids",[]):uE("fsl","ids",[]);if(!g.length)return!0;var h=zE(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);P(121);if(m==="https://www.facebook.com/tr/")return P(122),!0;h["gtm.elementUrl"]=m;h["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(h["gtm.interactedFormName"]=a.getAttribute("name"));e&&(h["gtm.formSubmitElement"]=e,h["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!RC(h,TC(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: partner.booking.com
Source: global traffic	DNS traffic detected: DNS query: 9edb85b43c77.5396bc6d.us-west-1.token.awswaf.com
Source: global traffic	DNS traffic detected: DNS query: bstatic.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: munchkin.marketo.net
Source: global traffic	DNS traffic detected: DNS query: try.abtasty.com
Source: global traffic	DNS traffic detected: DNS query: cdn.evgnet.com
Source: global traffic	DNS traffic detected: DNS query: geolocation.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: cdn.mouseflow.com
Source: global traffic	DNS traffic detected: DNS query: bookingdotcomb2b.germany-2.evergage.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: dcinfos-cache.abtasty.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: eu01.rec.mouseflow.com
Source: global traffic	DNS traffic detected: DNS query: ariane.abtasty.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: booking-privacy.my.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: zn09tjwjvephllacp-partnersatbooking.siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: cdn.spinnaker-js.com
Source: global traffic	DNS traffic detected: DNS query: chat.kindlycdn.com
Source: global traffic	DNS traffic detected: DNS query: siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: apil1.spinnaker-js.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2132,i,3421115317419968361,8129033344633704142,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2184 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2132,i,3421115317419968361,8129033344633704142,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4372 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://partner.booking.com/unsubscribe?TEj95orqZA=PEj2"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2132,i,3421115317419968361,8129033344633704142,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2996 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2132,i,3421115317419968361,8129033344633704142,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2184 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2132,i,3421115317419968361,8129033344633704142,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4372 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2132,i,3421115317419968361,8129033344633704142,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2996 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
bstatic.com	3.168.147.60	true	false	high
cdn.evgnet.com	151.101.0.114	true	false	high
bookingdotcomb2b.germany-2.evergage.com	18.198.242.208	true	false	high
chat.kindlycdn.com	104.26.6.229	true	false	high
booking-privacy.my.onetrust.com	104.18.32.137	true	false	high
9edb85b43c77.5396bc6d.us-west-1.token.awswaf.com	3.168.147.94	true	false	unknown
e10776.b.akamaiedge.net	23.52.214.123	true	false	high
ariane.abtasty.com	34.8.30.44	true	false	high
cdn.mouseflow.com.cdn.cloudflare.net	104.18.26.50	true	false	high
stats.g.doubleclick.net	142.250.141.157	true	false	high
scontent.xx.fbcdn.net	57.144.134.128	true	false	high
www.google.com	192.178.49.164	true	false	high
d2df291ti5v5sq.cloudfront.net	18.164.174.100	true	false	unknown
pirateprod.9k9qh2pzbv.eu-west-1.elasticbeanstalk.com	52.49.183.126	true	false	unknown
star-mini.c10r.facebook.com	57.144.134.1	true	false	high
partner.booking.com	13.226.210.109	true	false	high
pki-goog.l.google.com	142.250.68.227	true	false	high
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
analytics-alv.google.com	216.239.36.181	true	false	high
prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net	104.17.208.240	true	false	high
dcinfos-cache.abtasty.com	34.8.30.44	true	false	high
cdn.cookielaw.org	104.18.87.42	true	false	high
geolocation.onetrust.com	172.64.155.119	true	false	high
a1916.dscg2.akamai.net	23.55.241.80	true	false	high
ln-0002.ln-dc-msedge.net	150.171.23.12	true	false	high
eu01.rec.mouseflow.com	34.120.156.210	true	false	high
try-cloudfront.abtasty.com	3.167.192.63	true	false	unknown
siteintercept.qualtrics.com	unknown	unknown	false	high
try.abtasty.com	unknown	unknown	false	high
zn09tjwjvephllacp-partnersatbooking.siteintercept.qualtrics.com	unknown	unknown	false	high
apil1.spinnaker-js.com	unknown	unknown	false	high
cdn.spinnaker-js.com	unknown	unknown	false	high
c.pki.goog	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
cdn.mouseflow.com	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
munchkin.marketo.net	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high
analytics.google.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.6.229	chat.kindlycdn.com	United States	13335	CLOUDFLARENETUS	false
192.178.49.164	www.google.com	United States	15169	GOOGLEUS	false
3.168.147.60	bstatic.com	United States	16509	AMAZON-02US	false
57.144.134.128	scontent.xx.fbcdn.net	Belgium	2686	ATGS-MMD-ASUS	false
104.17.209.240	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.0.114	cdn.evgnet.com	United States	54113	FASTLYUS	false
18.164.174.100	d2df291ti5v5sq.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
34.8.30.44	ariane.abtasty.com	United States	2686	ATGS-MMD-ASUS	false
104.18.32.137	booking-privacy.my.onetrust.com	United States	13335	CLOUDFLARENETUS	false
23.55.241.80	a1916.dscg2.akamai.net	United States	20940	AKAMAI-ASN1EU	false
34.120.156.210	eu01.rec.mouseflow.com	United States	15169	GOOGLEUS	false
104.18.87.42	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
216.239.36.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
3.168.147.94	9edb85b43c77.5396bc6d.us-west-1.token.awswaf.com	United States	16509	AMAZON-02US	false
13.226.210.109	partner.booking.com	United States	16509	AMAZON-02US	false
3.167.192.63	try-cloudfront.abtasty.com	United States	16509	AMAZON-02US	false
172.64.155.119	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
57.144.134.1	star-mini.c10r.facebook.com	Belgium	2686	ATGS-MMD-ASUS	false
18.198.242.208	bookingdotcomb2b.germany-2.evergage.com	United States	16509	AMAZON-02US	false
52.49.183.126	pirateprod.9k9qh2pzbv.eu-west-1.elasticbeanstalk.com	United States	16509	AMAZON-02US	false
23.52.214.123	e10776.b.akamaiedge.net	United States	27747	TelecentroSAAR	false
150.171.23.12	ln-0002.ln-dc-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.86.42	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.141.157	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.17.208.240	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
104.18.26.50	cdn.mouseflow.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
18.193.173.108	unknown	United States	16509	AMAZON-02US	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1686572
Start date and time:	2025-05-10 07:14:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://partner.booking.com/unsubscribe?TEj95orqZA=PEj2
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@26/170@89/28

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.5654483718208256
Encrypted:	false
SSDEEP:	3:L1SR9H:JU
MD5:	4EBA1421429C48F7D003BC964C1382E3
SHA1:	84448D7F8910DE81C8699273320CEF386EACB893
SHA-256:	F35B60B9E90669DCF20C8B3568D66579A0567C6099897E25BCF920F5815F2FCA
SHA-512:	1C7E2196E2C879DCBB7588DC1C0897928A64C7AFDBF218057965574509EF28CCBDE6F3CF3A013BB7023AD1217311CB287612DB6629AE6260CC2F4E7491E6B164
Malicious:	false
Reputation:	low
URL:	https://eu01.rec.mouseflow.com/init?v=18.29&p=b18d32a2-ec35-41cf-9425-b945bb4c2fa5&s=f0e5aecf1b37c035ce105ed0b170a911&page=05101702c00800810792bb2d207a67e7126765a4&ret=0&u=82433d67273170ab311be76752c499d0&href=https%3A%2F%2Fpartner.booking.com%2Fen-us%2Fsearch%3Fsearch%3D%26sort_by%3Drelevance&url=%2Fen-us%2Fsearch&ref=https%3A%2F%2Fpartner.booking.com&title=Search%20the%20Partner%20Hub%20%7C%20Booking.com%20for%20Partners&res=1280x1024&tz=300&to=0&dnt=0&ori=&dw=1265&dh=897&time=1746854177702&pxr=1&gdpr=0
Preview:	1746854178657

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	low
URL:	https://px.ads.linkedin.com/attribution_trigger?pid=543530&time=1746854160459&url=https%3A%2F%2Fpartner.booking.com%2Funsubscribe%3FTEj95orqZA%3DPEj2
Preview:	{}

Name	Source	Malicious	Reputation
https://ad.doubleclick.net/activity;register_conversion=1;	chromecache_216.1.dr, chromecache_218.1.dr	false	high
https://cdn.mouseflow.com/projects/b18d32a2-ec35-41cf-9425-b945bb4c2fa5.js	chromecache_170.1.dr	false	high
https://stats.g.doubleclick.net/g/collect	chromecache_218.1.dr	false	high
https://munchkin.marketo.net/	chromecache_142.1.dr, chromecache_204.1.dr	false	high
https://www.booking.com/content/privacy.html	chromecache_166.1.dr	false	high
https://partner.booking.com/pl/b%C5%82%C4%85d-404-%E2%80%93-nie-znaleziono-strony	chromecache_142.1.dr	false	high
https://partner.booking.com/sv/search	chromecache_204.1.dr	false	high
https://partner.booking.com/hr/search	chromecache_204.1.dr	false	high
https://www.youtube.com/embed/	chromecache_170.1.dr	false	high
https://partner.booking.com/en-us/join	chromecache_200.1.dr	false	high
http://jqueryui.com	chromecache_164.1.dr, chromecache_195.1.dr	false	high
https://partner.booking.com/tr/404-sayfa-bulunamad%C4%B1	chromecache_142.1.dr	false	high
https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/main.a8916e10414ef10dd8f8.js	chromecache_170.1.dr	false	high
https://partner.booking.com/fr/erreur%C2%A0404%C2%A0-page-non-trouv%C3%A9e	chromecache_142.1.dr	false	high
https://ib.adnxs.com/bounce	chromecache_170.1.dr	false	high
https://google.com/pagead/form-data	chromecache_216.1.dr, chromecache_218.1.dr	false	high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_209.1.dr	false	high
https://partner.booking.com/pl/search	chromecache_204.1.dr	false	high
https://px.ads.linkedin.com/collect	chromecache_170.1.dr	false	high
https://partner.booking.com/en-gb/search	chromecache_204.1.dr	false	high
https://www.youtube.com	chromecache_216.1.dr, chromecache_218.1.dr	false	high
https://partner.booking.com/de/search	chromecache_204.1.dr	false	high
https://www.google.com	chromecache_218.1.dr	false	high
https://www.youtube.com/iframe_api	chromecache_170.1.dr, chromecache_216.1.dr	false	high
https://partner.booking.com/bg/404-%D1%81%D1%82%D1%80%D0%B0%D0%BD%D0%B8%D1%86%D0%B0%D1%82%D0%B0-%D0%	chromecache_142.1.dr	false	high
https://lonrtp1.marketo.com/gw1/msg	chromecache_170.1.dr	false	high
https://px.ads.linkedin.com/attribution_trigger	chromecache_170.1.dr	false	high
https://connect.facebook.net/en_US/fbevents.js	chromecache_170.1.dr	false	high
https://ib.adnxs.com/bounce?	chromecache_170.1.dr	false	high
https://m.youtube.com	chromecache_216.1.dr, chromecache_218.1.dr	false	high
https://x.bidswitch.net/sync?	chromecache_170.1.dr	false	high
https://partner.booking.com/sr/search	chromecache_204.1.dr	false	high
https://r.casalemedia.com/rum?	chromecache_170.1.dr	false	high
https://exchange.mediavine.com/usersync/push	chromecache_170.1.dr	false	high
https://admin.booking.com/?utm_source=partner_hub&utm_medium=go_to_extranet_link&utm_campaign=partne	chromecache_142.1.dr	false	high
https://ib.adnxs.com/getuid?	chromecache_170.1.dr	false	high
https://partner.booking.com/de/join	chromecache_200.1.dr	false	high
https://partner.booking.com/ko/search	chromecache_204.1.dr	false	high
https://stats.g.doubleclick.net/j/collect	chromecache_209.1.dr	false	high
https://www.drupal.org)	chromecache_142.1.dr, chromecache_204.1.dr	false	high
https://cdn.evgnet.com/beacon/bookingdotcomb2b/booking_prod/scripts/evergage.min.js	chromecache_170.1.dr	false	high
https://partner.booking.com/zh-cn/search	chromecache_204.1.dr	false	high
https://www.google.com/pagead/form-data	chromecache_216.1.dr, chromecache_218.1.dr	false	high
https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/main.f9f9128fc0ece542a425.js	chromecache_170.1.dr	false	high
https://gum.criteo.com/sync	chromecache_170.1.dr	false	high
https://partner.booking.com/hr/404-stranica-nije-prona%C4%91ena	chromecache_142.1.dr	false	high
https://partner.booking.com/es/search	chromecache_204.1.dr	false	high
https://connect.facebook.net/signals/config/	chromecache_170.1.dr	false	high
https://partner.booking.com/es-ar/error-404-p%C3%A1gina-no-encontrada	chromecache_142.1.dr	false	high
https://lonrtp1-cdn.marketo.com/rtp-api/v1/rtp.js	chromecache_170.1.dr	false	high
https://siteintercept.qualtrics.com	chromecache_158.1.dr	false	high
https://ib.adnxs.com/setuid?	chromecache_170.1.dr	false	high
https://partner.booking.com/en-us	chromecache_142.1.dr, chromecache_204.1.dr	false	high
https://partner.booking.com/pt-br/search	chromecache_204.1.dr	false	high
https://partner.booking.com/el/search	chromecache_204.1.dr	false	high
https://partner.booking.com/ru/search	chromecache_204.1.dr	false	high
https://siteintercept.qualtrics.com/dxjsmodule/	chromecache_158.1.dr	false	high
https://partner.booking.com/zh-cn/404%E9%A1%B5%E9%9D%A2%E6%9C%AA%E6%89%BE%E5%88%B0	chromecache_142.1.dr	false	high
https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/main.0b2b9315dfa1c7a31a02.js	chromecache_170.1.dr	false	high
https://schema.org	chromecache_142.1.dr, chromecache_204.1.dr	false	high
https://partner.booking.com/cs/404-%E2%80%93-str%C3%A1nka-nenalezena	chromecache_142.1.dr	false	high
https://git.drupalcode.org/project/once/-/raw/v1.0.1/LICENSE.md	chromecache_164.1.dr, chromecache_195.1.dr	false	high
https://cct.google/taggy/agent.js	chromecache_216.1.dr, chromecache_218.1.dr	false	high
https://partner.booking.com/nl/404-pagina-niet-gevonden	chromecache_142.1.dr	false	high
https://partner.booking.com/pt/search	chromecache_204.1.dr	false	high
https://connect.facebook.net/	chromecache_214.1.dr	false	high
https://partner.booking.com/vi/l%E1%BB%97i-404-kh%C3%B4ng-t%C3%ACm-th%E1%BA%A5y-trang	chromecache_142.1.dr	false	high
https://partner.booking.com/pl/do%C5%82%C4%85cz	chromecache_200.1.dr	false	high
https://partner.booking.com/th/search	chromecache_204.1.dr	false	high
https://ib.adnxs.com/getuid	chromecache_170.1.dr	false	high
https://dpm.demdex.net/	chromecache_170.1.dr	false	high
https://ib.adnxs.com/setuid	chromecache_170.1.dr	false	high
https://developers.marketo.com/MunchkinLicense.pdf	chromecache_132.1.dr	false	high
https://www.google.%/ads/ga-audiences	chromecache_209.1.dr	false	high
https://partner.booking.com/it/404-pagina-non-trovata	chromecache_142.1.dr	false	high
https://visitor.omnitagjs.com/visitor/sync	chromecache_170.1.dr	false	high
https://partner.booking.com/he/404-%D7%94%D7%A2%D7%9E%D7%95%D7%93-%D7%9C%D7%90-%D7%A0%D7%9E%D7%A6%D7	chromecache_142.1.dr	false	high
https://criteo-partners.tremorhub.com/sync?	chromecache_170.1.dr	false	high
https://lonrtp1.marketo.com/gw1/trw	chromecache_170.1.dr	false	high
https://raw.githubusercontent.com/jquery/jquery-ui/1.13.2/LICENSE.txt	chromecache_215.1.dr, chromecache_164.1.dr, chromecache_138.1.dr, chromecache_195.1.dr	false	high
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_218.1.dr	false	high
https://partner.booking.com/it/search	chromecache_204.1.dr	false	high
https://partner.booking.com/ro/eroare-404-pagina-nu-fost-g%C4%83sit%C4%83	chromecache_142.1.dr	false	high
https://partner.booking.com/id/search	chromecache_204.1.dr	false	high
https://www.google.com/ccm/collect	chromecache_216.1.dr, chromecache_218.1.dr	false	high
https://partner.booking.com/ja/search	chromecache_204.1.dr	false	high
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	chromecache_142.1.dr, chromecache_204.1.dr	false	high
https://www.drupal.org/licensing/faq	chromecache_127.1.dr, chromecache_215.1.dr, chromecache_164.1.dr, chromecache_138.1.dr, chromecache_162.1.dr, chromecache_175.1.dr, chromecache_163.1.dr, chromecache_184.1.dr, chromecache_195.1.dr, chromecache_190.1.dr	false	high
https://partner.booking.com/th/404-%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%9E%E0%B8%9A%E0%B8%AB%E0%B8%99%E	chromecache_142.1.dr	false	high
https://partner.booking.com/fr/search	chromecache_204.1.dr	false	high
http://jquery.org/license	chromecache_164.1.dr, chromecache_195.1.dr	false	high
https://www.booking.com/content/about.en-us.html?utm_source=partnerhub&utm_medium=about_booking_com_	chromecache_142.1.dr	false	high
https://cdn.cookielaw.org	chromecache_142.1.dr, chromecache_204.1.dr	false	high
https://partner.booking.com/ja/404-%E3%83%9A%E3%83%BC%E3%82%B8%E3%81%8C%E8%A6%8B%E3%81%A4%E3%81%8B%E	chromecache_142.1.dr	false	high
https://www.booking.com/content/about.en-us.html?utm_source=partnerhub&utm_medium=about_booking_	chromecache_204.1.dr	false	high
https://gum.criteo.com/sync?	chromecache_170.1.dr	false	high
https://partner.booking.com/sr/gre%C5%A1ka-404-%E2%80%93-stranica-nije-prona%C4%91ena	chromecache_142.1.dr	false	high
https://raw.githubusercontent.com/jquery/jquery/3.7.1/LICENSE.txt	chromecache_164.1.dr, chromecache_195.1.dr	false	high

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://partner.booking.com/unsubscribe?TEj95orqZA=PEj2

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Windows Analysis Report
https://partner.booking.com/unsubscribe?TEj95orqZA=PEj2