Automated Malware Analysis IOC Report for

Details

Filetype:	URL
Filename:	http://484242.484242.piraminds.com/.#.aHR0cDovL0RpZ2lwaG90b2dsb2JhbC5mZXNkeS5wZS9odG1sI2MyRnNhV3d1YzI5dFlXNUFaR2xuYVhCb2IzUnZaMnh2WW1Gc0xtTnZiUT09

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking
Classification label	System Summary
Downloads compressed data via HTTP	Networking	Non-Application Layer Protocol Application Layer Protocol Ingress Tool Transfer
Uses HTTPS	Networking	Encrypted Channel
Spawns processes	System Summary	Process Injection
Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.
Downloads files from webservers via HTTP	Networking
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking
Creates files inside the program directory	System Summary
Posts data to webserver	Networking
Creates a directory in C:\Program Files	Compliance, System Summary	Masquerading
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary
Found GUI installer (many successful clicks)	System Summary

Details

Name:	https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Details

Name:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=7644ce9c6e578fdd
IP:	104.18.6.185
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/img/7644ce9c6e578fdd/1667475333476/rc2rUmmE6n-7BY8
IP:	104.18.6.185
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/778263f53a53630a857a9290654bdb6f/turnstile_gif.gif
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/e45e66a9871bd16f924c89eba16b1b57/cloudflare-pages-blue.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/9ec514a3b8b51dfe57543cc0424e127e/security-api-web-apps-spot-illustration.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://frjn1qu9aj7akf.bioch.ru/favicon.ico
IP:	188.114.96.3
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://ad.doubleclick.net/activity;src=9309168;type=adh_o0;cat=adh_g0;ord=4509911983999;gtm=2ygav0;auiddc=1638296394.1667504171;u1=2022%20Nov%2003%2012%3A36%3A11;u2=undefined;u3=https%3A%2F%2Fwww.cloudflare.com%2F%3Futm_source%3Dchallenge%26utm_campaign%3Dm;u4=undefined;u5=undefined;u6=undefined;u7=undefined;u8=undefined;u9=undefined;u10=undefined;u11=undefined;u12=undefined;u13=undefined;u14=undefined;u15=undefined?
IP:	142.251.143.134
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://id.rlcdn.com/464526.gif
IP:	35.244.174.68
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/b067ac772150e57a54e7a1aa0f018c72/cloudflare-browser-blue.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/page-data/en-gb/products/turnstile/page-data.json
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://adservice.google.co.uk/ddm/fls/p/dc_pre=CJz-7On1kfsCFZiVmwod4FwO0A;src=9309168;type=adh_o0;cat=adh_g0;ord=4509911983999;gtm=2ygav0;auiddc=1638296394.1667504171;u1=2022%20Nov%2003%2012%3A36%3A11;u2=undefined;u3=https%3A%2F%2Fwww.cloudflare.com%2F%3Futm_source%3Dchallenge%26utm_campaign%3Dm;u4=undefined;u5=undefined;u6=undefined;u7=undefined;u8=undefined;u9=undefined;u10=undefined;u11=undefined;u12=undefined;u13=undefined;u14=undefined;u15=undefined;~oref=https://www.cloudflare.com/
IP:	142.251.143.98
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.cloudflare.com%2Fen-gb%2Fproducts%2Fturnstile%2F%3Futm_source%3Dturnstile%26utm_campaign%3Dwidget&page_title=Cloudflare%20Turnstile%2C%20a%20free%20CAPTCHA%20replacement%20%7C%20Cloudflare
IP:	54.230.206.114
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	https://www.cloudflare.com/vendor/onetrust/scripttemplates/otSDKStub.js
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://tr.www.cloudflare.com/gtag/js?id=G-PHVG60J2FD&l=dataLayer&cx=c&sign=d5a9b882437b3ac13c16066909793746b80cfeb6b0588c4062210ea2efe00b76_20221103
IP:	104.16.124.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://www.cloudflare.com/page-data/index/page-data.json
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/commons-7a405212b282de3f8e6f.js
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/7644ce9c6e578fdd/1667475333477/f70c782704a49e50c9e9cbb533b881fb40963c6d84a7e462b38153bf682f7f45/6DhiGC_ed1XnpJ1
IP:	104.18.6.185
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://ad.doubleclick.net/activity;dc_pre=CPLay_f1kfsCFe3JOwId7wMPtA;src=9309168;type=adh_o0;cat=adh_g0;ord=2038357168494;gtm=2ygav0;auiddc=1638296394.1667504171;u1=2022%20Nov%2003%2012%3A36%3A40;u2=undefined;u3=https%3A%2F%2Fwww.cloudflare.com%2Fen-gb%2Fproducts%2Fturnstile%2F%3Futm_source%3Dturnstile%26utm_campaign%3Dwidget;u4=undefined;u5=undefined;u6=undefined;u7=undefined;u8=undefined;u9=undefined;u10=undefined;u11=undefined;u12=undefined;u13=undefined;u14=undefined;u15=1796770398.1667504172?
IP:	142.251.143.134
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://www.cloudflare.com/page-data/sq/d/809133105.json
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/8bba4c4f12798edd31b6f2b8e600246e/internet-globe-blue.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://713-xsc-918.mktoresp.com/webevents/visitWebPage?_mchNc=1667504200295&_mchCn=&_mchId=713-XSC-918&_mchTk=_mch-cloudflare.com-1667504180879-97994&_mchHo=www.cloudflare.com&_mchPo=&_mchRu=%2Fen-gb%2Fproducts%2Fturnstile%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=utm_source%3Dturnstile__-__utm_campaign%3Dwidget
IP:	192.28.144.124
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	https://www.cloudflare.com/static/6d28db3ec2ddd52c893b4bd3b26d26bc/logo_loreal_trusted-by_gray.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/rvs/?u=https%3A%2F%2Fwww.cloudflare.com%2Fen-gb%2Fproducts%2Fturnstile%2F%3Futm_source%3Dturnstile%26utm_campaign%3Dwidget
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://frjn1qu9aj7akf.bioch.ru/Msalil.soman@digiphotoglobal.com
IP:	188.114.96.3
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://713-xsc-918.mktoresp.com/webevents/visitWebPage?_mchNc=1667504180881&_mchCn=&_mchId=713-XSC-918&_mchTk=_mch-cloudflare.com-1667504180879-97994&_mchHo=www.cloudflare.com&_mchPo=&_mchRu=%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=utm_source%3Dchallenge__-__utm_campaign%3Dm
IP:	192.28.144.124
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	https://www.cloudflare.com/page-data/sq/d/3934964512.json
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyQ2xvdWRmbGFyZSUyMC0lMjBUaGUlMjBXZWIlMjBQZXJmb3JtYW5jZSUyMCUyNiUyMFNlY3VyaXR5JTIwQ29tcGFueSUyMCU3QyUyMENsb3VkZmxhcmUlMjIlMkMlMjJ4JTIyJTNBMC40MDgyNzA3NDM1MTk5MTY2NiUyQyUyMnclMjIlM0ExMjgwJTJDJTIyaCUyMiUzQTEwMjQlMkMlMjJqJTIyJTNBOTEzJTJDJTIyZSUyMiUzQTEyODAlMkMlMjJsJTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZ3d3cuY2xvdWRmbGFyZS5jb20lMkYlM0Z1dG1fc291cmNlJTNEY2hhbGxlbmdlJTI2dXRtX2NhbXBhaWduJTNEbSUyMiUyQyUyMnIlMjIlM0ElMjIlMjIlMkMlMjJrJTIyJTNBMjQlMkMlMjJuJTIyJTNBJTIyVVRGLTglMjIlMkMlMjJvJTIyJTNBNDIwJTJDJTIycSUyMiUzQSU1QiU1RCU3RA==
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://stats.g.doubleclick.net/g/collect?v=2&tid=G-PHVG60J2FD&cid=1796770398.1667504172&gtm=2reav0&aip=1
IP:	142.250.153.156
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://www.cloudflare.com/en-gb/products/turnstile/?utm_source=turnstile&utm_campaign=widget
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Details

Name:	https://ad.doubleclick.net/activity;dc_pre=CJz-7On1kfsCFZiVmwod4FwO0A;src=9309168;type=adh_o0;cat=adh_g0;ord=4509911983999;gtm=2ygav0;auiddc=1638296394.1667504171;u1=2022%20Nov%2003%2012%3A36%3A11;u2=undefined;u3=https%3A%2F%2Fwww.cloudflare.com%2F%3Futm_source%3Dchallenge%26utm_campaign%3Dm;u4=undefined;u5=undefined;u6=undefined;u7=undefined;u8=undefined;u9=undefined;u10=undefined;u11=undefined;u12=undefined;u13=undefined;u14=undefined;u15=undefined?
IP:	142.251.143.134
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://www.cloudflare.com/static/88d8a61effe6ece596ff34fc796fa7b9/end_of_road.png
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://tag.demandbase.com/f309084f574a9b8e.min.js
IP:	52.85.92.7
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://www.cloudflare.com/static/6a54ab9058dd2854c6c48ef65a6d931d/Area-1_Vendor-Email-Fraud-Icon.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/b605eca229bbf7bc64daaae689da14ad/logo_zendesk_gray_32px-wrapper.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/82a73aab9040a829207ef10e8859e3ef/logo_labcorp_trusted-by_gray.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://frjn1qu9aj7akf.bioch.ru/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7644ce82bb376922
IP:	188.114.96.3
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://alb.reddit.com/rp.gif?id=t2_1upmecjq&event=PageVisit&ts=1667475371532&uuid=ffb754cf-ce40-4369-98c4-47a56b354747&s=%2F6C8i9X7STOQDh39eWje0g4rowozfKJwWFtgRQaPXt4%3D
IP:	151.101.1.140
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	http://digiphotoglobal.fesdy.pe/html/
IP:	192.185.14.33
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.23651009508986148:1667474967:fi0-4-A-sC4gybQGWCySYv6nPl6_WaDVssClb3Kh0Qs/7644ce9c6e578fdd/645a2645b8a2530
IP:	104.18.6.185
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/f66c9352641e2d181c7d3d4f4e80c899/Test_V1.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
IP:	54.229.166.11
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	https://www.cloudflare.com/static/4b39f12c05140c199c0a97d48c11fb63/analytics-data.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://tr.www.cloudflare.com/analytics.js
IP:	104.16.124.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://a.nel.cloudflare.com/report/v3?s=rKkqCaen49IaKvCBM8l3nL9pljiacbmCifS7EH98Ums6MYMe2ZY9hNq%2FU%2BwhSQcH9k6dsyE1MWQE3SRtW6LU0fXHwZxir6V3CAe2Kt53q2MGp%2B0BuHYqHqrWJBoGo02SdP6gjSfsL1SdLg%3D%3D
IP:	35.190.80.1
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://match.prod.bidr.io/cookie-sync/demandbase
IP:	54.229.166.11
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	https://www.cloudflare.com/static/cfe3596a8bbbc41b827c27e457c97607/face-sad.png
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://frjn1qu9aj7akf.bioch.ru/Msalil.soman@digiphotoglobal.com
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Details

Name:	https://www.cloudflare.com/framework-a161050e12a4e036ba91.js
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://tr.www.cloudflare.com/ns.html?id=GTM-PKQFGQB
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser
Reputation:	high

Details

Name:	https://frjn1qu9aj7akf.bioch.ru/cdn-cgi/challenge-platform/h/g/img/7644ce82bb376922/1667475329326/DxNlck9TWz50FZA
IP:	188.114.96.3
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/107b38103df2882b72b7d0117478f787/teams-access-hero_1.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/9669cae57f56c6e3049faec567a9e6a7/cloudflare-access-blue.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/page-data/sq/d/1869562119.json
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.googleoptimize.com/optimize.js?id=GTM-N4JSZJ8
IP:	142.251.143.142
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	https://www.cloudflare.com/static/e4e28c9fc1e9fc6ae9cd481258b4e0f6/performance-1-blue.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/01f0e9e70dbb5132df9a1ebc4b978b79/security-fingerprint-privacy-blue.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/963dade74282b833006aeacef3caf511/workers-hero-illustration.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
IP:	104.16.57.101
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	https://www.cloudflare.com/static/67c8dcbe189a2cf2a0a2966ba23a3da5/logo_garmin_trusted-by_gray.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://segments.company-target.com/log?vendor=choca&user_id=AAEn-k7Gx1AAACD4_0321w
IP:	52.222.191.11
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/e1ad6750062875202782bbb3fc19101a33b1e306-e253e64b9d4f28e16878.js
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/page-data/sq/d/2333086113.json
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/ff006509bb342c576c2f15bd7bee9704/logo_shopify_trusted-by_gray.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://tr.www.cloudflare.com/g/collect?v=2&tid=G-PHVG60J2FD&gtm=2reav0&_p=1330291102&_gaz=1&cid=1796770398.1667504172&ul=en-us&sr=1280x1024&_fplc=0&uaa=x86&uab=64&uafvl=Chromium%3B104.0.5112.81%7C%2520Not%2520A%253BBrand%3B99.0.0.0%7CGoogle%2520Chrome%3B104.0.5112.81&uamb=0&uam=&uap=Windows&uapv=6.0.0&uaw=0&_s=1&dl=https%3A%2F%2Fwww.cloudflare.com%2F%3Futm_source%3Dchallenge%26utm_campaign%3Dm&dr=&sid=1667504180&sct=1&seg=0&dt=Cloudflare%20-%20The%20Web%20Performance%20%26%20Security%20Company%20%7C%20Cloudflare&en=page_view&_fv=1&_ss=1&ep.content_group=Marketing%20Site&ep.timestamp=2022-11-03T12%3A36%3A11.78-07%3A00&ep.blog_post_date=&ep.content_interest_score=&ep.gtm_container_id=GTM-PKQFGQB&upn.timezone_offset=-7&richsstsse
IP:	104.16.124.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://www.cloudflare.com/static/bc68754f416c6ace80b7ced3c1a0706a/cloudflare-gateway-blue.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1
IP:	142.251.143.174
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://www.cloudflare.com/page-data/app-data.json
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/8e6e17c1d426c4173db2d937aeeead9d/performance-cloud-speed-blue.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/rvs/?u=https%3A%2F%2Fwww.cloudflare.com%2F%3Futm_source%3Dchallenge%26utm_campaign%3Dm
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://alb.reddit.com/rp.gif?id=t2_1upmecjq&event=PageVisit&ts=1667475400788&uuid=ffb754cf-ce40-4369-98c4-47a56b354747&s=plKct8GSOItMF%2BqYHQCqL35CP8Qw32mCeNRfA1lCbTM%3D
IP:	151.101.1.140
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/turnstile/if/ov2/av0/bm9y5/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
IP:	104.18.6.185
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://tr.www.cloudflare.com/ns.html?id=GTM-PKQFGQB
IP:	104.16.124.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/turnstile/if/ov2/av0/bm9y5/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Details

Name:	https://www.cloudflare.com/vendor/onetrust/consent/e34df59b-4a48-4bf9-b2b5-7a4bb09cd231/4505fd23-3c09-44db-82b2-07a7d776e9a7/en.json
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://frjn1qu9aj7akf.bioch.ru/cdn-cgi/styles/challenges.css
IP:	188.114.96.3
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEn-k7Gx1AAACD4_0321w&verifyHash=47413aef4791e2c8c095d8f2f0fc0c5a33d7a8f8
IP:	52.222.191.11
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/cdn-cgi/rum?
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.cloudflare.com%2F%3Futm_source%3Dchallenge%26utm_campaign%3Dm&page_title=Cloudflare%20-%20The%20Web%20Performance%20%26%20Security%20Company%20%7C%20Cloudflare
IP:	54.230.206.114
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://digiphotoglobal.fesdy.pe/html
IP:	192.185.14.33
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	https://www.cloudflare.com/static/f9049af4fb3ca830e5bf61496a5f1024/price.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://www.cloudflare.com/static/8700e89879f875a08b6769b1583cf270/logo_thomson-reuters_gray_32px-wrapper.svg
IP:	104.16.123.96
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Details

Name:	https://performance.radar.cloudflare.com/beacon.js
IP:	104.18.31.78
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://ad.doubleclick.net/activity;src=9309168;type=adh_o0;cat=adh_g0;ord=2038357168494;gtm=2ygav0;auiddc=1638296394.1667504171;u1=2022%20Nov%2003%2012%3A36%3A40;u2=undefined;u3=https%3A%2F%2Fwww.cloudflare.com%2Fen-gb%2Fproducts%2Fturnstile%2F%3Futm_source%3Dturnstile%26utm_campaign%3Dwidget;u4=undefined;u5=undefined;u6=undefined;u7=undefined;u8=undefined;u9=undefined;u10=undefined;u11=undefined;u12=undefined;u13=undefined;u14=undefined;u15=1796770398.1667504172?
IP:	142.251.143.134
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Details

Name:	https://frjn1qu9aj7akf.bioch.ru/cdn-cgi/challenge-platform/h/g/pat/7644ce82bb376922/1667475329324/3b4e8252d3d82181a2c4ddc71259a96c4a752369b3bd03252bd73f618b82ae7d/cIwre8ykeajALTC
IP:	188.114.96.3
TargetID:	1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://484242.484242.piraminds.com/.#.aHR0cDovL0RpZ2lwaG90b2dsb2JhbC5mZXNkeS5wZS9odG1sI2MyRnNhV3d1YzI5dFlXNUFaR2xuYVhCb2IzUnZaMnh2WW1Gc0xtTnZiUT09

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://484242.484242.piraminds.com/.#.aHR0cDovL0RpZ2lwaG90b2dsb2JhbC5mZXNkeS5wZS9odG1sI2MyRnNhV3d1YzI5dFlXNUFaR2xuYVhCb2IzUnZaMnh2WW1Gc0xtTnZiUT09

Processes

URLs

IOC Report
http://484242.484242.piraminds.com/.#.aHR0cDovL0RpZ2lwaG90b2dsb2JhbC5mZXNkeS5wZS9odG1sI2MyRnNhV3d1YzI5dFlXNUFaR2xuYVhCb2IzUnZaMnh2WW1Gc0xtTnZiUT09