Edit tour

Windows Analysis Report
http://r.srvtrck.com/v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d

Overview

General Information

Sample URL:	http://r.srvtrck.com/v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d
Analysis ID:	1548502
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious URL

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

No HTML title found

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1960,i,67862924641324011,8668913507460035504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5868 --field-trial-handle=1960,i,67862924641324011,8668913507460035504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1960,i,67862924641324011,8668913507460035504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://r.srvtrck.com/v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T15:21:49.062342+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.16	49716	TCP
2024-11-04T15:22:26.974949+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.16	50239	TCP

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T15:22:27.371022+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.16	50240	52.22.152.64	443	TCP
2024-11-04T15:22:30.632793+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.16	50267	169.150.255.180	443	TCP
2024-11-04T15:22:31.888169+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.16	50271	169.150.255.180	443	TCP
2024-11-04T15:22:33.148640+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.16	50274	207.211.211.27	443	TCP

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/jsd/r/8dd540be78766b19 HTTP/1.1Host: ritual.comConnection: keep-aliveContent-Length: 15763sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: */*Origin: https://ritual.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://ritual.com/	HTTP Parser: Iframe src: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html#url=https%3A%2F%2Fritual.com%2F&title=Ritual%3A%20The%20Future%20of%20Health%20is%20Clear&referrer=&muid=NA&sid=NA&version=6&preview=false
Source: https://ritual.com/	HTTP Parser: Iframe src: https://js.stripe.com/v3/controller-with-preconnect-b390d41507222c653c84072bcedf9d04.html#apiKey=pk_live_WMeJN8QujSCDgIcJK5E5XENB&stripeJsId=a83465ee-9e06-4a2e-b9ea-8b5ab64c34d6&controllerCount=1&isCheckout=false&stripeJsLoadTime=1730730118008&manualBrowserDeprecationRollout=false&mids[guid]=NA&mids[muid]=NA&mids[sid]=NA&referrer=https%3A%2F%2Fritual.com%2F&controllerId=__privateStripeController8451
Source: https://ritual.com/	HTTP Parser: Iframe src: https://share.ritual.com/public/ritual/affiliate_members/create.html?v=4.0.6&matched_placement_ids%5B%5D=54581&matched_placement_ids%5B%5D=54582&ts=1729773606&ii=ritual-v4
Source: https://ritual.com/	HTTP Parser: Iframe src: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html#url=https%3A%2F%2Fritual.com%2F&title=Ritual%3A%20The%20Future%20of%20Health%20is%20Clear&referrer=&muid=NA&sid=NA&version=6&preview=false
Source: https://ritual.com/	HTTP Parser: Iframe src: https://js.stripe.com/v3/controller-with-preconnect-b390d41507222c653c84072bcedf9d04.html#apiKey=pk_live_WMeJN8QujSCDgIcJK5E5XENB&stripeJsId=a83465ee-9e06-4a2e-b9ea-8b5ab64c34d6&controllerCount=1&isCheckout=false&stripeJsLoadTime=1730730118008&manualBrowserDeprecationRollout=false&mids[guid]=NA&mids[muid]=NA&mids[sid]=NA&referrer=https%3A%2F%2Fritual.com%2F&controllerId=__privateStripeController8451
Source: https://ritual.com/	HTTP Parser: Iframe src: https://share.ritual.com/public/ritual/affiliate_members/create.html?v=4.0.6&matched_placement_ids%5B%5D=54581&matched_placement_ids%5B%5D=54582&ts=1729773606&ii=ritual-v4
Source: https://ritual.com/	HTTP Parser: Iframe src: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html#url=https%3A%2F%2Fritual.com%2F&title=Ritual%3A%20The%20Future%20of%20Health%20is%20Clear&referrer=&muid=NA&sid=NA&version=6&preview=false
Source: https://ritual.com/	HTTP Parser: Iframe src: https://js.stripe.com/v3/controller-with-preconnect-b390d41507222c653c84072bcedf9d04.html#apiKey=pk_live_WMeJN8QujSCDgIcJK5E5XENB&stripeJsId=a83465ee-9e06-4a2e-b9ea-8b5ab64c34d6&controllerCount=1&isCheckout=false&stripeJsLoadTime=1730730118008&manualBrowserDeprecationRollout=false&mids[guid]=NA&mids[muid]=NA&mids[sid]=NA&referrer=https%3A%2F%2Fritual.com%2F&controllerId=__privateStripeController8451
Source: https://ritual.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-0F146ZHSFS&gacid=1555970106.1730730140&gtm=45je4au0v896096102za200&dma=0&gcd=13l3l3l3l2l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101823848~101878899~101878944~101925629&z=1817052602
Source: https://ritual.com/	HTTP Parser: Iframe src: https://js.stripe.com/v3/hcaptcha-invisible-8e6ecc026a43500caf45633dcee144b0.html#debugMode=false&parentOrigin=https%3A%2F%2Fritual.com
Source: https://ritual.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/866253485?random=1730730143315&cv=11&fst=1730730143315&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v881948088za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fritual.com%2F&hn=www.googleadservices.com&frm=0&tiba=Ritual%3A%20The%20Future%20of%20Health%20is%20Clear&npa=0&pscdl=noapi&auid=2093846469.1730730143&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://ritual.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/866253485?random=1730730143347&cv=11&fst=1730730143347&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v881948088za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fritual.com%2F&label=UYNCCNDT8YQZEK31h50D&hn=www.googleadservices.com&frm=0&tiba=Ritual%3A%20The%20Future%20of%20Health%20is%20Clear&npa=0&pscdl=noapi&auid=2093846469.1730730143&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0
Source: https://ritual.com/	HTTP Parser: Iframe src: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html#url=https%3A%2F%2Fritual.com%2F&title=Ritual%3A%20The%20Future%20of%20Health%20is%20Clear&referrer=&muid=NA&sid=NA&version=6&preview=false
Source: https://ritual.com/	HTTP Parser: Iframe src: https://js.stripe.com/v3/controller-with-preconnect-b390d41507222c653c84072bcedf9d04.html#apiKey=pk_live_WMeJN8QujSCDgIcJK5E5XENB&stripeJsId=a83465ee-9e06-4a2e-b9ea-8b5ab64c34d6&controllerCount=1&isCheckout=false&stripeJsLoadTime=1730730118008&manualBrowserDeprecationRollout=false&mids[guid]=NA&mids[muid]=NA&mids[sid]=NA&referrer=https%3A%2F%2Fritual.com%2F&controllerId=__privateStripeController8451
Source: https://ritual.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-0F146ZHSFS&gacid=1555970106.1730730140&gtm=45je4au0v896096102za200&dma=0&gcd=13l3l3l3l2l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101823848~101878899~101878944~101925629&z=1817052602
Source: https://ritual.com/	HTTP Parser: Iframe src: https://js.stripe.com/v3/hcaptcha-invisible-8e6ecc026a43500caf45633dcee144b0.html#debugMode=false&parentOrigin=https%3A%2F%2Fritual.com
Source: https://ritual.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/866253485?random=1730730143315&cv=11&fst=1730730143315&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v881948088za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fritual.com%2F&hn=www.googleadservices.com&frm=0&tiba=Ritual%3A%20The%20Future%20of%20Health%20is%20Clear&npa=0&pscdl=noapi&auid=2093846469.1730730143&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://ritual.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/866253485?random=1730730143347&cv=11&fst=1730730143347&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v881948088za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fritual.com%2F&label=UYNCCNDT8YQZEK31h50D&hn=www.googleadservices.com&frm=0&tiba=Ritual%3A%20The%20Future%20of%20Health%20is%20Clear&npa=0&pscdl=noapi&auid=2093846469.1730730143&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&ec_mode=a&fledge=1&capi=1&data=event%3Dconversion&em=tv.1&ct_cookie_present=0
Source: https://ritual.com/	HTTP Parser: Iframe src: https://www.lightboxcdn.com/lclst/e64fdb6a-9235-4648-be35-c296e6aff92e/ls.html?purl=https%3A%2F%2Fritual.com%2F&vid=e64fdb6a-9235-4648-be35-c296e6aff92e&se=0&prev=0&cb=638658181651610948

Source: https://r.srvtrck.com/v2/go?t=mtcpl%3Au%2Fig%3Dpsodeop9x7l1c7map0pbpbp3zbn4i5%3D77d42c5i%3Dkddpvx3d48011d5a00d317dcfbd8840e4905cd0b760a01050%260_%3Dii3celc%2614079d5e4o4%3F9hd.7lb%2Feo7.6eci%26navert.rlt%2Fas.toh&e=1&ai=45b3ecaa57a34dd6bbfc3122ad70694a&sct=0&ct=1730730106732&cu=0dc10d4f0d884bec9753d0ba6da1185d&cs=ef30f596636bef334c378511342b45f5	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon
Source: https://ritual.com/	HTTP Parser: No favicon

Source: https://ritual.com/	HTTP Parser: No <meta name="author".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="author".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="author".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="author".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="author".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="author".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="author".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="author".. found

Source: https://ritual.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://ritual.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:50239 version: TLS 1.2

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.16:49716
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.16:50239
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.16:50271 -> 169.150.255.180:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.16:50274 -> 207.211.211.27:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.16:50240 -> 52.22.152.64:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.16:50267 -> 169.150.255.180:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_412.1.dr	String found in binary or memory: "https://www.facebook.com/StripeHQ", equals www.facebook.com (Facebook)
Source: chromecache_412.1.dr	String found in binary or memory: "https://www.linkedin.com/company/stripe/", equals www.linkedin.com (Linkedin)
Source: chromecache_537.1.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},rk:function(){e=pb()},zd:function(){d()}}};var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: chromecache_516.1.dr	String found in binary or memory: [{"name":"Amazon S3","creationName":"Amazon S3","description":"Our Amazon S3 copies our log files of your raw API calls from our S3 bucket to yours, where you can then perform custom analysis on them.","website":"http://aws.amazon.com/s3","category":"Analytics"},{"name":"Facebook Pixel","creationName":"Facebook Pixel","description":"The Facebook Pixel integration lets you measure and optimize the performance of your Facebook Ads.","website":"https://developers.facebook.com/docs/facebook-pixel","category":"Advertising"},{"name":"Google Tag Manager","creationName":"Google Tag Manager","description":"Google Tag Manager lets you add or update your website tags, easily and for free.","website":"https://www.google.com/analytics/tag-manager/","category":"Tag Managers"},{"name":"Google Ads (Gtag)","creationName":"Google AdWords New","description":"Advertise on Google and put your message in front of potential customers right when they're searching for what you have to offer.","website":"https://adwords.google.com","category":"Advertising"},{"name":"Visual Tagger","creationName":"Visual Tagger","description":"","website":"https://www.segment.com","category":"Analytics"},{"name":"Indicative","creationName":"Indicative","description":"Indicative is a behavioral analytics platform designed to help Marketing and Product teams optimize user engagement, conversion, and retention. It's easy to setup and easy to use equals www.facebook.com (Facebook)
Source: chromecache_521.1.dr	String found in binary or memory: [{"name":"Facebook Pixel","creationName":"Facebook Pixel","description":"The Facebook Pixel integration lets you measure and optimize the performance of your Facebook Ads.","website":"https://developers.facebook.com/docs/facebook-pixel","category":"Advertising"},{"name":"Google Tag Manager","creationName":"Google Tag Manager","description":"Google Tag Manager lets you add or update your website tags, easily and for free.","website":"https://www.google.com/analytics/tag-manager/","category":"Tag Managers"},{"name":"Indicative","creationName":"Indicative","description":"Indicative is a behavioral analytics platform designed to help Marketing and Product teams optimize user engagement, conversion, and retention. It's easy to setup and easy to use equals www.facebook.com (Facebook)
Source: chromecache_521.1.dr	String found in binary or memory: and offers analysts a single view of customer behavior across all digital touchpoints. Get started by creating an account.","website":"https://app.indicative.com/?utm_source=segment&utm_medium=partners&utm_campaign=integrations-page#/login/register","category":"Analytics"},{"name":"Amazon S3","creationName":"Amazon S3","description":"Our Amazon S3 copies our log files of your raw API calls from our S3 bucket to yours, where you can then perform custom analysis on them.","website":"http://aws.amazon.com/s3","category":"Analytics"},{"name":"Fullstory (Actions)","creationName":"Fullstory","description":"FullStory lets product and support teams easily understand everything about the customer experience.","website":"http://www.fullstory.com","category":"Analytics"},{"name":"TikTok Conversions","creationName":"Tiktok Conversions","description":"When you have Segment installed, you can make efficient use of your existing tracking implementation by using Segment to fulfill your data collection needs across all your tools that integrate with Segment, including TikTok Ads. Segment reports events directly to TikTok, powering TikTok solutions like dynamic product ads, custom targeting, campaign optimization and attribution.","website":"https://ads.tiktok.com/marketing_api/docs?id=1701890979375106","category":"Advertising"},{"name":"Impact Partnership Cloud","creationName":"Impact Partnership Cloud","description":"Impact integrates with Segment through a robust and scalable API connection. Once connected, seamlessly track and credit your partners for any Segment event within Impact.","website":"https://impact.com","category":"Attribution"},{"name":"Facebook Conversions API (Actions)","creationName":"Facebook Conversions API (Actions)","description":"Facebook Conversions API (Actions) enables advertisers to send events from their servers directly to Facebook. Server-side events are linked to Facebook Pixel events and processed like browser pixel events. This means that server-side events are used in measurement, reporting, and optimization in the same way as browser pixel events. When you have Segment installed, you can make efficient use of your existing tracking implementation by using Segment to fulfill your data collection needs across all your tools that integrate with Segment, including Facebook Conversions API.","website":"https://www.facebook.com/business/help/2041148702652965","category":"Advertising"},{"name":"Intercom Web (Actions)","creationName":"Intercom Web (Actions)","description":"Intercom is one place for every team in an internet business to communicate with customers, personally, at scale - on your website, inside web and mobile apps, and by email. When you have Segment installed, you can make efficient use of your existing tracking implementation by using Segment to fulfill your data collection needs across all your tools that integrate with Segment, including Intercom.","website":"http://www.intercom.com","category":"Customer Success"},{"
Source: chromecache_328.1.dr	String found in binary or memory: and offers analysts a single view of customer behavior across all digital touchpoints. Get started by creating an account.","website":"https://app.indicative.com/?utm_source=segment&utm_medium=partners&utm_campaign=integrations-page#/login/register","category":"Analytics"},{"name":"Google Ads (Gtag)","creationName":"Google AdWords New","description":"Advertise on Google and put your message in front of potential customers right when they're searching for what you have to offer.","website":"https://adwords.google.com","category":"Advertising"},{"name":"Amazon S3","creationName":"Amazon S3","description":"Our Amazon S3 copies our log files of your raw API calls from our S3 bucket to yours, where you can then perform custom analysis on them.","website":"http://aws.amazon.com/s3","category":"Analytics"},{"name":"Fullstory (Actions)","creationName":"Fullstory","description":"FullStory lets product and support teams easily understand everything about the customer experience.","website":"http://www.fullstory.com","category":"Analytics"},{"name":"TikTok Conversions","creationName":"Tiktok Conversions","description":"When you have Segment installed, you can make efficient use of your existing tracking implementation by using Segment to fulfill your data collection needs across all your tools that integrate with Segment, including TikTok Ads. Segment reports events directly to TikTok, powering TikTok solutions like dynamic product ads, custom targeting, campaign optimization and attribution.","website":"https://ads.tiktok.com/marketing_api/docs?id=1701890979375106","category":"Advertising"},{"name":"Impact Partnership Cloud","creationName":"Impact Partnership Cloud","description":"Impact integrates with Segment through a robust and scalable API connection. Once connected, seamlessly track and credit your partners for any Segment event within Impact.","website":"https://impact.com","category":"Attribution"},{"name":"Facebook Conversions API (Actions)","creationName":"Facebook Conversions API (Actions)","description":"Facebook Conversions API (Actions) enables advertisers to send events from their servers directly to Facebook. Server-side events are linked to Facebook Pixel events and processed like browser pixel events. This means that server-side events are used in measurement, reporting, and optimization in the same way as browser pixel events. When you have Segment installed, you can make efficient use of your existing tracking implementation by using Segment to fulfill your data collection needs across all your tools that integrate with Segment, including Facebook Conversions API.","website":"https://www.facebook.com/business/help/2041148702652965","category":"Advertising"},{"name":"Intercom Web (Actions)","creationName":"Intercom Web (Actions)","description":"Intercom is one place for every team in an internet business to communicate with customers, personally, at scale - on your website, inside web and mobile apps, and by email. When you have Segment
Source: chromecache_537.1.dr, chromecache_603.1.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=UA(a,c,e);S(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return S(122),!0;if(d&&f){for(var m=Ab(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},XA=function(){var a=[],b=function(c){return db(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_537.1.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Ah:e,yh:f,zh:g,ii:k,ji:m,Qe:n,Ib:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};G(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(yD(w,"iframe_api")\|\|yD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!pD&&wD(x[A],p.Qe))return oc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_653.1.dr, chromecache_603.1.dr	String found in binary or memory: return b}lD.F="internal.enableAutoEventOnTimer";var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: chromecache_690.1.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_690.1.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_690.1.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/",TOPICS_API_ENDPOINT:"https://www.facebook.com/privacy_sandbox/topics/registration/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_328.1.dr	String found in binary or memory: s new Analytics property, which you can use for both websites and apps. Google Analytics 4 has machine learning at its core to automatically surface helpful insights and give you a complete understanding of your customers across devices and platforms. When you have Segment installed, you can make efficient use of your existing tracking implementation by using Segment to fulfill your data collection needs across all your tools that integrate with Segment, including Google Analytics 4. The Google Analytics 4 Web destination works on the client by loading gtag.js for you.","website":"https://support.google.com/analytics/answer/10089681","category":"Analytics"},{"name":"Pinterest Conversions API","creationName":"Pinterest Conversions API","description":"The Pinterest API for Conversions enables advertisers to send conversions directly to Pinterest via a server-to-server method without requiring a Pinterest Tag. These conversions are mapped to Pinterest campaigns for conversion reporting to improve conversion visibility. The API for Conversions can help Pinterest in continuing to provide a more comprehensive view of your campaign performance. By leveraging Pinterest Conversions API with Segment, you can use Segment to integrate with Pinterest without additional implementation and development work.","website":"http://www.segment.com","category":"Advertising"},{"name":"Iterable (Actions)","creationName":"Iterable (Actions)","description":"Iterable is the AI-powered cross-channel communication platform helping to orchestrate individualized, harmonized, and dynamic customer experiences by closing the activation gap.","website":"http://www.iterable.com","category":"Email Marketing"},{"name":"LaunchDarkly (Actions)","creationName":"LaunchDarkly","description":"LaunchDarkly is a feature management platform that empowers development teams to safely deliver, control and measure their software through feature flags. With LaunchDarkly, you can run experiments on any feature flag. This destination allows you to connect existing Segment events to LaunchDarkly custom metrics for use in LaunchDarkly experiments.","website":"https://launchdarkly.com","category":"Feature Flagging"},{"name":"Google Ads Conversions","creationName":"Google Enhanced Conversions","description":"The Google Ads destination allows users to upload conversions, conversion adjustments, and customer match lists in a privacy-safe manner. Marketers can leverage this integration to re-engage users across Search, Shopping, Gmail, YouTube, and Display by combining conversion data with customer match lists for more effective targeting.","website":"https://developers.google.com/google-ads/api/docs/conversions/overview","category":"Advertising"},{"name":"Iterable Channel Opt-Out (Ritual)","creationName":"Iterable Marketing Opt-Out (Ritual)","description":"Removes users from Iterable channels when opt-out is selected","website":"https://www.segment.com","category":"Other"}] equals www.youtube.com (Youtube
Source: chromecache_537.1.dr, chromecache_603.1.dr	String found in binary or memory: var AC=function(a,b,c,d,e){var f=rA("fsl",c?"nv.mwt":"mwt",0),g;g=c?rA("fsl","nv.ids",[]):rA("fsl","ids",[]);if(!g.length)return!0;var k=wA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);S(121);if(m==="https://www.facebook.com/tr/")return S(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!dz(k,fz(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: r.srvtrck.com
Source: global traffic	DNS traffic detected: DNS query: lg.provenpixel.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lg-crl.provenpixel.com
Source: global traffic	DNS traffic detected: DNS query: sd-73-0.914trk.com
Source: global traffic	DNS traffic detected: DNS query: ritual.com
Source: global traffic	DNS traffic detected: DNS query: images.ctfassets.net
Source: global traffic	DNS traffic detected: DNS query: fonts.ritual.com
Source: global traffic	DNS traffic detected: DNS query: analytics.seg.ritual.com
Source: global traffic	DNS traffic detected: DNS query: api.seg.ritual.com
Source: global traffic	DNS traffic detected: DNS query: image.mux.com
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: cdn.userway.org
Source: global traffic	DNS traffic detected: DNS query: d2jjzw81hqbuqv.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: cdn.speedcurve.com
Source: global traffic	DNS traffic detected: DNS query: js.stripe.com
Source: global traffic	DNS traffic detected: DNS query: app.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: events.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: api.userway.org
Source: global traffic	DNS traffic detected: DNS query: sessions.bugsnag.com
Source: global traffic	DNS traffic detected: DNS query: api.ritual.com
Source: global traffic	DNS traffic detected: DNS query: share.ritual.com
Source: global traffic	DNS traffic detected: DNS query: otlp.bugsnag.com
Source: global traffic	DNS traffic detected: DNS query: api.stripe.com
Source: global traffic	DNS traffic detected: DNS query: m.stripe.network
Source: global traffic	DNS traffic detected: DNS query: stream.mux.com
Source: global traffic	DNS traffic detected: DNS query: cdn77.api.userway.org
Source: global traffic	DNS traffic detected: DNS query: merchant-ui-api.stripe.com
Source: global traffic	DNS traffic detected: DNS query: manifest-gcp-us-east4-vop1.cfcdn.mux.com
Source: global traffic	DNS traffic detected: DNS query: manifest-gcp-us-east1-vop1.cfcdn.mux.com
Source: global traffic	DNS traffic detected: DNS query: assets.ritual.com
Source: global traffic	DNS traffic detected: DNS query: chunk-gcp-us-east4-vop1.fastly.mux.com
Source: global traffic	DNS traffic detected: DNS query: chunk-gcp-us-east1-vop1.fastly.mux.com
Source: global traffic	DNS traffic detected: DNS query: r.stripe.com
Source: global traffic	DNS traffic detected: DNS query: m.stripe.com
Source: global traffic	DNS traffic detected: DNS query: inferred.litix.io
Source: global traffic	DNS traffic detected: DNS query: b.stripecdn.com
Source: global traffic	DNS traffic detected: DNS query: hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: stripe.com
Source: global traffic	DNS traffic detected: DNS query: newassets.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: api.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: api2.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: dx.ritual.com
Source: global traffic	DNS traffic detected: DNS query: widget.intercom.io
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: js.intercomcdn.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: s.pinimg.com
Source: global traffic	DNS traffic detected: DNS query: api-iam.intercom.io
Source: global traffic	DNS traffic detected: DNS query: nexus-websocket-a.intercom.io
Source: global traffic	DNS traffic detected: DNS query: ct.pinterest.com
Source: global traffic	DNS traffic detected: DNS query: js.go2sdk.com
Source: global traffic	DNS traffic detected: DNS query: analytics.tiktok.com
Source: global traffic	DNS traffic detected: DNS query: s.axon.ai
Source: global traffic	DNS traffic detected: DNS query: c.albss.com
Source: global traffic	DNS traffic detected: DNS query: d34r8q7sht0t9k.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: listen.audiohook.com
Source: global traffic	DNS traffic detected: DNS query: tvspix.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.lightboxcdn.com
Source: global traffic	DNS traffic detected: DNS query: b.applovin.com
Source: global traffic	DNS traffic detected: DNS query: ipv4.podscribe.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: verifi.podscribe.com
Source: global traffic	DNS traffic detected: DNS query: api.lightboxcdn.com
Source: global traffic	DNS traffic detected: DNS query: s3.lightboxcdn.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Nov 2024 14:22:07 GMTContent-Length: 10Content-Type: text/plain; charset=utf-8Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 04 Nov 2024 14:22:10 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 04 Nov 2024 14:22:11 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 04 Nov 2024 14:22:12 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 04 Nov 2024 14:22:14 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 04 Nov 2024 14:22:15 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 04 Nov 2024 14:22:23 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1960,i,67862924641324011,8668913507460035504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://r.srvtrck.com/v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5868 --field-trial-handle=1960,i,67862924641324011,8668913507460035504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1960,i,67862924641324011,8668913507460035504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1960,i,67862924641324011,8668913507460035504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5868 --field-trial-handle=1960,i,67862924641324011,8668913507460035504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1960,i,67862924641324011,8668913507460035504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Email	JoeBoxAI: AI detected Typosquatting in URL: URL: http://r.srvtrck.com
Source: Email	JoeBoxAI: AI detected Typosquatting in URL: URL: https://r.srvtrck.com

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://images.ctfassets.net/uuc5ok478nyh/1KmGsetehOWMRIcaSRRhnp/f478bb64d7e2b5f806eadddafc1bec11/PL	0%	Avira URL Cloud	safe
https://downloads.ctfassets.net/uuc5ok478nyh/GARNqFnwWAGC6UNJQRmMw/9c342e6570fd1bf6b01239dd01d751f6/	0%	Avira URL Cloud	safe
https://api.seg.ritual.com/v1/t	0%	Avira URL Cloud	safe
https://www.lightboxcdn.com/z9g/digibox.gif?c=1730730159959&h=ritual.com&e=i&u=44964&b=280219&v=empty&s=empty	0%	Avira URL Cloud	safe
https://newassets.hcaptcha.com/captcha/v1/05c78a4/static/hcaptcha.html	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/cP1ElWa9rxbfKFxwmxyUj/75e20cf202f982af99a92d58bbd03a0a/17_	0%	Avira URL Cloud	safe
https://ritual.com/component---src-templates-routes-cart-js-6d883228096a9ee29a19.js	0%	Avira URL Cloud	safe
http://store.bitstream.com0	0%	Avira URL Cloud	safe
https://analytics.seg.ritual.com/next-integrations/integrations/facebook-pixel/2.11.5/facebook-pixel.dynamic.js.gz	0%	Avira URL Cloud	safe
https://api.seg.ritual.com/v1/p	0%	Avira URL Cloud	safe
https://ritual.com/cdn-cgi/rum?	0%	Avira URL Cloud	safe
https://api.seg.ritual.com/v1/i	0%	Avira URL Cloud	safe
https://api.seg.ritual.com/v1/m	0%	Avira URL Cloud	safe
https://s3.lightboxcdn.com/vendors/e64fdb6a-9235-4648-be35-c296e6aff92e/uploads/fc39c61f-6b6f-44eb-a0c9-ea0540c611e5/CircularXXRegular.otf	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/4g8NqG2vqFyi9dFMu6WnXk/cc6fba5a78649de2e26d9e33f173bb8a/Category-GutHealth-v2.jpg?w=580&h=359&q=90&fm=webp	0%	Avira URL Cloud	safe
https://assets.ritual.com/icons/close.svg	0%	Avira URL Cloud	safe
https://analytics.seg.ritual.com/analytics-next/bundles/schemaFilter.bundle.5c2661f67b4b71a6d9bd.js	0%	Avira URL Cloud	safe
https://analytics.seg.ritual.com/v1/projects/i7w0QiJzs86wBaM1h1xDI26GELQtgKGi/integrations	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/1urffiHYVSYPWjm4pDjAqU/bd7a46bd63595f7abdfb0881f4511634/PL	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/2Qp9vFD5KmoemJ1BzKyftw/dc287b7ba27d8b1d454d47e1d3973e69/PL	0%	Avira URL Cloud	safe
https://www.lightboxcdn.com/vendor/e64fdb6a-9235-4648-be35-c296e6aff92e/custom_box.js?cb=3CC54B8C6E977C7BE53D31EF0466F2B5	0%	Avira URL Cloud	safe
https://analytics.seg.ritual.com/v1/projects/jBKkKOGmXz9UdedZorYIp3eZemJ18P5f/integrations	0%	Avira URL Cloud	safe
https://connect.facebook.net/signals/config/558603544300321?v=2.9.176&r=stable&domain=ritual.com&hme=872f04a0547459b3285cb03b0d7a47bfde40628f4b386809918a621e2688602f&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/3kI6hM2ENDLW2OQuXhnVPx/af8b62db6d1061d0a010f06b2f2b29d7/PL	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/2RQ7pdzdW9JmLk0z0shhzM/cb2bdddeb740841de6153bea9e1b7d0f/Ca	0%	Avira URL Cloud	safe
https://api.ritual.com/api/v1/promotions/best_eligible?store_id=a749a39a-d8cd-4721-bdd1-5c776c753ba0	0%	Avira URL Cloud	safe
https://sd-73-0.914trk.com/trk/?sd5d8444577762f9&sig=4cd456.smfjwo&u=https%3A%2F%2Fritual.com	100%	Avira URL Cloud	malware
https://cdn.userway.org/widgetapp/2024-11-01-10-09-24/remediation/remediation_1730455764190.js	0%	Avira URL Cloud	safe
https://verifi.podscribe.com/tag?	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/5xGdLlaelAH2jPMWL91feW/259608c6704d0b1f3de9f959221b909c/site3_bellies.png?w=270&h=270&q=90&fm=webp	0%	Avira URL Cloud	safe
https://analytics.seg.ritual.com/v1/projects/ggPRI3y1YeiyKA4HFVpyVs0bpXAvpCPT/integrations	0%	Avira URL Cloud	safe
https://www.lightboxcdn.com/vendor/e64fdb6a-9235-4648-be35-c296e6aff92e/lightbox.js?mb=1730730143784	0%	Avira URL Cloud	safe
https://ritual.com/9559-628b9201f255cd3ad3b4.js	0%	Avira URL Cloud	safe
https://ritual.com/manifest.webmanifest	0%	Avira URL Cloud	safe
https://s3.lightboxcdn.com/vendors/e64fdb6a-9235-4648-be35-c296e6aff92e/uploads/6af93166-ee86-4a67-8c48-87a1e57de38b/close.svg	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/1b2qQNygGSU4NwwAOj36oi/408f397e388fbe9dc6ce78073a49e594/Category-Pregnancy.jpg?w=580&h=359&q=90&fm=webp	0%	Avira URL Cloud	safe
https://listen.audiohook.com/e4ab32e0-db93-49db-a2e3-4123c8014261/pixel.png?type=pageview%22	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie#write_a_new_cookie)	0%	Avira URL Cloud	safe
https://ritual.com/page-data/shop/gut-health/page-data.json	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/6CoW7odXqbDS4XTmiVwUU1/f10b505d28f74dcb392f848687a3c44a/PL	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/5IJgw8ESQ2UCUbntMHocnJ/8cd5b601be61174ac89d3284f67469ef/02	0%	Avira URL Cloud	safe
https://ritual.com/7272-25d36155c96f66479902.js	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/25thPmEh7GFgBId98TtFu0/28ae83473a3f2fb2e7b1a2626c187538/Tested.svg	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/4llXYVdlo5BogadisVOPiQ/c2a91203d759c07df7a58f826128a9c9/Non-GMO.svg	0%	Avira URL Cloud	safe
https://analytics.seg.ritual.com/next-integrations/integrations/google-tag-manager/2.5.1/google-tag-manager.dynamic.js.gz	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/3EGL5bIq8ktatPLoOC3R0C/530f5f258289cd5b8ec48c68d6c19f2a/PL	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/31156kSvGUxVMatB7GjBb0/4c00f4f864e5409fb80761768e2a4f76/PL	0%	Avira URL Cloud	safe
https://impact.ritual.com/2023.pdf	0%	Avira URL Cloud	safe
https://app.indicative.com/?utm_source=segment&utm_medium=partners&utm_campaign=integrations-page#/l	0%	Avira URL Cloud	safe
https://cdn77.api.userway.org/api/img-dscr/v2/g3PUExEDwi/1365413/ViataKRasiDwmM1f/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F25thPmEh7GFgBId98TtFu0%2F28ae83473a3f2fb2e7b1a2626c187538%2FTested.svg%22%2C%22alt%22%3A%22Tested.svg%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F2Ot38DL6ci6tHcThKsX02J%2F5156c2799699635df5ed8318a67199f6%2FTraceable.svg%22%2C%22alt%22%3A%22Traceable.svg%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F3b2rDAxg4SGASVbyiHYA4J%2Fe1d474b1648af04c1130bc67502e7d2a%2Fhome-feat-dyson.jpg%22%2C%22alt%22%3A%22pill%20image%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F3Bt84vIv74GcnJ34cqoPYi%2F0e3739c22ea2d22dc49e375599c07dae%2FHome-Feat-03.jpg%22%2C%22alt%22%3A%22Ritual%20Essential%20for%20Women%20bottle%20shown%20in%20a%20yellow%20staged%20background%20with%20mint%20leaves%20and%20other%20props%20scatted%20around%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F3JHmTV1dNv2RkROoGdgp2H%2F64766a5445928cf2114cf24dcedd5e09%2FPLP-Product-Tile-SYN.jpg%22%2C%22alt%22%3A%22Ritual%20Synbiotic%2B%20capsule%20on%20a%20yellow%20background%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F4llXYVdlo5BogadisVOPiQ%2Fc2a91203d759c07df7a58f826128a9c9%2FNon-GMO.svg%22%2C%22alt%22%3A%22Non-GMO.svg%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F4omFL520uv8cAkSPuiF0tz%2F8392a7f6e92dec5c4baac78040cb57c7%2Fsite1_FS.png%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F5GmVfeAI5f3zIL55YAFSdL%2F38284494321bcfbcbc8ebf663ddcabbc%2Fsite4_multieye.png%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F5O43D7OyK4CaCcQaaCsCAe%2F83c4d9f65ddef3e8ed950929e19267fc%2FHome-Map.jpg%22%2C%22alt%22%3A%22Map%20of%20our%20Ingredient%20locations%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F5xGdLlaelAH2jPMWL91feW%2F259608c6704d0b1f3de9f959221b909c%2Fsite3_bellies.png%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F6nefvLCF2DL37PzZyLhmBF%2Fd1380e7a82c3f064880e6c50a4ba42c0%2FPLP-Product-Tile-SKN.jpg%22%2C%22alt%22%3A%22Ritual%20HyaCera%E2%84%A2%20capsule%20on%20a%20yellow%20background%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F6rgXBe3c8mtYSyUd3iXgAh%2Fbb629a125d2dfb6a2a6ee33093bfbe69%2Fsite2_prepostbathroom.png%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F6tq5Ig8BP3vc3sUf2j7sds%2Fe000bd861426e04161fa3ff1ca9e4c07%2FVegan.svg%22%2C%22alt%22%3A%22Vegan.svg%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F7E0v6tTHHB2sOtaU0d5b5h%2F8b6730a50d031dd69e98c6f1c7a7d72d%2FPLP-Product-Tile-EFW18.jpg%22%2C%22alt%22%3A%22Ritual%20Essential%20for%20Women%2018%2B%20capsule%20on%20a%20yellow%20background%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F7uD7RugE7muUndiqsGrhU9%2F52b3c026918e7f2b664f09f253ccdfa4%2FPLP-Product-Tile-EPRE.jpg%22%2C%22alt%22%3A%22Ritual%20Essential%20Prenatal%20capsule%20on%20a%20yellow%20background%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%2C%22pageUrl%22%3A%22https%3A%2F%2Fritual.com%2F%22%7D	0%	Avira URL Cloud	safe
https://s3.lightboxcdn.com/vendors/e64fdb6a-9235-4648-be35-c296e6aff92e/uploads/4122ccad-e184-47f1-a59d-82ee3bff6a1e/Dutch801BTItalic.ttf	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/5ItSwjfsgltFoKPGklkd6u/b8d2d9aac2f95ddadaadf041dac5b75e/Ca	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/36RNzTePP3uBBdkntwCxcz/4d7e99ab726bf06de9dc0454205dd3c2/PL	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/1A3fh5Uccwr9wQwNuM0t9I/d50dc46878cf5926ae10d2165fd346f8/PL	0%	Avira URL Cloud	safe
https://b.stripecdn.com/mkt-statics-srv/assets/Bootstrapper-U3EHIUXL.js	0%	Avira URL Cloud	safe
https://ritual.com/6669-c707ce9b4aeff7fad543.js	0%	Avira URL Cloud	safe
https://js.stripe.com/v3/fingerprinted/js/shared-95669596883100744ea338bd2ff11e88.js	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/5gzUZU9blkkrieLpks4fIH/ccd4a34bf00d655aa02c6d8ac3373375/Ca	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/yhd8uj13NxMah99kpKCWT/4366c2dab597aaab9c5d36b46234a1d9/Mad	0%	Avira URL Cloud	safe
https://images.ctfassets.net/uuc5ok478nyh/5wu6CW8R3k3YajkEgkuMOl/01937d107e55f40ba4637ecb6eb6f36d/Ca	0%	Avira URL Cloud	safe
https://ritual.com/favicon-32x32.png?v=d671b4e146ec8ffe45ad3fd9a6fdfc53	0%	Avira URL Cloud	safe
https://js.intercomcdn.com/vendor.6349e54f.js	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
1784939676.rsc.cdn77.org	169.150.255.180	true	false	unknown
fonts.ritual.com	104.18.20.119	true	false	unknown
api.userway.org	35.83.101.170	true	false	high
stats.g.doubleclick.net	66.102.1.154	true	false	high
api.seg.ritual.com	34.208.52.2	true	false	high
analytics.seg.ritual.com	13.32.145.78	true	false	high
s3.lightboxcdn.com	104.17.159.113	true	false	high
stripe.com	52.30.58.64	true	false	high
www.google.com	142.250.185.196	true	false	high
api2.hcaptcha.com	104.19.229.21	true	false	high
js.intercomcdn.com	18.245.46.55	true	false	high
star-mini.c10r.facebook.com	157.240.0.35	true	false	unknown
ritual.com	104.18.20.119	true	false	high
c.albss.com	34.144.212.59	true	false	high
sessions.bugsnag.com	35.190.88.7	true	false	unknown
api-iam.intercom.io	54.227.163.11	true	false	high
events-router-v8tt.zeet-audiohook-gcp-us-east.zeet.app	34.145.223.123	true	false	unknown
stripecdn.map.fastly.net	151.101.0.176	true	false	unknown
www.lightboxcdn.com	104.17.159.113	true	false	high
analytics-alv.google.com	216.239.38.181	true	false	unknown
prod.pinterest.global.map.fastly.net	151.101.128.84	true	false	unknown
d2jjzw81hqbuqv.cloudfront.net	52.222.214.21	true	false	high
googleads.g.doubleclick.net	216.58.206.34	true	false	high
m.stripe.com	52.89.219.222	true	false	high
b.applovin.com	35.241.1.16	true	false	unknown
dualstack.pinterest.map.fastly.net	151.101.0.84	true	false	unknown
sd-73-0.914trk.com	18.205.42.100	true	false	unknown
td.doubleclick.net	142.250.186.162	true	false	high
merchant-ui-api.stripe.com	54.194.97.239	true	false	high
d3orhvfyxudxxq.cloudfront.net	13.33.187.102	true	false	unknown
d1tcqh4bio8cty.cloudfront.net	18.173.205.62	true	false	unknown
s.axon.ai	34.54.197.252	true	false	high
1667503734.rsc.cdn77.org	195.181.170.19	true	false	unknown
static.cloudflareinsights.com	104.16.80.73	true	false	high
a9ddfb5d6fc6a446a947425297392b95-984a61f2738dc6d3.elb.us-east-1.amazonaws.com	52.22.110.116	true	false	unknown
d34r8q7sht0t9k.cloudfront.net	18.244.20.77	true	false	high
events.launchdarkly.com	18.211.63.6	true	false	unknown
r.srvtrck.com	54.154.136.171	true	false	high
assets.ritual.com	104.18.20.119	true	false	high
scontent.xx.fbcdn.net	157.240.252.13	true	false	unknown
nexus-websocket-a.intercom.io	35.174.127.31	true	false	high
ipv4.podscribe.com	52.21.35.3	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
lg.provenpixel.com	34.192.219.139	true	false	unknown
api.hcaptcha.com	104.19.229.21	true	false	high
ax-0001.ax-dc-msedge.net	150.171.29.10	true	false	unknown
widget.intercom.io	13.224.189.35	true	false	high
api.ritual.com	104.18.20.119	true	false	high
js.go2sdk.com	18.66.102.5	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	unknown
r.stripe.com	54.186.23.98	true	false	high
tvspix.com	52.24.25.70	true	false	high
dx.ritual.com	34.111.8.208	true	false	high
hcaptcha.com	104.19.230.21	true	false	high
share.ritual.com	107.21.52.67	true	false	unknown
verifi.podscribe.com	52.22.152.64	true	false	high
newassets.hcaptcha.com	104.19.229.21	true	false	high
otlp.bugsnag.com	34.149.94.206	true	false	high
api.stripe.com	34.241.54.72	true	false	high
b.stripecdn.com	unknown	unknown	false	high
chunk-gcp-us-east4-vop1.fastly.mux.com	unknown	unknown	false	unknown
listen.audiohook.com	unknown	unknown	false	high
images.ctfassets.net	unknown	unknown	false	high
manifest-gcp-us-east4-vop1.cfcdn.mux.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
api.lightboxcdn.com	unknown	unknown	false	high
cdn.userway.org	unknown	unknown	false	high
manifest-gcp-us-east1-vop1.cfcdn.mux.com	unknown	unknown	false	unknown
image.mux.com	unknown	unknown	false	high
js.stripe.com	unknown	unknown	false	high
cdn.speedcurve.com	unknown	unknown	false	high
m.stripe.network	unknown	unknown	false	high
ct.pinterest.com	unknown	unknown	false	high
cdn77.api.userway.org	unknown	unknown	false	high
stream.mux.com	unknown	unknown	false	high
inferred.litix.io	unknown	unknown	false	high
lg-crl.provenpixel.com	unknown	unknown	false	unknown
www.facebook.com	unknown	unknown	false	high
app.launchdarkly.com	unknown	unknown	false	high
chunk-gcp-us-east1-vop1.fastly.mux.com	unknown	unknown	false	high
s.pinimg.com	unknown	unknown	false	high
analytics.google.com	unknown	unknown	false	unknown
analytics.tiktok.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://newassets.hcaptcha.com/captcha/v1/05c78a4/static/hcaptcha.html	false	Avira URL Cloud: safe	unknown
https://analytics.seg.ritual.com/next-integrations/integrations/facebook-pixel/2.11.5/facebook-pixel.dynamic.js.gz	false	Avira URL Cloud: safe	unknown
https://api.seg.ritual.com/v1/p	false	Avira URL Cloud: safe	unknown
https://ritual.com/component---src-templates-routes-cart-js-6d883228096a9ee29a19.js	false	Avira URL Cloud: safe	unknown
https://www.lightboxcdn.com/z9g/digibox.gif?c=1730730159959&h=ritual.com&e=i&u=44964&b=280219&v=empty&s=empty	false	Avira URL Cloud: safe	unknown
https://api.seg.ritual.com/v1/t	false	Avira URL Cloud: safe	unknown
https://ritual.com/cdn-cgi/rum?	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/4g8NqG2vqFyi9dFMu6WnXk/cc6fba5a78649de2e26d9e33f173bb8a/Category-GutHealth-v2.jpg?w=580&h=359&q=90&fm=webp	false	Avira URL Cloud: safe	unknown
https://api.seg.ritual.com/v1/i	false	Avira URL Cloud: safe	unknown
https://s3.lightboxcdn.com/vendors/e64fdb6a-9235-4648-be35-c296e6aff92e/uploads/fc39c61f-6b6f-44eb-a0c9-ea0540c611e5/CircularXXRegular.otf	false	Avira URL Cloud: safe	unknown
https://assets.ritual.com/icons/close.svg	false	Avira URL Cloud: safe	unknown
https://api.seg.ritual.com/v1/m	false	Avira URL Cloud: safe	unknown
https://analytics.seg.ritual.com/analytics-next/bundles/schemaFilter.bundle.5c2661f67b4b71a6d9bd.js	false	Avira URL Cloud: safe	unknown
https://analytics.seg.ritual.com/v1/projects/i7w0QiJzs86wBaM1h1xDI26GELQtgKGi/integrations	false	Avira URL Cloud: safe	unknown
https://www.lightboxcdn.com/vendor/e64fdb6a-9235-4648-be35-c296e6aff92e/custom_box.js?cb=3CC54B8C6E977C7BE53D31EF0466F2B5	false	Avira URL Cloud: safe	unknown
https://analytics.seg.ritual.com/v1/projects/jBKkKOGmXz9UdedZorYIp3eZemJ18P5f/integrations	false	Avira URL Cloud: safe	unknown
https://connect.facebook.net/signals/config/558603544300321?v=2.9.176&r=stable&domain=ritual.com&hme=872f04a0547459b3285cb03b0d7a47bfde40628f4b386809918a621e2688602f&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113	false	Avira URL Cloud: safe	unknown
https://cdn.userway.org/widgetapp/2024-11-01-10-09-24/remediation/remediation_1730455764190.js	false	Avira URL Cloud: safe	unknown
https://sd-73-0.914trk.com/trk/?sd5d8444577762f9&sig=4cd456.smfjwo&u=https%3A%2F%2Fritual.com	false	Avira URL Cloud: malware	unknown
https://r.srvtrck.com/v2/go?t=mtcpl%3Au%2Fig%3Dpsodeop9x7l1c7map0pbpbp3zbn4i5%3D77d42c5i%3Dkddpvx3d48011d5a00d317dcfbd8840e4905cd0b760a01050%260_%3Dii3celc%2614079d5e4o4%3F9hd.7lb%2Feo7.6eci%26navert.rlt%2Fas.toh&e=1&ai=45b3ecaa57a34dd6bbfc3122ad70694a&sct=0&ct=1730730106732&cu=0dc10d4f0d884bec9753d0ba6da1185d&cs=ef30f596636bef334c378511342b45f5	false		unknown
https://api.ritual.com/api/v1/promotions/best_eligible?store_id=a749a39a-d8cd-4721-bdd1-5c776c753ba0	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/5xGdLlaelAH2jPMWL91feW/259608c6704d0b1f3de9f959221b909c/site3_bellies.png?w=270&h=270&q=90&fm=webp	false	Avira URL Cloud: safe	unknown
https://www.lightboxcdn.com/vendor/e64fdb6a-9235-4648-be35-c296e6aff92e/lightbox.js?mb=1730730143784	false	Avira URL Cloud: safe	unknown
https://analytics.seg.ritual.com/v1/projects/ggPRI3y1YeiyKA4HFVpyVs0bpXAvpCPT/integrations	false	Avira URL Cloud: safe	unknown
https://ritual.com/9559-628b9201f255cd3ad3b4.js	false	Avira URL Cloud: safe	unknown
https://ritual.com/manifest.webmanifest	false	Avira URL Cloud: safe	unknown
https://s3.lightboxcdn.com/vendors/e64fdb6a-9235-4648-be35-c296e6aff92e/uploads/6af93166-ee86-4a67-8c48-87a1e57de38b/close.svg	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/1b2qQNygGSU4NwwAOj36oi/408f397e388fbe9dc6ce78073a49e594/Category-Pregnancy.jpg?w=580&h=359&q=90&fm=webp	false	Avira URL Cloud: safe	unknown
https://ritual.com/page-data/shop/gut-health/page-data.json	false	Avira URL Cloud: safe	unknown
https://listen.audiohook.com/e4ab32e0-db93-49db-a2e3-4123c8014261/pixel.png?type=pageview%22	false	Avira URL Cloud: safe	unknown
https://api-iam.intercom.io/messenger/web/ping	false		high
https://ritual.com/7272-25d36155c96f66479902.js	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/25thPmEh7GFgBId98TtFu0/28ae83473a3f2fb2e7b1a2626c187538/Tested.svg	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/4llXYVdlo5BogadisVOPiQ/c2a91203d759c07df7a58f826128a9c9/Non-GMO.svg	false	Avira URL Cloud: safe	unknown
https://analytics.seg.ritual.com/next-integrations/integrations/google-tag-manager/2.5.1/google-tag-manager.dynamic.js.gz	false	Avira URL Cloud: safe	unknown
https://cdn77.api.userway.org/api/img-dscr/v2/g3PUExEDwi/1365413/ViataKRasiDwmM1f/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F25thPmEh7GFgBId98TtFu0%2F28ae83473a3f2fb2e7b1a2626c187538%2FTested.svg%22%2C%22alt%22%3A%22Tested.svg%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F2Ot38DL6ci6tHcThKsX02J%2F5156c2799699635df5ed8318a67199f6%2FTraceable.svg%22%2C%22alt%22%3A%22Traceable.svg%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F3b2rDAxg4SGASVbyiHYA4J%2Fe1d474b1648af04c1130bc67502e7d2a%2Fhome-feat-dyson.jpg%22%2C%22alt%22%3A%22pill%20image%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F3Bt84vIv74GcnJ34cqoPYi%2F0e3739c22ea2d22dc49e375599c07dae%2FHome-Feat-03.jpg%22%2C%22alt%22%3A%22Ritual%20Essential%20for%20Women%20bottle%20shown%20in%20a%20yellow%20staged%20background%20with%20mint%20leaves%20and%20other%20props%20scatted%20around%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F3JHmTV1dNv2RkROoGdgp2H%2F64766a5445928cf2114cf24dcedd5e09%2FPLP-Product-Tile-SYN.jpg%22%2C%22alt%22%3A%22Ritual%20Synbiotic%2B%20capsule%20on%20a%20yellow%20background%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F4llXYVdlo5BogadisVOPiQ%2Fc2a91203d759c07df7a58f826128a9c9%2FNon-GMO.svg%22%2C%22alt%22%3A%22Non-GMO.svg%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F4omFL520uv8cAkSPuiF0tz%2F8392a7f6e92dec5c4baac78040cb57c7%2Fsite1_FS.png%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F5GmVfeAI5f3zIL55YAFSdL%2F38284494321bcfbcbc8ebf663ddcabbc%2Fsite4_multieye.png%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F5O43D7OyK4CaCcQaaCsCAe%2F83c4d9f65ddef3e8ed950929e19267fc%2FHome-Map.jpg%22%2C%22alt%22%3A%22Map%20of%20our%20Ingredient%20locations%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F5xGdLlaelAH2jPMWL91feW%2F259608c6704d0b1f3de9f959221b909c%2Fsite3_bellies.png%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F6nefvLCF2DL37PzZyLhmBF%2Fd1380e7a82c3f064880e6c50a4ba42c0%2FPLP-Product-Tile-SKN.jpg%22%2C%22alt%22%3A%22Ritual%20HyaCera%E2%84%A2%20capsule%20on%20a%20yellow%20background%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F6rgXBe3c8mtYSyUd3iXgAh%2Fbb629a125d2dfb6a2a6ee33093bfbe69%2Fsite2_prepostbathroom.png%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F6tq5Ig8BP3vc3sUf2j7sds%2Fe000bd861426e04161fa3ff1ca9e4c07%2FVegan.svg%22%2C%22alt%22%3A%22Vegan.svg%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F7E0v6tTHHB2sOtaU0d5b5h%2F8b6730a50d031dd69e98c6f1c7a7d72d%2FPLP-Product-Tile-EFW18.jpg%22%2C%22alt%22%3A%22Ritual%20Essential%20for%20Women%2018%2B%20capsule%20on%20a%20yellow%20background%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fimages.ctfassets.net%2Fuuc5ok478nyh%2F7uD7RugE7muUndiqsGrhU9%2F52b3c026918e7f2b664f09f253ccdfa4%2FPLP-Product-Tile-EPRE.jpg%22%2C%22alt%22%3A%22Ritual%20Essential%20Prenatal%20capsule%20on%20a%20yellow%20background%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%2C%22pageUrl%22%3A%22https%3A%2F%2Fritual.com%2F%22%7D	false	Avira URL Cloud: safe	unknown
https://s3.lightboxcdn.com/vendors/e64fdb6a-9235-4648-be35-c296e6aff92e/uploads/4122ccad-e184-47f1-a59d-82ee3bff6a1e/Dutch801BTItalic.ttf	false	Avira URL Cloud: safe	unknown
https://ritual.com/6669-c707ce9b4aeff7fad543.js	false	Avira URL Cloud: safe	unknown
https://js.stripe.com/v3/fingerprinted/js/shared-95669596883100744ea338bd2ff11e88.js	false	Avira URL Cloud: safe	unknown
https://js.intercomcdn.com/vendor.6349e54f.js	false	Avira URL Cloud: safe	unknown
https://ritual.com/favicon-32x32.png?v=d671b4e146ec8ffe45ad3fd9a6fdfc53	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://images.ctfassets.net/uuc5ok478nyh/1KmGsetehOWMRIcaSRRhnp/f478bb64d7e2b5f806eadddafc1bec11/PL	chromecache_527.1.dr	false	Avira URL Cloud: safe	unknown
http://store.bitstream.com0	chromecache_442.1.dr	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/cP1ElWa9rxbfKFxwmxyUj/75e20cf202f982af99a92d58bbd03a0a/17_	chromecache_498.1.dr	false	Avira URL Cloud: safe	unknown
https://b.stripecdn.com/mkt-statics-srv/assets/CodeEditorAutocomplete-dc62d89d9e2121e48baf.css	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/CustomersCaseStudyCarouselNavItem-fd5a8f8fac232f661b3	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/StripeSet-423109ad4bf57a2a011c.css	chromecache_412.1.dr	false		high
https://docs.stripe.com	chromecache_412.1.dr	false		high
https://downloads.ctfassets.net/uuc5ok478nyh/GARNqFnwWAGC6UNJQRmMw/9c342e6570fd1bf6b01239dd01d751f6/	chromecache_498.1.dr	false	Avira URL Cloud: safe	unknown
https://b.stripecdn.com/mkt-statics-srv/assets/CodeEditorStatusBar-24c7c84123b2b6e4f091.css	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/FrontdoorStickyAnimation-4ea4d6a5e9b414987337.css	chromecache_412.1.dr	false		high
https://images.ctfassets.net/uuc5ok478nyh/1urffiHYVSYPWjm4pDjAqU/bd7a46bd63595f7abdfb0881f4511634/PL	chromecache_367.1.dr	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/2Qp9vFD5KmoemJ1BzKyftw/dc287b7ba27d8b1d454d47e1d3973e69/PL	chromecache_527.1.dr	false	Avira URL Cloud: safe	unknown
https://b.stripecdn.com/mkt-statics-srv/assets/Field-ea906aa31d4012757deb.css	chromecache_412.1.dr	false		high
https://stripe.com/ie	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/GraphicFormFieldInput-3d704dfad5ff81d0e80b.css	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/CustomersCaseStudyCarouselNavTrack-1380f9c2e275695c5e	chromecache_412.1.dr	false		high
https://docs.stripe.com/stripe-apps	chromecache_412.1.dr	false		high
https://images.ctfassets.net/uuc5ok478nyh/3kI6hM2ENDLW2OQuXhnVPx/af8b62db6d1061d0a010f06b2f2b29d7/PL	chromecache_527.1.dr	false	Avira URL Cloud: safe	unknown
https://verifi.podscribe.com/tag?	chromecache_707.1.dr	false	Avira URL Cloud: safe	unknown
https://b.stripecdn.com/mkt-statics-srv/assets/Stripe-b3679504f08482f96a0d.css	chromecache_412.1.dr	false		high
https://images.ctfassets.net/uuc5ok478nyh/2RQ7pdzdW9JmLk0z0shhzM/cb2bdddeb740841de6153bea9e1b7d0f/Ca	chromecache_561.1.dr	false	Avira URL Cloud: safe	unknown
https://docs.stripe.com/development	chromecache_412.1.dr	false		high
https://docs.stripe.com/no-code/payment-links	chromecache_412.1.dr	false		high
https://stripe.com/in	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/f965fdf4.woff2	chromecache_412.1.dr	false		high
https://stripe.com/it	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/FrontdoorConnectGraphicCell-18f4786ec794a3671860.css	chromecache_412.1.dr	false		high
https://images.ctfassets.net	chromecache_492.1.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie#write_a_new_cookie)	chromecache_411.1.dr	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/6CoW7odXqbDS4XTmiVwUU1/f10b505d28f74dcb392f848687a3c44a/PL	chromecache_680.1.dr	false	Avira URL Cloud: safe	unknown
https://stripe.com/#organization	chromecache_412.1.dr	false		high
https://images.stripeassets.com/fzn2n1nzq965/5F0uhf7cRg9vhR6NmgWzzI/664e14ddebb91375f89f8dcc75242dc0	chromecache_412.1.dr	false		high
https://stripe.com/jp	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/FrontdoorBillingGraphicTier-c39e78ce45a9380bf169.css	chromecache_412.1.dr	false		high
https://images.ctfassets.net/uuc5ok478nyh/5IJgw8ESQ2UCUbntMHocnJ/8cd5b601be61174ac89d3284f67469ef/02	chromecache_498.1.dr	false	Avira URL Cloud: safe	unknown
https://dashboard.stripe.com/	chromecache_412.1.dr	false		high
https://docs.stripe.com/no-code/tap-to-pay	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/GlobalizationPicker-cb59e0de1d5c3aeaa184.css	chromecache_412.1.dr	false		high
https://images.ctfassets.net/uuc5ok478nyh/31156kSvGUxVMatB7GjBb0/4c00f4f864e5409fb80761768e2a4f76/PL	chromecache_680.1.dr	false	Avira URL Cloud: safe	unknown
https://b.stripecdn.com/mkt-statics-srv/assets/HorizontalOverflowContainer-0b85e8f46a0db21a6ef9.css	chromecache_412.1.dr	false		high
https://images.ctfassets.net/uuc5ok478nyh/3EGL5bIq8ktatPLoOC3R0C/530f5f258289cd5b8ec48c68d6c19f2a/PL	chromecache_289.1.dr	false	Avira URL Cloud: safe	unknown
https://stripe.com/sv-fi	chromecache_412.1.dr	false		high
https://support.stripe.com/?referrerLocale=en-us	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/FrontdoorSuiteAnimation-683958a93f82ca151ea7.css	chromecache_412.1.dr	false		high
https://impact.ritual.com/2023.pdf	chromecache_498.1.dr	false	Avira URL Cloud: safe	unknown
https://b.stripecdn.com/mkt-statics-srv/assets/FrontdoorSubanimation-b9163916332f2a67d464.css	chromecache_412.1.dr	false		high
https://app.indicative.com/?utm_source=segment&utm_medium=partners&utm_campaign=integrations-page#/l	chromecache_328.1.dr, chromecache_516.1.dr, chromecache_521.1.dr	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/5ItSwjfsgltFoKPGklkd6u/b8d2d9aac2f95ddadaadf041dac5b75e/Ca	chromecache_668.1.dr	false	Avira URL Cloud: safe	unknown
https://stripesessions.com/?utm_medium=owned-surfaces&utm_source=45e0&utm_campaign=US%2FCA_40cb&utm_	chromecache_412.1.dr	false		high
https://images.ctfassets.net/uuc5ok478nyh/36RNzTePP3uBBdkntwCxcz/4d7e99ab726bf06de9dc0454205dd3c2/PL	chromecache_527.1.dr	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/1A3fh5Uccwr9wQwNuM0t9I/d50dc46878cf5926ae10d2165fd346f8/PL	chromecache_680.1.dr	false	Avira URL Cloud: safe	unknown
https://b.stripecdn.com/mkt-statics-srv/assets/ProductListing-3e17d7acee941b127dd1.css	chromecache_412.1.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/Bootstrapper-U3EHIUXL.js	chromecache_412.1.dr	false	Avira URL Cloud: safe	unknown
https://stripe.com/de	chromecache_412.1.dr	false		high
https://images.ctfassets.net/uuc5ok478nyh/5gzUZU9blkkrieLpks4fIH/ccd4a34bf00d655aa02c6d8ac3373375/Ca	chromecache_452.1.dr	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/uuc5ok478nyh/yhd8uj13NxMah99kpKCWT/4366c2dab597aaab9c5d36b46234a1d9/Mad	chromecache_498.1.dr	false	Avira URL Cloud: safe	unknown
https://b.stripecdn.com/mkt-statics-srv/assets/FrontdoorPaymentsAnimation-71bdbfda51a40294b593.css	chromecache_412.1.dr	false		high
https://images.ctfassets.net/uuc5ok478nyh/5wu6CW8R3k3YajkEgkuMOl/01937d107e55f40ba4637ecb6eb6f36d/Ca	chromecache_680.1.dr	false	Avira URL Cloud: safe	unknown
https://ipv4.podscribe.com	chromecache_697.1.dr, chromecache_707.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	unknown	United States	15169	GOOGLEUS	false
151.101.0.84	dualstack.pinterest.map.fastly.net	United States	54113	FASTLYUS	false
35.83.101.170	api.userway.org	United States	237	MERIT-AS-14US	false
52.22.110.116	a9ddfb5d6fc6a446a947425297392b95-984a61f2738dc6d3.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
34.54.197.252	s.axon.ai	United States	2686	ATGS-MMD-ASUS	false
34.241.54.72	api.stripe.com	United States	16509	AMAZON-02US	false
18.66.102.17	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.185.100	unknown	United States	15169	GOOGLEUS	false
35.190.88.7	sessions.bugsnag.com	United States	15169	GOOGLEUS	false
35.174.127.31	nexus-websocket-a.intercom.io	United States	14618	AMAZON-AESUS	false
104.16.80.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
54.194.97.239	merchant-ui-api.stripe.com	United States	16509	AMAZON-02US	false
151.101.128.84	prod.pinterest.global.map.fastly.net	United States	54113	FASTLYUS	false
34.145.223.123	events-router-v8tt.zeet-audiohook-gcp-us-east.zeet.app	United States	2686	ATGS-MMD-ASUS	false
34.227.253.14	unknown	United States	14618	AMAZON-AESUS	false
54.191.131.220	unknown	United States	16509	AMAZON-02US	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
157.240.252.13	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
34.144.212.59	c.albss.com	United States	2686	ATGS-MMD-ASUS	false
3.209.177.37	unknown	United States	14618	AMAZON-AESUS	false
34.192.219.139	lg.provenpixel.com	United States	14618	AMAZON-AESUS	false
157.240.0.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
34.204.238.1	unknown	United States	14618	AMAZON-AESUS	false
104.17.159.113	s3.lightboxcdn.com	United States	13335	CLOUDFLARENETUS	false
54.186.23.98	r.stripe.com	United States	16509	AMAZON-02US	false
151.101.128.176	unknown	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
18.173.205.14	unknown	United States	3	MIT-GATEWAYSUS	false
172.217.23.100	unknown	United States	15169	GOOGLEUS	false
169.150.255.180	1784939676.rsc.cdn77.org	United States	2711	SPIRITTEL-ASUS	false
216.58.206.34	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
18.66.102.5	js.go2sdk.com	United States	3	MIT-GATEWAYSUS	false
216.239.38.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
13.224.189.35	widget.intercom.io	United States	16509	AMAZON-02US	false
157.240.0.6	unknown	United States	32934	FACEBOOKUS	false
104.16.79.73	unknown	United States	13335	CLOUDFLARENETUS	false
34.240.123.193	unknown	United States	16509	AMAZON-02US	false
34.111.8.208	dx.ritual.com	United States	15169	GOOGLEUS	false
35.241.1.16	b.applovin.com	United States	15169	GOOGLEUS	false
195.181.170.19	1667503734.rsc.cdn77.org	United Kingdom	60068	CDN77GB	false
195.181.170.18	unknown	United Kingdom	60068	CDN77GB	false
54.187.159.182	unknown	United States	16509	AMAZON-02US	false
3.162.38.19	unknown	United States	16509	AMAZON-02US	false
150.171.27.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.222.214.21	d2jjzw81hqbuqv.cloudfront.net	United States	16509	AMAZON-02US	false
52.33.255.201	unknown	United States	16509	AMAZON-02US	false
63.33.119.172	unknown	United States	16509	AMAZON-02US	false
18.205.42.100	sd-73-0.914trk.com	United States	14618	AMAZON-AESUS	false
18.245.46.55	js.intercomcdn.com	United States	16509	AMAZON-02US	false
34.149.94.206	otlp.bugsnag.com	United States	2686	ATGS-MMD-ASUS	false
52.22.152.64	verifi.podscribe.com	United States	14618	AMAZON-AESUS	false
151.101.0.176	stripecdn.map.fastly.net	United States	54113	FASTLYUS	false
54.187.226.195	unknown	United States	16509	AMAZON-02US	false
104.17.158.113	unknown	United States	13335	CLOUDFLARENETUS	false
66.102.1.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.19.230.21	hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
54.227.163.11	api-iam.intercom.io	United States	14618	AMAZON-AESUS	false
104.18.20.119	fonts.ritual.com	United States	13335	CLOUDFLARENETUS	false
52.21.35.3	ipv4.podscribe.com	United States	14618	AMAZON-AESUS	false
52.89.219.222	m.stripe.com	United States	16509	AMAZON-02US	false
52.210.46.219	unknown	United States	16509	AMAZON-02US	false
18.244.20.77	d34r8q7sht0t9k.cloudfront.net	United States	16509	AMAZON-02US	false
18.211.63.6	events.launchdarkly.com	United States	14618	AMAZON-AESUS	false
13.224.189.49	unknown	United States	16509	AMAZON-02US	false
18.244.20.112	unknown	United States	16509	AMAZON-02US	false
18.173.205.62	d1tcqh4bio8cty.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
13.33.187.102	d3orhvfyxudxxq.cloudfront.net	United States	16509	AMAZON-02US	false
150.171.29.10	ax-0001.ax-dc-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
143.204.98.62	unknown	United States	16509	AMAZON-02US	false
52.30.58.64	stripe.com	United States	16509	AMAZON-02US	false
151.101.64.84	unknown	United States	54113	FASTLYUS	false
13.32.145.78	analytics.seg.ritual.com	United States	16509	AMAZON-02US	false
34.208.52.2	api.seg.ritual.com	United States	16509	AMAZON-02US	false
142.250.186.162	td.doubleclick.net	United States	15169	GOOGLEUS	false
13.33.187.25	unknown	United States	16509	AMAZON-02US	false
216.58.206.66	unknown	United States	15169	GOOGLEUS	false
104.19.229.21	api2.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
54.154.136.171	r.srvtrck.com	United States	16509	AMAZON-02US	false
52.222.214.61	unknown	United States	16509	AMAZON-02US	false
207.211.211.27	unknown	United States	14135	NAVISITE-EAST-2US	false
107.21.52.67	share.ritual.com	United States	14618	AMAZON-AESUS	false
54.190.107.168	unknown	United States	16509	AMAZON-02US	false
52.24.25.70	tvspix.com	United States	16509	AMAZON-02US	false
157.240.251.35	unknown	United States	32934	FACEBOOKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548502
Start date and time:	2024-11-04 15:21:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://r.srvtrck.com/v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.win@33/687@264/89
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 4 13:21:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.977590879538124
Encrypted:	false
SSDEEP:	48:801d2TyWKH1idAKZdA1FehwiZUklqeh3y+3:8PvU8y
MD5:	2221998FFEFD70195B1D5D10370F34D0
SHA1:	AB159379FC9E0D2D325515FF6956857F51A51B5E
SHA-256:	7212ABE3E9D4B48FE8894933736BC02218E0C351FA3F97CE65F51696388EE18D
SHA-512:	770FCC082CAEC4D6CB6DE2595F7894E0077ABC4416D76671706E85AEBA614317353CD117AE4DAB241D9FB16EA70B18894231E4355B1030681B7FB1F808528BCE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......P.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IdY.r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VdY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VdY.r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VdY.r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VdY.r...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............U......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 15:21:44.833369017 CET	596	OUT	GET /v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d HTTP/1.1 Host: r.srvtrck.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 4, 2024 15:21:45.685645103 CET	508	IN	HTTP/1.1 308 Permanent Redirect Date: Mon, 04 Nov 2024 14:21:45 GMT Content-Type: text/html Content-Length: 164 Connection: keep-alive Location: https://r.srvtrck.com/v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 38 20 50 65 72 6d 61 6e 65 6e 74 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 38 20 50 65 72 6d 61 6e 65 6e 74 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>308 Permanent Redirect</title></head><body><center><h1>308 Permanent Redirect</h1></center><hr><center>nginx</center></body></html>
Nov 4, 2024 15:22:30.698883057 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:46 UTC	824	OUT	GET /v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d HTTP/1.1 Host: r.srvtrck.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:21:46 UTC	691	IN	HTTP/1.1 302 Date: Mon, 04 Nov 2024 14:21:46 GMT Content-Length: 0 Connection: close Set-Cookie: ykuid=582455dbfd9046cc91c4c45974c710c7; Path=/; Secure; Domain=.srvtrck.com; Max-Age=31536000; SameSite=None Set-Cookie: JSESSIONID=2A5B6C6A4E6DE10B4EDB283A842D5ACC; Path=/; HttpOnly Location: /v2/go?t=mtcpl%3Au%2Fig%3Dpsodeop9x7l1c7map0pbpbp3zbn4i5%3D77d42c5i%3Dkddpvx3d48011d5a00d317dcfbd8840e4905cd0b760a01050%260_%3Dii3celc%2614079d5e4o4%3F9hd.7lb%2Feo7.6eci%26navert.rlt%2Fas.toh&e=1&ai=45b3ecaa57a34dd6bbfc3122ad70694a&sct=0&ct=1730730106732&cu=0dc10d4f0d884bec9753d0ba6da1185d&cs=ef30f596636bef334c378511342b45f5 Strict-Transport-Security: max-age=31536000; includeSubDomains

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://r.srvtrck.com/v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 285

Chrome Cache Entry: 286

Chrome Cache Entry: 287

Chrome Cache Entry: 288

Chrome Cache Entry: 289

Chrome Cache Entry: 290

Chrome Cache Entry: 291

Chrome Cache Entry: 292

Chrome Cache Entry: 293

Chrome Cache Entry: 294

Chrome Cache Entry: 295

Chrome Cache Entry: 296

Chrome Cache Entry: 297

Chrome Cache Entry: 298

Chrome Cache Entry: 299

Chrome Cache Entry: 300

Chrome Cache Entry: 301

Chrome Cache Entry: 302

Chrome Cache Entry: 303

Windows Analysis Report
http://r.srvtrck.com/v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:47 UTC	1074	OUT	GET /v2/go?t=mtcpl%3Au%2Fig%3Dpsodeop9x7l1c7map0pbpbp3zbn4i5%3D77d42c5i%3Dkddpvx3d48011d5a00d317dcfbd8840e4905cd0b760a01050%260_%3Dii3celc%2614079d5e4o4%3F9hd.7lb%2Feo7.6eci%26navert.rlt%2Fas.toh&e=1&ai=45b3ecaa57a34dd6bbfc3122ad70694a&sct=0&ct=1730730106732&cu=0dc10d4f0d884bec9753d0ba6da1185d&cs=ef30f596636bef334c378511342b45f5 HTTP/1.1 Host: r.srvtrck.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ykuid=582455dbfd9046cc91c4c45974c710c7; JSESSIONID=2A5B6C6A4E6DE10B4EDB283A842D5ACC
2024-11-04 14:21:47 UTC	198	IN	HTTP/1.1 200 Date: Mon, 04 Nov 2024 14:21:47 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1547 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains
2024-11-04 14:21:47 UTC	1547	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 6c 65 61 73 65 20 77 61 69 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 74 72 79 7b 0a 20 20 20 20 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 64 69 72 65 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 2f 4d 53 49 45 20 28 5c 64 2b 5c 2e 5c 64 2b 29 3b 2f 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 29 20 7b Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title>Please wait</title></head><body><script> try{ (function(){ function redirection(){ if (/MSIE (\d+\.\d+);/.test(navigator.userAgent)) {

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:48 UTC	811	OUT	GET /plp.php?zoneid=7744&clickid=v0304000105700dc10d4f0d884bec9753d0ba6da1185d&x_pid3=e5c21d0795544b439bdb70bae77167c9&oadest=ritual.com HTTP/1.1 Host: lg.provenpixel.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://r.srvtrck.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:21:48 UTC	307	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 04 Nov 2024 14:21:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1647 Connection: close Cache-Control: no-cache no-store must-revalidate proxy-revalidate Pragma: no-cache Expires: 0 P3P: CP="CUR ADM OUR NOR STA NID" Vary: Accept-Encoding
2024-11-04 14:21:48 UTC	1647	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6c 67 2d 63 72 6c 2e 70 72 6f 76 65 6e 70 69 78 65 6c 2e 63 6f 6d 2f 70 6c 70 2e 70 68 70 3f 73 69 67 64 3d 6e 6f 6a 73 2e 37 36 65 32 61 63 2e 73 6d 66 6a 77 6d 26 7a 6f 6e 65 69 64 3d 37 37 34 34 26 63 6c 69 63 6b 69 64 3d 76 30 33 30 34 30 30 30 31 30 35 37 30 30 64 63 31 30 64 34 66 30 64 38 38 34 62 65 63 39 37 35 33 64 30 62 61 36 64 61 Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><noscript><meta http-equiv="refresh" content="0; url=https://lg-crl.provenpixel.com/plp.php?sigd=nojs.76e2ac.smfjwm&zoneid=7744&clickid=v0304000105700dc10d4f0d884bec9753d0ba6da

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:48 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NBFzCXzSGvC6TZe&MD=nKrycm2o HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-04 14:21:49 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cc23f767-4dcf-44c8-93f4-1b47ef5ba5d2 MS-RequestId: 2c8cfb36-ad14-4b70-999f-a79454531c35 MS-CV: lR/C55Zpm06s1BzW.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 04 Nov 2024 14:21:48 GMT Connection: close Content-Length: 24490
2024-11-04 14:21:49 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-04 14:21:49 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:49 UTC	863	OUT	GET /plp.php?sigd=1280_907_0_0_0_1280_1024.76e2ac.smfjwm&zoneid=7744&clickid=v0304000105700dc10d4f0d884bec9753d0ba6da1185d&x_pid3=e5c21d0795544b439bdb70bae77167c9&oadest=ritual.com HTTP/1.1 Host: lg-crl.provenpixel.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://lg.provenpixel.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:21:50 UTC	486	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 04 Nov 2024 14:21:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 402 Connection: close Set-Cookie: pxid=0004a965-6728d87d-adfefa45-9717149e49f3; expires=Tue, 04-Nov-2025 14:21:49 GMT; Max-Age=31535999; path=/; domain=provenpixel.com; secure; HttpOnly; SameSite=None Cache-Control: no-cache no-store must-revalidate proxy-revalidate Pragma: no-cache Expires: 0 P3P: CP="CUR ADM OUR NOR STA NID" Vary: Accept-Encoding
2024-11-04 14:21:50 UTC	402	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 64 2d 37 33 2d 30 2e 39 31 34 74 72 6b 2e 63 6f 6d 2f 74 72 6b 2f 3f 73 64 35 64 38 34 34 34 35 37 37 37 36 32 66 39 26 73 69 67 3d 34 63 64 34 35 36 2e 73 6d 66 6a 77 6f 26 75 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 72 69 74 75 61 6c 2e 63 6f 6d 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="refresh" content="1; url=https://sd-73-0.914trk.com/trk/?sd5d8444577762f9&sig=4cd456.smfjwo&u=https%3A%2F%2Fritual.com"></head><body><script>

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:50 UTC	755	OUT	GET /trk/?sd5d8444577762f9&sig=4cd456.smfjwo&u=https%3A%2F%2Fritual.com HTTP/1.1 Host: sd-73-0.914trk.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://lg-crl.provenpixel.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:21:50 UTC	204	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 04 Nov 2024 14:21:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 298 Connection: close Referrer-Policy: no-referrer Vary: Accept-Encoding
2024-11-04 14:21:50 UTC	298	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 72 69 74 75 61 6c 2e 63 6f 6d 22 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 22 68 Data Ascii: <html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="robots" content="noindex, nofollow"><noscript><meta http-equiv="refresh" content="0; url=https://ritual.com"></noscript><script>window.location.replace("h

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:51 UTC	639	OUT	GET / HTTP/1.1 Host: ritual.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:21:51 UTC	971	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:21:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 8dd540be78766b19-DFW CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9j10SjQdNLOKJDFAzLpy2o7YglN3VvL4rASFzzNiiPD2KiFTYuREbemKUmm00LFfrT%2FhmPBjqtfGYp3uiVV5%2B3msUUUGThIKwzZb%2BOnh9RdmZC43QoGG62r2zFEz"}],"group":"cf-nel","max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Permissions-Policy: fullscreen=(self "https://ritual.com"), geolocation=() Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-11-04 14:21:51 UTC	398	IN	Data Raw: 37 62 64 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 63 6f 6d 70 6f 6e 65 6e 74 3d 22 48 54 4d 4c 22 20 64 61 74 61 2d 73 6f 75 72 63 65 2d 66 69 6c 65 3d 22 68 74 6d 6c 2e 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 20 64 61 74 61 2d 65 6c 65 6d 65 6e 74 3d 22 6d 65 74 61 22 20 64 61 74 61 2d 73 6f 75 72 63 65 2d 66 69 6c 65 3d 22 68 74 6d 6c 2e 6a 73 22 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 20 64 61 74 61 2d 65 6c 65 6d 65 6e 74 3d 22 6d 65 74 61 22 20 64 61 74 61 2d 73 6f 75 72 63 65 2d 66 69 6c 65 3d Data Ascii: 7bdd<!DOCTYPE html><html lang="en-US" data-component="HTML" data-source-file="html.js"><head><meta charSet="utf-8" data-element="meta" data-source-file="html.js"/><meta http-equiv="x-ua-compatible" content="ie=edge" data-element="meta" data-source-file=
2024-11-04 14:21:51 UTC	1369	IN	Data Raw: 6f 75 72 63 65 2d 66 69 6c 65 3d 22 68 74 6d 6c 2e 6a 73 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 73 2e 63 74 66 61 73 73 65 74 73 2e 6e 65 74 22 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 72 69 74 75 61 6c 2e 63 6f 6d 22 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6e 61 6c Data Ascii: ource-file="html.js"/><link rel="icon" href="/images/favicon.ico"/><link href="https://images.ctfassets.net" rel="preconnect" crossorigin="anonymous"/><link href="https://fonts.ritual.com" rel="preconnect" crossorigin="anonymous"/><link href="https://anal
2024-11-04 14:21:51 UTC	1369	IN	Data Raw: 74 73 2e 22 2f 3e 3c 6d 65 74 61 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 2f 3e 3c 6d 65 74 61 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 69 74 75 61 6c 22 2f 3e 3c 6d 65 74 61 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6d 6d 69 74 74 65 64 20 74 6f 20 63 72 65 61 74 69 6e 67 20 74 68 65 20 70 75 72 65 73 74 2c 20 6d 6f 73 74 20 65 66 66 65 63 74 Data Ascii: ts."/><meta data-react-helmet="true" property="og:locale" content="en_US"/><meta data-react-helmet="true" property="og:title" content="Ritual"/><meta data-react-helmet="true" property="og:description" content="Committed to creating the purest, most effect
2024-11-04 14:21:51 UTC	1369	IN	Data Raw: 6d 61 67 65 73 2e 63 74 66 61 73 73 65 74 73 2e 6e 65 74 2f 75 75 63 35 6f 6b 34 37 38 6e 79 68 2f 46 74 36 42 7a 43 54 34 79 47 49 36 55 67 4f 73 36 32 77 61 4d 2f 63 39 62 61 65 30 65 30 39 30 61 36 38 65 39 34 62 63 66 64 35 32 37 61 32 37 65 30 38 34 33 61 2f 73 68 61 72 65 2e 6a 70 67 22 2f 3e 3c 6d 65 74 61 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 2f 3e 3c 6d 65 74 61 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 72 65 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 69 74 75 61 6c 22 2f 3e Data Ascii: mages.ctfassets.net/uuc5ok478nyh/Ft6BzCT4yGI6UgOs62waM/c9bae0e090a68e94bcfd527a27e0843a/share.jpg"/><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"/><meta data-react-helmet="true" name="twitter:creator" content="@ritual"/>
2024-11-04 14:21:51 UTC	1369	IN	Data Raw: 37 35 30 70 78 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 6d 64 3a 39 36 30 70 78 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 6c 67 3a 31 32 30 30 70 78 3b 2d 2d 66 6f 6e 74 2d 66 61 6d 69 6c 79 2d 73 61 6e 73 2d 73 65 72 69 66 3a 22 4c 4c 20 43 69 72 63 75 6c 61 72 22 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 52 6f 62 6f 74 6f 2c 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 3b 2d 2d 66 6f 6e 74 2d 66 61 6d 69 6c 79 2d 6d 6f 6e 6f 73 70 61 63 65 3a 53 46 4d 6f 6e 6f 2d 52 65 67 75 6c Data Ascii: 750px;--breakpoint-md:960px;--breakpoint-lg:1200px;--font-family-sans-serif:"LL Circular",-apple-system,BlinkMacSystemFont,Roboto,"Helvetica Neue",Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";--font-family-monospace:SFMono-Regul
2024-11-04 14:21:51 UTC	1369	IN	Data Raw: 68 74 3a 37 30 30 7d 64 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 62 6c 6f 63 6b 71 75 6f 74 65 7b 6d 61 72 67 69 6e 3a 30 20 30 20 31 72 65 6d 7d 62 2c 73 74 72 6f 6e 67 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 65 72 7d 73 6d 61 6c 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 38 30 25 7d 73 75 62 2c 73 75 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 37 35 25 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 69 6e 69 74 69 61 6c 7d 73 75 62 7b 62 6f 74 74 6f 6d 3a 2d 2e 32 35 65 6d 7d 73 75 70 7b 74 6f 70 3a 2d 2e 35 65 6d 7d 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 Data Ascii: ht:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}b,strong{font-weight:bolder}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:initial}sub{bottom:-.25em}sup{top:-.5em}a{background-color:transpar
2024-11-04 14:21:51 UTC	1369	IN	Data Raw: 29 2c 62 75 74 74 6f 6e 3a 6e 6f 74 28 3a 64 69 73 61 62 6c 65 64 29 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 2c 5b 74 79 70 65 3d 72 65 73 65 74 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 2c 62 75 74 74 6f 6e 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 7d 69 6e 70 75 74 5b 74 79 70 65 3d 63 68 65 63 6b 62 6f 78 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 72 61 64 69 6f 5d 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 70 61 64 64 69 6e 67 Data Ascii: ),button:not(:disabled){cursor:pointer}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}input[type=checkbox],input[type=radio]{box-sizing:border-box;padding
2024-11-04 14:21:51 UTC	1369	IN	Data Raw: 7a 65 3a 34 2e 35 72 65 6d 7d 2e 64 69 73 70 6c 61 79 2d 33 2c 2e 64 69 73 70 6c 61 79 2d 34 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 2e 64 69 73 70 6c 61 79 2d 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 2e 35 72 65 6d 7d 68 72 7b 62 6f 72 64 65 72 3a 30 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 32 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 29 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 72 65 6d 7d 2e 73 6d 61 6c 6c 2c 73 6d 61 6c 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 38 30 25 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 6d 61 72 6b 2c 6d 61 72 6b 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 63 66 38 65 33 3b 70 Data Ascii: ze:4.5rem}.display-3,.display-4{font-weight:300;line-height:1.2}.display-4{font-size:3.5rem}hr{border:0;border-top:2px solid rgba(0,0,0,.1);margin-bottom:1rem;margin-top:1rem}.small,small{font-size:80%;font-weight:400}.mark,mark{background-color:#fcf8e3;p
2024-11-04 14:21:51 UTC	1369	IN	Data Raw: 64 64 69 6e 67 2d 6c 65 66 74 3a 31 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 35 70 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 40 6d 65 64 69 61 28 6d 69 6e 2d 77 69 64 74 68 3a 37 35 30 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 7b 6d 61 78 2d 77 69 64 74 68 3a 37 30 30 70 78 7d 7d 40 6d 65 64 69 61 28 6d 69 6e 2d 77 69 64 74 68 3a 39 36 30 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6d 64 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 7b 6d 61 78 2d 77 69 64 74 68 3a 39 33 34 70 78 7d 7d 40 6d 65 64 69 61 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6c 67 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6d 64 Data Ascii: dding-left:15px;padding-right:15px;width:100%}@media(min-width:750px){.container,.container-sm{max-width:700px}}@media(min-width:960px){.container,.container-md,.container-sm{max-width:934px}}@media(min-width:1200px){.container,.container-lg,.container-md
2024-11-04 14:21:52 UTC	1369	IN	Data Raw: 20 31 36 2e 36 36 36 36 36 36 36 36 36 37 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 36 2e 36 36 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 61 75 74 6f 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 63 6f 6c 2d 31 7b 66 6c 65 78 3a 30 20 30 20 38 2e 33 33 33 33 33 33 33 33 25 3b 6d 61 78 2d 77 69 64 74 68 3a 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 32 7b 66 6c 65 78 3a 30 20 30 20 31 36 2e 36 36 36 36 36 36 36 37 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 33 7b 66 6c 65 78 3a 30 20 30 20 32 35 25 3b 6d 61 78 2d 77 69 64 74 68 3a 32 35 25 7d 2e 63 6f 6c 2d 34 7b 66 6c 65 78 3a 30 20 30 20 33 33 2e 33 33 33 33 33 33 33 33 25 Data Ascii: 16.6666666667%;max-width:16.6666666667%}.col-auto{flex:0 0 auto;max-width:100%;width:auto}.col-1{flex:0 0 8.33333333%;max-width:8.33333333%}.col-2{flex:0 0 16.66666667%;max-width:16.66666667%}.col-3{flex:0 0 25%;max-width:25%}.col-4{flex:0 0 33.33333333%

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:52 UTC	584	OUT	GET /Circular/Medium/css/fonts/CircularXXWeb-Medium.woff2 HTTP/1.1 Host: fonts.ritual.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ritual.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://ritual.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:21:52 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:21:52 GMT Content-Type: binary/octet-stream Content-Length: 71507 Connection: close Access-Control-Allow-Origin: * ETag: "d5f19ad80c7ce40747a0b5ca8f3c25b5" Last-Modified: Thu, 08 Jun 2023 20:43:41 GMT Vary: Origin, Accept-Encoding CF-Cache-Status: HIT Age: 6602 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8dd540c4c8a14792-DFW alt-svc: h3=":443"; ma=86400
2024-11-04 14:21:52 UTC	877	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 01 17 53 00 11 00 00 00 03 7c 58 00 01 15 24 00 04 00 00 00 01 15 88 00 00 01 cb 00 00 04 83 00 00 00 00 00 00 00 00 1b 81 ce 0e 1c a5 68 06 60 00 89 0a 08 56 09 82 73 11 10 0a 89 85 74 88 ac 30 12 81 f9 38 01 36 02 24 03 97 4c 0b 97 50 00 04 20 05 8c 20 07 b5 01 0c 84 11 5b 98 42 b3 01 fe 5d 8c bd 3f 77 9b 33 b3 3a 14 3c 2b 82 ec 1a de ee b2 c1 8b 94 16 e0 84 38 65 25 13 f8 55 bb 86 a7 07 9a b3 da 14 75 43 e6 f6 09 3e 82 02 dd 41 41 4a b5 ab 72 d9 ff ff ff ff ff ff ff ff 6f 5d 16 21 9b cd 4e 92 ce ee e5 c2 41 82 c4 80 88 f0 2a 16 91 62 5b 6d ed 43 2e 05 52 9b 91 a0 84 f0 b0 1d 62 86 62 e6 88 c0 a2 47 1a 96 37 2b 12 18 87 6c e3 76 62 33 b7 eb 58 d7 99 68 12 95 a8 c2 6e 64 ee b6 1b 6d 64 ee 77 ac f8 83 ef d3 01 db 9c ff 33 c9 04 Data Ascii: wOF2S\|X$h`Vst086$LP [B]?w3:<+8e%UuC>AAJro]!NA*b[mC.RbbG7+lvb3Xhndmdw3
2024-11-04 14:21:52 UTC	1369	IN	Data Raw: e8 d4 fe ff 1a 13 10 02 c9 48 18 64 8c c5 72 1c e8 c0 83 0e b9 d9 a8 43 ee b0 1b d4 e7 07 1d 76 6b f2 fc a0 c3 6e 4c 07 74 d8 77 e1 06 64 e0 bb 90 f8 c1 0d 72 cf ba 41 6e 8f 7d 80 97 5e 58 23 85 c9 31 33 f8 fe ff 1f ea 7d 7f bc 3f 47 22 16 e0 a4 e3 78 b1 b6 b9 00 5c e5 8c f9 e9 ec fb 6e 9a d8 be 88 56 3d a9 38 01 22 2d 81 60 b1 33 5b b7 af 87 38 cb 8e da 6e 0c a4 41 01 d9 9c ed 33 f0 94 1d 3c be 5f 28 6f 05 9b 0f 03 d6 a4 04 27 70 6e ad d8 c4 57 f0 fe 5f ea f6 7a 77 6f 4a 9a f2 81 84 16 0a 3f 96 6c 49 41 1c f3 e6 e1 68 02 04 08 10 4d ee 0a e8 2d d6 16 30 67 22 6a e5 9e 89 32 05 24 25 fb 93 23 9c 95 39 7b 63 4b 4d 55 dc 28 b0 17 13 fe b7 31 fc d7 be 75 51 e0 f8 ab 49 da 2d ff f1 01 06 db ac ff f7 c5 4f 2b a7 db 17 bd 9f cc d6 a5 3b 2b de 5d 1f f3 aa 50 f0 Data Ascii: HdrCvknLtwdrAn}^X#13}?G"x\nV=8"-`3[8nA3<_(o'pnW_zwoJ?lIAhM-0g"j2$%#9{cKMU(1uQI-O+;+]P
2024-11-04 14:21:52 UTC	1369	IN	Data Raw: 39 84 43 22 1c 58 81 30 0a 78 fe 2b 4d bf b6 b8 f1 12 51 e4 f8 54 80 9f 63 5c 1d a8 9d 59 2c 8b e6 4b b3 94 69 b3 da 16 22 5e 22 27 91 19 91 dd 64 b5 fa 7c 81 a8 6a e3 d4 fa fc ff a8 9d 45 22 51 55 28 14 48 8a 6a 47 52 1a b7 73 f6 ec 9d dd fa fd 2c 36 7b b9 3e 47 66 56 ce 30 06 1c 52 a0 3a f1 2e 03 f9 85 44 32 f0 39 2b 9f fc aa 98 ce 2c c9 21 88 8f 08 8d 31 c2 08 cf 7a 38 2e eb ce af 6f 9b 54 ef ce 9e 6a 79 0c 75 28 43 29 a1 84 10 42 08 d5 9b 7f ff 06 7d 27 da 5b 25 f4 d2 75 90 ce 74 ec 23 7c 4c 30 c1 98 87 10 e2 21 4c 70 57 ba a0 b7 98 fa da a7 c3 60 3b 45 48 73 24 9d 34 9c 5f 8b c5 7e fa ff 99 c5 92 62 9a 93 64 97 a3 04 11 f0 be da bf 5e df 1f b3 fa 97 30 65 b7 e3 96 3e 15 59 45 89 20 10 eb 78 77 ff 1f 63 ab aa be c2 ab d8 3d 03 15 14 19 06 26 e0 ff 90 Data Ascii: 9C"X0x+MQTc\Y,Ki"^"'d\|jE"QU(HjGRs,6{>GfV0R:.D29+,!1z8.oTjyu(C)B}'[%ut#\|L0!LpW`;EHs$4_~bd^0e>YE xwc=&
2024-11-04 14:21:52 UTC	1369	IN	Data Raw: a5 ee e0 3d e3 08 9f 48 14 58 a0 5d 6a 2b 06 88 2c 89 01 66 3d fd a5 e4 8c 27 b5 a0 0f c9 70 0a cb 4c 2f 0a 4d 2d a1 95 b1 9b 2d c4 74 a8 df 51 0a 1a 65 46 2d e6 6b 6e ac 5c 4e 1c 8e 08 ac 8a b1 23 b3 27 25 ea e3 e5 86 b6 00 43 dd d9 9e c0 74 ac d1 8e dc 9b e6 86 69 7c 7e fe 16 dc bb b9 e7 ec 2b de cd 9d 32 27 43 fa 0c bb a9 7f 80 d5 b9 37 b1 06 db a6 d0 82 60 4d 78 ce 0b ae c4 37 12 02 18 90 31 62 2b 39 63 8e 2f 7e 03 1f df 60 ac c4 25 31 14 0e 1b 97 ce 49 49 de 8d 91 31 05 4a 0d a0 36 19 f5 58 76 f5 fc 26 f8 dd 42 7b 11 6f ea fb 5a e6 b4 41 43 bd 43 e6 ea 4b c6 85 83 f0 c1 60 43 f0 41 85 12 5b 28 2e 00 13 a0 8e e3 00 cd 3e 82 5d 8c 98 95 8d 78 64 a5 3f 10 b8 02 08 11 e1 b3 23 10 55 08 35 84 c3 8e 09 81 8a b0 cc 0c 7b 37 43 06 ca 03 21 42 42 05 c1 8f 75 Data Ascii: =HX]j+,f='pL/M--tQeF-kn\N#'%Cti\|~+2'C7`Mx71b+9c/~`%1II1J6Xv&B{oZACCK`CA[(.>]xd?#U5{7C!BBu
2024-11-04 14:21:52 UTC	1369	IN	Data Raw: 61 08 d8 b9 a2 43 20 e0 6d 81 86 44 b0 c5 10 9b 14 1b 72 4d 6e 08 b2 ff 2c 60 67 87 0b ce ba 1b e3 6e 48 d6 a9 4a 0a da 1d 7d 18 73 36 68 a0 43 51 f1 7d 4a e6 79 f5 ac fb db a1 e3 3c 81 49 61 8e a4 91 94 24 e3 ca 33 03 f9 55 1f 46 4a 67 0f bd 97 b1 25 8c 29 18 95 10 80 4b c6 c9 b1 0b 0a 2a c9 ab 8c 74 4c 44 42 b4 27 76 5c ce f4 e4 cf d7 64 1a f2 f2 80 1f 72 6c 22 c5 b2 e5 97 e3 75 95 71 2c 18 42 18 a1 63 53 03 a8 0c 3c a8 ef 22 a1 5e 6b c6 79 0d e0 5e e9 1e d1 93 c7 f9 a0 f7 f9 8e 3b 74 d2 13 76 95 f0 96 64 ff f3 65 2a f2 5e 37 ff c7 2d a8 ed da ae f3 3e a0 87 ae 47 d4 63 cc b9 8e 95 16 5f b3 56 d1 02 c2 57 6c 86 20 0d 4a 14 21 34 66 44 38 00 70 66 ac 4e a2 b6 46 6b 85 f4 18 c7 a6 bb fc 54 1c ef 48 6b c1 5d 99 ae 79 1b 19 cf 92 32 ab 02 b6 48 71 44 6b 44 Data Ascii: aC mDrMn,`gnHJ}s6hCQ}Jy<Ia$3UFJg%)KtLDB'v\drl"uq,BcS<"^ky^;tvde^7->Gc_VWl J!4fD8pfNFkTHk]y2HqDkD
2024-11-04 14:21:52 UTC	1369	IN	Data Raw: 55 38 f0 04 22 a9 a2 1c d4 74 d6 9c f9 5a 88 b4 b4 c4 ad 75 4a 27 02 43 48 67 86 12 49 52 8d 64 e4 14 94 54 d4 5d ab 9e 9e 32 6a 64 66 65 e7 8c 6b df dd 9a 79 c4 cb c7 2f 60 75 79 e6 a0 2b a6 13 39 73 e1 7a 79 23 26 6e c5 86 3b dc 93 90 92 91 47 e9 a8 55 7a 03 46 66 d6 b2 13 9c dc e5 e5 f0 0b 0a 8b 8a af 43 22 08 e2 11 f0 3c bc fa 5c c7 ac c1 75 10 6e 22 75 39 25 41 6b 60 0d f0 84 fa 49 9a d2 ae 2e a2 5f 33 c2 dc c2 b2 ad 8e 8c 94 8c 42 63 b0 c5 a9 8f 97 90 94 92 96 91 95 93 57 a8 22 73 25 e5 5a 13 db d8 da b5 fd 4d 85 88 29 09 da 1a 99 b4 e9 4d 05 8b 8d 45 db 12 da 60 10 55 70 41 e0 5f 8b 16 d3 97 e2 ea 05 e9 78 af a7 37 d2 47 be 98 b8 4d 8f 0c a5 ef cd 67 c3 4e b6 10 0a 85 c2 9f 0e 7b ac 55 c0 27 67 76 f4 3b 0c c2 0c 2c 6c 9c 60 35 1c 31 91 9c 71 66 43 Data Ascii: U8"tZuJ'CHgIRdT]2jdfeky/`uy+9szy#&n;GUzFfC"<\un"u9%Ak`I._3BcW"s%ZM)ME`UpA_x7GMgN{U'gv;,l`51qfC
2024-11-04 14:21:52 UTC	1369	IN	Data Raw: a4 e6 58 58 b6 d5 76 6b 1b 5b bb b6 bf 62 14 5d 26 4c 04 14 36 b0 e5 f2 10 77 39 01 f3 c8 f5 74 de 89 c6 2f 25 94 fe 97 86 f6 b7 0e ed 41 9e 93 a5 a2 74 96 d9 95 1c bf b1 bb fa 1f da 3d b1 98 a2 f9 4e e2 c6 36 ef 91 fa 7a 44 0a b7 70 fc ea 89 be f4 78 63 cc 5f 0c d1 c3 f2 bf bb 0e bb 67 57 d7 63 6f 7c 71 e4 58 28 92 f8 2e 95 29 fc f3 5f 5c 69 4b bd bb c7 d7 ff e3 27 4b 2b 6b 98 cb e3 0b ec 1d 50 21 4f 7a 35 14 5d 2b 30 40 a0 63 c8 96 7b 51 98 a8 5b 9d f3 59 5c b1 78 6b fa 65 c0 a0 21 c3 46 6b 2c d1 b8 09 93 b5 d0 ac a5 92 a0 c9 28 a8 b8 78 f8 04 86 27 84 1b 91 ba 23 21 8b 87 f8 10 10 12 11 5b 87 10 88 19 62 31 a3 3a a9 cf 69 4a 3b fd ea 87 43 35 63 8e 8c 44 47 a1 31 d8 eb 75 7b 6b 0f e2 0a 8d 05 ee 02 ab b8 24 20 51 92 14 a9 d2 65 c8 94 25 47 de 95 0a 3a Data Ascii: XXvk[b]&L6w9t/%At=N6zDpxc_gWco\|qX(.)_\iK'K+kP!Oz5]+0@c{Q[Y\xke!Fk,(x'#![b1:iJ;C5cDG1u{k$ Qe%G:
2024-11-04 14:21:52 UTC	1369	IN	Data Raw: 15 1a 4c 15 9f 99 80 90 28 8b 64 1d 9b b5 bd 4a bb f6 1d 3a 76 ea 3c 97 b8 71 b7 7f 60 3b c0 d1 7a 62 95 fb 5a f2 86 2b dd 77 1a e7 77 cd da f3 4f 68 11 40 57 99 58 35 55 0b d2 a9 9b 62 35 98 0a 5f a2 8a c5 fb 66 bd 36 17 6b 5b 3f 19 7e cb fd 51 e4 af dd b8 db 3f b0 1d e0 68 98 18 b4 e1 9e 6e bc ff 65 bb 75 fb b2 a8 d5 db fa bd e3 6a 65 73 c4 67 32 0f c9 11 0a 15 4a 8f a8 92 26 da 35 09 9a 12 8f 41 54 55 55 46 c7 a8 6e b2 c2 c2 68 fb f3 16 d0 43 90 a0 b0 c2 55 90 a8 30 9d 70 0e 2f 02 91 54 51 55 75 ea 35 4c 4d 04 77 f6 50 27 d5 ad a2 57 7f 0d 7b 64 34 e3 77 26 31 6d b6 16 3d b2 6c d5 fa b4 79 9c 71 f6 d9 8f ac 9f aa 7e e7 af da ff 2d b9 00 1c d5 89 58 75 e6 c2 75 dd 8a 15 f7 a4 e4 51 ae 51 53 7a 2b cc f1 de f1 23 28 2c 2a 5e b8 87 c8 d0 fd b0 9d 2e 68 19 Data Ascii: L(dJ:v<q`;zbZ+wwOh@WX5Ub5_f6k[?~Q?hneujesg2J&5ATUUFnhCU0p/TQUu5LMwP'W{d4w&1m=lyq~-XuuQQSz+#(,*^.h
2024-11-04 14:21:52 UTC	1369	IN	Data Raw: 4c e8 3b ee 57 aa 77 61 73 cc cf 79 d4 a5 c1 d3 ed 09 ce 0d c2 dc d0 8b 4d 50 34 54 8b 32 af 37 0d 00 ac 71 08 46 a6 5c 77 f7 f7 f8 28 73 53 d3 ab 32 d4 fc a0 b5 c5 1d 35 da aa bb bc 42 6a ab 9e c6 cf d5 8d b5 3f 28 7c ea 31 59 93 d8 37 f3 29 33 d2 4b 88 68 63 bb 7b a5 ae c6 18 9b d7 06 65 d2 71 fe 8a 8d cf 40 f3 da c6 8c d4 07 d0 cb a8 2a 8b ff 1f 52 e0 7d 9c be 98 91 6d 2c 78 98 4f 6c a4 e9 d5 fc 8d c0 7f 89 71 f0 5f 25 32 5b 0a 86 20 0b 4a 4c 0c 1d c6 fe f5 7f 1a 28 24 95 e7 3b 5a 36 e5 7f 68 df 1a 82 9e 7f f9 59 c6 13 8f ee 2f 20 44 06 9f dc f4 82 24 48 37 01 a0 4e 15 1a ed 9b 5f d9 d7 cf a7 42 fd 97 4a 37 2c f8 e8 45 8e 4d 5e e1 cd 3a 1a dd 5e f4 9e d5 e0 b9 10 61 b7 70 8f 3e 11 5d 5e 9c 4b d7 b1 5d 5a b1 eb 7a a7 28 57 eb 66 33 6e 6e ba 88 a8 8f 2d Data Ascii: L;WwasyMP4T27qF\w(sS25Bj?(\|1Y7)3Khc{eq@*R}m,xOlq_%2[ JL($;Z6hY/ D$H7N_BJ7,EM^:^ap>]^K]Zz(Wf3nn-
2024-11-04 14:21:52 UTC	1369	IN	Data Raw: 54 24 28 40 31 00 47 85 1a 0d 5a 74 50 c0 5e 94 62 73 75 2a 49 fc 5d d1 f9 c5 35 99 24 a1 fe c8 04 61 c6 4e dd a5 5f 0e 40 c6 c8 23 5c c9 bd 3c c0 57 ea 3f d3 a3 ee 31 53 cc 80 b9 87 0b f6 19 5f 74 1c de 3d e0 9e 8b 65 c3 ec b5 ec b1 f0 46 5f 40 d8 e2 6f ef 31 ec e1 be d6 92 e3 83 14 89 94 30 28 20 e6 fd d2 48 dd 5b df 7c f7 c3 4f bf fc f6 d7 3f ff 31 84 10 46 22 92 90 8c 14 44 11 43 2a d2 90 8e ce a5 49 c7 32 c6 0f 1a 6b 89 4c 51 ee d8 89 92 ae 9e be 81 a1 91 31 8b 7d 26 d8 7f 84 99 b9 c5 5a 6b af b3 ae 67 3c 9e 13 d2 ab a8 aa b9 d2 1b 8c 26 b3 c5 6a 83 60 04 c5 70 96 b3 f3 82 28 c9 8a ea 70 12 c4 c0 d0 c8 d8 c4 d4 cc dc c2 d2 0a 03 60 71 78 02 91 44 a6 58 53 69 74 06 c8 64 b1 6d 6c ed ec 1d 1c 9d 9c 5d 38 5c 1e 5f 20 14 89 25 52 19 04 23 a8 3f fe fa 17 Data Ascii: T$(@1GZtP^bsuI]5$aN_@#\<W?1S_t=eF_@o10( H[\|O?1F"DCI2kLQ1}&Zkg<&j`p(p`qxDXSitdml]8\_ %R#?

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:52 UTC	568	OUT	GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1 Host: ritual.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://ritual.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:21:53 UTC	500	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:21:53 GMT Content-Type: application/javascript Content-Length: 12332 Connection: close Last-Modified: Tue, 29 Oct 2024 16:52:30 GMT ETag: "672112ce-302c" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8dd540c6985b1441-DFW X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Wed, 06 Nov 2024 14:21:53 GMT Cache-Control: max-age=172800 Cache-Control: public Accept-Ranges: bytes
2024-11-04 14:21:53 UTC	869	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 72 65 74 75 72 6e 22 63 66 2d 6d 61 72 6b 65 72 2d 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2e 74 6f 53 74 72 69 6e 67 28 29 2e 73 6c 69 63 65 28 32 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 28 6e 3d 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 7c 7c 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 29 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 6e 2c 5b 63 6f 6e 73 6f 6c 65 2c 22 5b 52 4f 43 4b 45 54 20 4c 4f 41 44 45 52 5d 20 22 5d 2e 63 6f 6e 63 61 74 28 74 29 29 3b 76 61 72 20 6e 7d 66 75 6e 63 Data Ascii: !function(){"use strict";function t(){return"cf-marker-"+Math.random().toString().slice(2)}function e(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];(n=console.warn\|\|console.log).call.apply(n,[console,"[ROCKET LOADER] "].concat(t));var n}func
2024-11-04 14:21:53 UTC	1369	IN	Data Raw: 74 43 6f 6e 74 65 6e 74 3d 74 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 74 2e 61 74 74 72 69 62 75 74 65 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 72 3d 74 2e 61 74 74 72 69 62 75 74 65 73 5b 6e 5d 3b 74 72 79 7b 72 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 3f 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 4e 53 28 72 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 72 2e 6e 61 6d 65 2c 72 2e 76 61 6c 75 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 72 2e 6e 61 6d 65 2c 72 2e 76 61 6c 75 65 29 7d 63 61 74 63 68 28 6f 29 7b 7d 7d 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 49 28 65 29 3b 74 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 6e 29 7d 66 75 6e Data Ascii: tContent=t.textContent;for(var n=0;n<t.attributes.length;n++){var r=t.attributes[n];try{r.namespaceURI?e.setAttributeNS(r.namespaceURI,r.name,r.value):e.setAttribute(r.name,r.value)}catch(o){}}return e}function l(t,e){var n=new I(e);t.dispatchEvent(n)}fun
2024-11-04 14:21:53 UTC	1369	IN	Data Raw: 6f 72 45 61 63 68 2e 63 61 6c 6c 28 6e 2e 61 74 74 72 69 62 75 74 65 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 2f 5e 6f 6e 2f 2e 74 65 73 74 28 65 2e 6e 61 6d 65 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 6e 5b 65 2e 6e 61 6d 65 5d 26 26 6e 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 65 2e 6e 61 6d 65 2c 65 2e 76 61 6c 75 65 2e 73 75 62 73 74 72 69 6e 67 28 74 2e 68 61 6e 64 6c 65 72 50 72 65 66 69 78 4c 65 6e 67 74 68 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 53 28 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 74 2e 5f 5f 63 66 51 52 3d 7b 64 6f 6e 65 3a 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 Data Ascii: orEach.call(n.attributes,function(e){/^on/.test(e.name)&&"function"!=typeof n[e.name]&&n.setAttribute(e.name,e.value.substring(t.handlerPrefixLength))})})}function S(){var t=window;"undefined"!=typeof Promise&&(t.__cfQR={done:new Promise(function(t){retur
2024-11-04 14:21:53 UTC	1369	IN	Data Raw: 69 70 74 22 29 2e 6e 6f 4d 6f 64 75 6c 65 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 3b 72 65 74 75 72 6e 20 74 2e 5f 5f 72 6f 63 6b 65 74 4c 6f 61 64 65 72 45 76 65 6e 74 43 74 6f 72 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 72 6f 63 6b 65 74 4c 6f 61 64 65 72 45 76 65 6e 74 43 74 6f 72 22 2c 7b 76 61 6c 75 65 3a 45 76 65 6e 74 7d 29 2c 74 2e 5f 5f 72 6f 63 6b 65 74 4c 6f 61 64 65 72 45 76 65 6e 74 43 74 6f 72 7d 28 29 2c 4c 3d 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 2c 5f 3d 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 6c 6e 2c 48 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 Data Ascii: ipt").noModule,I=function(){var t=window;return t.__rocketLoaderEventCtor\|\|Object.defineProperty(t,"__rocketLoaderEventCtor",{value:Event}),t.__rocketLoaderEventCtor}(),L=document.write,_=document.writeln,H=Object.setPrototypeOf\|\|{__proto__:[]}instanceof
2024-11-04 14:21:53 UTC	1369	IN	Data Raw: 72 53 63 72 69 70 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 65 66 65 72 22 29 7c 7c 74 2e 74 79 70 65 3d 3d 3d 74 68 69 73 2e 6e 6f 6e 63 65 2b 22 6d 6f 64 75 6c 65 22 26 26 21 74 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 61 73 79 6e 63 22 29 7d 2c 74 7d 28 29 2c 4e 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 26 26 74 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7c 7c 74 68 69 73 7d 72 65 74 75 72 6e 20 79 28 65 2c 74 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 72 76 65 73 74 53 63 72 69 70 74 73 49 6e 44 6f 63 75 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d Data Ascii: rScript=function(t){return t.hasAttribute("defer")\|\|t.type===this.nonce+"module"&&!t.hasAttribute("async")},t}(),N=function(t){function e(){return null!==t&&t.apply(this,arguments)\|\|this}return y(e,t),e.prototype.harvestScriptsInDocument=function(){var t=
2024-11-04 14:21:53 UTC	1369	IN	Data Raw: 67 75 6d 65 6e 74 73 5b 6e 5d 3b 72 65 74 75 72 6e 20 65 2e 77 72 69 74 65 28 74 2c 21 30 29 7d 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6c 75 73 68 57 72 69 74 74 65 6e 43 6f 6e 74 65 6e 74 41 6e 64 44 69 73 61 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 3d 4c 2c 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 6c 6e 3d 5f 2c 74 68 69 73 2e 62 75 66 66 65 72 2e 6c 65 6e 67 74 68 26 26 28 64 6f 63 75 6d 65 6e 74 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 69 6e 73 65 72 74 69 6f 6e 50 6f 69 6e 74 4d 61 72 6b 65 72 29 3f 74 68 69 73 2e 69 6e 73 65 72 74 69 6f 6e 50 6f 69 6e 74 4d 61 72 6b 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 3f 74 68 69 73 2e 69 6e 73 65 72 74 43 6f Data Ascii: guments[n];return e.write(t,!0)}},t.prototype.flushWrittenContentAndDisable=function(){document.write=L,document.writeln=_,this.buffer.length&&(document.contains(this.insertionPointMarker)?this.insertionPointMarker.parentNode===document.head?this.insertCo
2024-11-04 14:21:53 UTC	1369	IN	Data Raw: 73 2e 62 79 70 61 73 73 45 76 65 6e 74 73 49 6e 50 72 6f 78 69 65 73 3d 21 31 2c 74 68 69 73 2e 6e 61 74 69 76 65 57 69 6e 64 6f 77 41 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3b 74 72 79 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 64 6f 63 75 6d 65 6e 74 2c 22 72 65 61 64 79 53 74 61 74 65 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 73 69 6d 75 6c 61 74 65 64 52 65 61 64 79 53 74 61 74 65 7d 7d 29 7d 63 61 74 63 68 28 65 29 7b 7d 74 68 69 73 2e 73 65 74 75 70 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 50 72 6f 78 79 28 29 2c 74 68 69 73 2e 75 70 64 61 74 65 49 6e 6c 69 6e 65 48 61 6e 64 6c 65 72 73 28 29 7d 72 65 74 75 72 Data Ascii: s.bypassEventsInProxies=!1,this.nativeWindowAddEventListener=window.addEventListener;try{Object.defineProperty(document,"readyState",{get:function(){return t.simulatedReadyState}})}catch(e){}this.setupEventListenerProxy(),this.updateInlineHandlers()}retur
2024-11-04 14:21:53 UTC	1369	IN	Data Raw: 6f 64 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2c 6e 3d 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 2c 72 3d 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3b 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 66 6f 72 28 76 61 72 20 6f 3d 5b 5d 2c 69 3d 32 3b 69 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 6f 5b 69 2d 32 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 69 5d 3b 76 61 72 20 61 3d 6d 28 74 68 69 73 29 2c 63 3d 72 26 26 72 2e 5f 5f 72 6f 63 6b 65 74 4c 6f 61 64 65 72 50 72 6f 78 69 65 64 48 61 6e 64 6c 65 72 3b 69 66 28 21 63 29 7b 76 61 72 20 73 3d 66 28 72 29 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 3f 28 Data Ascii: ods=function(t){var e=this,n=t.addEventListener,r=t.removeEventListener;t.addEventListener=function(t,r){for(var o=[],i=2;i<arguments.length;i++)o[i-2]=arguments[i];var a=m(this),c=r&&r.__rocketLoaderProxiedHandler;if(!c){var s=f(r);"function"==typeof s?(
2024-11-04 14:21:53 UTC	1369	IN	Data Raw: 6e 67 73 2e 6e 6f 6e 63 65 29 29 7b 76 61 72 20 6e 3d 69 28 65 29 2c 72 3d 76 28 29 26 26 65 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 69 6e 74 65 67 72 69 74 79 22 29 3b 69 66 28 6e 26 26 21 72 29 7b 76 61 72 20 6f 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6c 69 6e 6b 22 29 3b 6f 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 6c 22 2c 22 70 72 65 6c 6f 61 64 22 29 2c 6f 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 73 22 2c 22 73 63 72 69 70 74 22 29 2c 6f 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 22 2c 6e 29 2c 65 2e 63 72 6f 73 73 4f 72 69 67 69 6e 26 26 6f 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 72 6f 73 73 6f 72 69 67 69 6e 22 2c 65 2e 63 72 6f 73 73 4f 72 69 67 69 6e 29 2c 64 6f 63 75 Data Ascii: ngs.nonce)){var n=i(e),r=v()&&e.hasAttribute("integrity");if(n&&!r){var o=document.createElement("link");o.setAttribute("rel","preload"),o.setAttribute("as","script"),o.setAttribute("href",n),e.crossOrigin&&o.setAttribute("crossorigin",e.crossOrigin),docu
2024-11-04 14:21:53 UTC	511	IN	Data Raw: 69 6e 67 26 26 6f 26 26 21 69 3f 64 28 6e 29 3a 70 28 6e 29 3b 72 65 74 75 72 6e 20 63 3f 28 61 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 63 2c 72 29 2c 63 29 3a 28 65 28 22 46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 20 61 63 74 69 76 61 74 61 62 6c 65 20 63 6f 70 79 20 6f 66 20 73 63 72 69 70 74 20 5c 6e 22 2b 6e 2e 6f 75 74 65 72 48 54 4d 4c 2b 22 5c 6e 22 2c 22 53 63 72 69 70 74 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 65 78 65 63 75 74 65 64 2e 22 29 2c 6e 75 6c 6c 29 7d 2c 74 7d 28 29 2c 52 3d 22 64 61 74 61 2d 63 66 2d 73 65 74 74 69 6e 67 73 22 2c 54 3d 22 7c 22 2c 42 3d 22 64 61 74 61 2d 63 66 2d 6d 6f 64 69 66 69 65 64 2d 22 2c 55 3d 76 6f 69 64 20 30 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 75 72 Data Ascii: ing&&o&&!i?d(n):p(n);return c?(a.insertBefore(c,r),c):(e("Failed to create activatable copy of script \n"+n.outerHTML+"\n","Script will not be executed."),null)},t}(),R="data-cf-settings",T="\|",B="data-cf-modified-",U=void 0;!function(){var t=document.cur

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:53 UTC	693	OUT	GET /uuc5ok478nyh/28hfBJ1mqho10JHWUltf0X/720c1c1212efc928775e881214f528b8/Category-Multivitamin.jpg?w=580&h=359&q=90&fm=webp HTTP/1.1 Host: images.ctfassets.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ritual.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:21:53 UTC	505	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 32908 Connection: close ETag: "c166463070247c70e68a7de76c19f33b" Last-Modified: Fri, 25 Oct 2024 05:10:34 GMT Date: Mon, 04 Nov 2024 14:21:53 GMT Cache-Control: max-age=31536000 Server: Contentful Images API Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 5f82872daec754c74bbd4ef1bc7f7314.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P9 X-Amz-Cf-Id: OIkoAsRTC4iOODwHHIxTJ_b-Wxdk5C-O5xOnc2lXHjSJyG7lu8PDfg==
2024-11-04 14:21:53 UTC	16384	IN	Data Raw: 52 49 46 46 84 80 00 00 57 45 42 50 56 50 38 20 78 80 00 00 b0 b6 01 9d 01 2a 43 02 67 01 3e 49 22 8d 45 22 a2 21 13 7b 6d 70 28 04 84 b1 b7 25 c1 e4 62 cd 3d 48 a9 25 7d f9 69 fd 0f e4 57 7d ec 73 f0 0f d1 fe 47 7e f0 7f b7 f9 ef e4 1f 07 7d d7 e3 1f dd 0f f7 5f 39 bc 3e ee 4f 39 ef 35 fe 0b fd f7 f8 5f dd 2f f5 1f 35 fd 3b 7f 4e ff 7f ec 11 fa b7 fe bb fc 0f f8 4f f6 5f bf ff ff fc 39 79 8a fe b1 fe 67 fe 2f fa af 77 2f fc 1e b4 ff ad fa 82 7f 64 ff 13 d6 bf e8 11 fb 6b e9 bf fb 8f f0 b1 fd 9b fe 17 ff 0f f4 ff 02 7f af 7f f4 bf 3f fe 40 3f fc fa 80 7f ff eb af 8b 1f a6 7f 39 fe cf c1 5f ce fe d7 fe 3f 9b c6 25 fb 3c d4 47 bf 7f ee 7f 9a f6 eb fe 67 7f ff b1 7f 69 e8 11 ee 5d e8 5b a1 e8 1d e0 ef 3b 1f da f3 83 f7 7f f6 de c0 5f d3 7c fd ff db e2 59 f9 Data Ascii: RIFFWEBPVP8 x*Cg>I"E"!{mp(%b=H%}iW}sG~}_9>O95_/5;NO_9yg/w/dk?@?9_?%<Ggi][;_\|Y
2024-11-04 14:21:53 UTC	9597	IN	Data Raw: 0f 6f f3 7f 87 14 b5 f8 90 62 c9 8d aa 0c ef 51 2c af 1d a5 fc 6e 95 24 46 20 c9 78 b9 47 12 7b b9 7b 5c 04 ee 8f 9f a8 f0 39 f0 29 30 ae f6 af 67 2c 31 63 bf b8 c6 74 92 ab 65 cb b5 60 43 46 71 d9 1d 47 3a a2 4e ea c0 35 ab 81 51 8f fe c3 ab e2 01 ec e9 f5 51 93 1e c5 1f 0c 26 7e 17 5d 69 b8 5f d5 82 9f 87 79 03 e8 97 70 93 1c 4a 90 7c 21 b3 03 61 3a 55 22 25 b2 29 af 1f d5 dd eb 8a e7 05 54 d4 11 f4 f7 a6 1d bb 47 4e f7 a8 72 a8 96 53 29 40 4a 0c d4 ec 72 c4 a7 e4 86 ce ee 18 1c 33 bc 01 7a 8d f1 69 a5 62 9b 74 c5 5e 4f 7e 57 66 65 ad 60 6c 16 48 7e e4 f3 c3 5f 3c 40 5b 8e 98 be fe 07 dd 9b 23 fd 7b 4c 14 ec 38 eb 33 be c2 4f a9 5c 6d d5 fb 5e af e8 73 69 57 a1 0b bf cb b3 8a 3f 4e 34 91 6f 18 f1 af 8e 36 8d e2 fd ec b9 54 a4 9d 1e 4d e7 6e 57 83 ff 28 Data Ascii: obQ,n$F xG{{\9)0g,1cte`CFqG:N5QQ&~]i_ypJ\|!a:U"%)TGNrS)@Jr3zibt^O~Wfe`lH~_<@[#{L83O\m^siW?N4o6TMnW(
2024-11-04 14:21:53 UTC	2742	IN	Data Raw: 4f 40 62 c3 ac bc 53 95 e8 8d 94 b6 92 84 5f 21 a7 4c fa 13 71 94 54 b3 92 66 e0 35 00 c5 ea 02 58 d8 94 91 05 6e 4a 36 40 06 37 48 60 28 ce c8 44 75 83 7d 6b ae 85 fe 45 d9 31 18 b0 bb 11 ff b7 85 70 04 01 4e 8c 7b 7d 9e 3e d5 a6 8e 49 33 f0 6d 46 dc 2c 23 92 d3 20 d3 ff 6f d5 f5 10 17 dd 1a 1c df f3 ed 3c 90 2c 96 44 f3 80 92 13 03 aa f0 00 6b 5f 1a db b3 1a 6a 6f af 91 69 34 2d 12 d9 1f 02 fc 4a 2d bd 09 ff af 17 65 ea 00 58 cd a6 d8 f6 cf 56 e7 91 9c 39 80 4d 17 8b 74 55 b9 64 72 1d 8b b9 cf f3 6c f8 e8 bf a7 03 c5 db b3 53 31 6e ef fc 43 1a 8b 14 2b 2f 07 18 5a 67 98 01 f7 b3 c4 08 5c 57 09 d4 81 62 0f e5 48 60 c9 e0 28 37 de 88 89 f5 d8 50 37 4c 86 96 33 2f 0e e1 83 b1 25 9d ac 2f d5 f6 4f 1f cf e6 d3 e6 49 ae 27 e0 b2 8d 5c d5 4c f5 01 af a0 70 8e Data Ascii: O@bS_!LqTf5XnJ6@7H`(Du}kE1pN{}>I3mF,# o<,Dk_joi4-J-eXV9MtUdrlS1nC+/Zg\WbH`(7P7L3/%/OI'\Lp
2024-11-04 14:21:53 UTC	2742	IN	Data Raw: fb 0c ac 01 fb 86 48 b8 18 7d f3 0c 57 ba 6a d0 02 c2 f6 41 e6 2f 48 2c 9d 61 6c 7f 05 95 aa 85 82 6e 83 02 94 7a 0d 08 f3 82 d2 70 ef 96 cc ca 4a 37 07 2a 71 3e d9 b0 bd 14 28 90 59 43 55 1e 77 f9 29 ec 67 cd 79 b5 84 b3 7f 88 96 87 d5 d6 3c 59 ee a1 01 76 5e 5f d1 77 b1 ee 12 d0 2f a2 42 98 b0 56 f9 c4 60 b8 de 10 0d 6b 82 fb 09 dc 1e 9b 9f 77 05 f3 f9 02 de db 6f 39 b2 7f 69 43 42 7c fe 52 b1 c9 d3 d7 02 54 76 45 94 b6 b6 1a 66 8d 56 22 6c e4 e0 01 af f3 e0 40 ce a6 4a 1d 39 1f 96 79 36 08 a4 4b 8f 71 39 99 03 26 28 3e 09 2a 48 23 e6 49 7f 37 0b dd 33 c1 19 21 53 09 15 76 d8 cf 3b fa 1c 1b e2 02 9a 1a 76 60 73 d7 dc 55 82 c4 ff 95 0a 4a b3 4b df 07 f1 f7 20 35 b8 6b 03 9d 65 28 f8 a3 c6 1c ec 6c 8e 72 41 15 be c5 f7 90 d9 67 5d 63 22 31 d4 b3 4c d7 e4 Data Ascii: H}WjA/H,alnzpJ7q>(YCUw)gy<Yv^_w/BV`kwo9iCB\|RTvEfV"l@J9y6Kq9&(>H#I73!Sv;v`sUJK 5ke(lrAg]c"1L
2024-11-04 14:21:53 UTC	1443	IN	Data Raw: 15 6b ed 8a 51 b8 41 d5 68 45 26 a8 45 a1 66 94 e9 28 c7 6b 3c 13 34 f9 42 7d e9 37 b6 b5 3a f2 3a 57 55 0f 27 93 dc 37 48 f0 ab 0e 61 dd 79 c1 01 88 09 f3 80 a7 5e e3 33 92 e2 39 ef d0 ac ed 18 66 41 14 57 a3 36 c2 de 6a ad ee ff 32 a1 1a cc 56 4d 5b 11 1b 5b 47 05 39 14 b4 4d 5d 28 80 13 24 77 6b 7d 06 23 7a 61 a5 58 28 b0 a9 a2 2e ed 8b d9 d6 51 c7 7f 07 df ce 28 cf 29 ef 2c 13 24 36 89 61 11 e8 5a f1 e8 ac 0e 97 fa db cd 5b ba b4 06 7b 49 bf fe a6 89 a6 c7 1d ed db e4 48 cb 6c c1 70 3c c9 17 70 53 57 2c 17 f6 18 63 3f c3 34 2c 56 9f 54 88 3c 43 90 b2 79 62 5f f3 81 bd db 75 e4 b5 0f 47 a5 96 6d 7e 67 33 1b 20 eb a9 6b 4a a5 89 1e f1 c4 63 d1 cf 63 d0 64 46 7a 73 40 f0 fa ef 45 c0 cd d6 fc cb 2a 03 b0 fa 9e 64 46 40 6a 05 45 65 5b d8 18 90 7f a6 87 7d Data Ascii: kQAhE&Ef(k<4B}7::WU'7Hay^39fAW6j2VM[[G9M]($wk}#zaX(.Q(),$6aZ[{IHlp<pSW,c?4,VT<Cyb_uGm~g3 kJccdFzs@E*dF@jEe[}

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:21:53 UTC	690	OUT	GET /uuc5ok478nyh/1b2qQNygGSU4NwwAOj36oi/408f397e388fbe9dc6ce78073a49e594/Category-Pregnancy.jpg?w=580&h=359&q=90&fm=webp HTTP/1.1 Host: images.ctfassets.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ritual.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:21:53 UTC	505	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 21662 Connection: close ETag: "dec952905b4d54911c29ac911a6009d6" Last-Modified: Mon, 28 Oct 2024 06:20:16 GMT Date: Mon, 04 Nov 2024 14:21:53 GMT Cache-Control: max-age=31536000 Server: Contentful Images API Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 d2c570942164f5ee69dab53f43b0f1d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P9 X-Amz-Cf-Id: ad1aED3V8aEdLSOr8Gm6SXDCbzlmvRe8ExkQRA18cXMA3ByJY74iYw==
2024-11-04 14:21:53 UTC	15879	IN	Data Raw: 52 49 46 46 96 54 00 00 57 45 42 50 56 50 38 20 8a 54 00 00 10 65 01 9d 01 2a 43 02 67 01 3e 49 24 8f 45 a2 a2 21 10 d8 bd 0c 28 04 84 b2 b7 48 9b 18 bd db 7f 06 c2 57 41 43 41 1f 6b 0c 2b 0b 33 bc 4b 98 34 a2 05 8c 20 75 01 35 1e 14 ea 81 e0 2a 64 bd 77 e3 9f e4 f7 d1 87 25 f9 6f f2 df 05 fe 48 7e 0d e4 7f dd 19 c1 f4 b7 f8 ff f0 1f b9 1f de fe 60 ff e0 f5 8b fa c7 d8 0f f4 73 fc a7 f8 0f f1 5f f3 bf c8 fc 6a fb 1f f3 2b fb 39 ff 7f fc 2f bd 67 fc 6f 5e 5f e2 7f 6e ff ae fc 00 7f 36 fe b5 d6 d1 e8 17 fb 15 eb 33 ff 6b f6 c7 e1 83 fa e7 fb ef da 7f 81 af d8 3f fd 9d 60 1f ff fa 73 fd 0b c8 9f d3 3e e4 78 77 fa 77 60 65 ee fe 63 c1 0e ce df f4 78 3b fb 67 88 47 b6 7f d4 71 07 80 af d4 3f be ff da ff 07 eb db fb 1e 7f 7f 0b ea 07 e5 df fd df 18 0f c6 ff c8 Data Ascii: RIFFTWEBPVP8 TeCg>I$E!(HWACAk+3K4 u5dw%oH~`s_j+9/go^_n63k?`s>xww`ecx;gGq?
2024-11-04 14:21:53 UTC	3309	IN	Data Raw: 2d b7 51 5f cd 82 9b 80 02 63 6b 95 5c b3 84 2d 20 6a 05 83 6e 78 4a f7 fc 0d 65 14 0d a7 ed 77 a3 7c 41 47 82 45 5b 0c 64 f6 09 74 2d 05 8b 84 6f b7 07 66 ec 5d 49 33 17 38 89 d7 8a a2 6c e7 9e 2f 24 26 0e d6 42 15 d4 dd 16 15 b8 4a 37 57 63 d1 5f 72 ef 6b aa 5e 76 e3 96 18 27 60 f7 0b 2d 4b d3 94 e2 62 21 f8 76 c2 5e 43 8c 69 5d f2 4c 5a ef 31 e2 9e fc 84 07 a4 af 5b 80 05 1f e1 8c d6 20 89 e0 00 6f 1b 0d c1 8a ef bb 39 0f 7e 6a 78 27 25 f8 1e 03 7c 75 3d d3 65 20 05 f1 68 34 b4 79 05 09 a2 e9 5f 8e 83 92 9f a6 0e ec 91 2c 3f 45 cd 2f f5 3f 9f 84 02 d3 7d 30 ea 00 00 5c d2 ca 5d c1 08 69 28 e3 46 0f 46 6b b9 37 c9 45 b1 0b bd fc 36 60 9a 30 66 0b 7d 6d 82 55 e5 33 b3 48 b6 25 5b 4d 10 76 f3 97 53 4f df 4a e8 1e 50 66 ec ef 4a 4d 46 eb d1 81 fa 8a d0 b6 Data Ascii: -Q_ck\- jnxJew\|AGE[dt-of]I38l/$&BJ7Wc_rk^v'`-Kb!v^Ci]LZ1[ o9~jx'%\|u=e h4y_,?E/?}0\]i(FFk7E6`0f}mU3H%[MvSOJPfJMF
2024-11-04 14:21:53 UTC	2474	IN	Data Raw: 14 70 b8 37 ec 6d bb e7 f8 16 9e f7 fe 8a 8c 6c b4 54 95 a9 7e 81 f0 0e 21 25 29 ab ed d5 ee 71 b3 9e 4d 72 c8 34 60 65 e9 c4 73 36 c8 38 9b f1 44 d5 a1 3c 3d 98 dc 14 83 fd ad eb ee 4b 7d 05 0a 36 b6 71 f4 90 94 a4 d9 20 d3 07 2b 97 87 eb 77 ad 47 fb da ca b8 c8 44 91 b8 e3 6b ab 08 42 d1 30 49 99 1d 9c df d0 f4 f4 75 be 17 76 28 ea 41 88 92 9f 26 23 91 71 82 01 8c e0 b7 0d f6 86 6d c2 80 94 04 85 d8 fd ec df 4a 5d 3f ed 1a 01 90 02 42 d4 07 9d a1 b2 7a 42 a5 b4 6a 35 d3 5f 0d d7 52 58 29 64 e4 ef 9e 90 12 95 ce b4 0b 04 44 ce 51 77 62 a6 f0 91 3c 5c c4 c0 e0 11 f3 20 1a 68 3a 0b 04 d7 e6 c2 98 0d 45 26 8e 71 0b fa 5d 08 e7 d0 a4 08 b6 e4 5a 08 bb 26 ae 69 f1 06 91 16 b1 ce d8 c7 95 d0 b3 34 84 37 f1 82 87 a3 06 cb 78 3d 46 21 d2 16 3d a4 5c 97 c4 12 6d Data Ascii: p7mlT~!%)qMr4`es68D<=K}6q +wGDkB0Iuv(A&#qmJ]?BzBj5_RX)dDQwb<\ h:E&q]Z&i47x=F!=\m