Edit tour

Windows Analysis Report
http://americanlibertywatch.com

Overview

General Information

Sample URL:	http://americanlibertywatch.com
Analysis ID:	1636205
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

HTML page contains suspicious base64 encoded javascript

Yara detected JavaScript embedded in SVG

Connects to several IPs in different countries

Creates files inside the system directory

Deletes files inside the Windows folder

HTML page contains hidden javascript code

HTML page contains obfuscated script src

Suspicious form URL found

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2068,i,3236423303652968921,17909862154440810528,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2988 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://americanlibertywatch.com" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_386	JoeSecurity_JavaScriptembeddedinSVG	Yara detected JavaScript embedded in SVG	Joe Security

HTTP traffic detected: POST /g/collect?v=2&tid=G-1LQSGCDS0T&gtm=45je53a1v886440378za200zb858720085&_p=1741785816380&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102482433~102587591~102640600~102717422~102788824~102791784~102814060~102825837&gdid=dZTNiMT&cid=599323718.1741785824&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Chromium%3B134.0.6998.36%7CNot%253AA-Brand%3B24.0.0.0%7CGoogle%2520Chrome%3B134.0.6998.36&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1741785823&sct=1&seg=0&dl=https%3A%2F%2Famericanliberty.news%2F&dt=American%20Liberty%20News&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.googlesitekit_post_type=page&tfd=19428 HTTP/1.1Host: analytics.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://americanliberty.newsX-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50239
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

Source: unknown	HTTPS traffic detected: 172.66.42.247:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.41.9:443 -> 192.168.2.16:49794 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6868_451426227

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6868_451426227

Source: classification engine

Classification label: mal48.phis.win@32/223@257/808

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2068,i,3236423303652968921,17909862154440810528,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://americanlibertywatch.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2068,i,3236423303652968921,17909862154440810528,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

No bigger version

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://americanlibertywatch.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://pxl.iqm.com/c/2e5b6cbe-5624-4339-b0bf-ad6dedd9e541	0%	Avira URL Cloud	safe
https://sync.aniview.com/cookiesyncendpoint?biddername=212&key=86b58bad-5100-415b-b2de-9e5cb46a939d	0%	Avira URL Cloud	safe
https://sync.bfmio.com/sync?pid=191&uid=86b58bad-5100-415b-b2de-9e5cb46a939d	0%	Avira URL Cloud	safe
https://i.liadm.com/s/c/a-08d5?duid=56b099d6a41d--01jp58cz7pcx8ehyr01w0xw6j4&euns=0&s=&version=v3.8.0&cd=.americanliberty.news&pv=a77d2442-9698-441b-908e-efd11c30b2ec	0%	Avira URL Cloud	safe
https://pxl.iqm.com/i/cookie/service/redirect?tagId=2e5b6cbe-5624-4339-b0bf-ad6dedd9e541	0%	Avira URL Cloud	safe
https://pxl.iqm.com/i/ck/telaria?cid=67537e1f417546819ee5a7670d36297d&UIIQ=86b58bad-5100-415b-b2de-9e5cb46a939d	0%	Avira URL Cloud	safe
https://partners.tremorhub.com/sync?UIIQ=86b58bad-5100-415b-b2de-9e5cb46a939d	0%	Avira URL Cloud	safe
https://eb2.3lift.com/getuid?redir=https://i.liadm.com/s/88342?bidder_id%3D246498%26bidder_uuid%3D$UID	0%	Avira URL Cloud	safe
https://pxl.iqm.com/i/ck/indexch?cmid=Z9GK6NHM56QAONmbASP78wAA	0%	Avira URL Cloud	safe
https://dpm.demdex.net/ibs:dpid=127444&dpuuid=	0%	Avira URL Cloud	safe
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=americanliberty.news	0%	Avira URL Cloud	safe
https://cs.media.net/cksync?cs=3&type=iqm&ovsid=86b58bad-5100-415b-b2de-9e5cb46a939d	0%	Avira URL Cloud	safe
https://bpi.rtactivate.com/tag/?id=21328&user_id=86b58bad-5100-415b-b2de-9e5cb46a939d	0%	Avira URL Cloud	safe
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzM4MiZ0bD0xMjk2MDA%3D%26piggybackCookie%3D86b58bad-5100-415b-b2de-9e5cb46a939d%26r%3Dhttps%3A%2F%2Fpxl.iqm.com%2Fi%2Fck%2Fpubmatic%3Fpuid%3D%24%7BPUBMATIC_UID%7D&rdf=1	0%	Avira URL Cloud	safe
https://idsync.rlcdn.com/709732.gif?partner_uid=86b58bad-5100-415b-b2de-9e5cb46a939d	0%	Avira URL Cloud	safe
https://pxl.iqm.com/i/ck/equativ?cid=5255026163917636486&gdpr=0&gdpr_consent=	0%	Avira URL Cloud	safe
https://us-u.openx.net/w/1.0/sd?id=537134162&val=86b58bad-5100-415b-b2de-9e5cb46a939d	0%	Avira URL Cloud	safe
https://sync.outbrain.com/cookie-sync?p=iqm&uid=86b58bad-5100-415b-b2de-9e5cb46a939d&initiator=partner&obUid=&gdpr=&gdpr_consent=&us_privacy=	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=iqm&google_cm	0%	Avira URL Cloud	safe
https://rtb-csync.smartadserver.com/redir/?partnerid=154&partneruserid=86b58bad-5100-415b-b2de-9e5cb46a939d&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fpxl.iqm.com%2Fi%2Fck%2Fequativ%3Fcid%3DSMART_USER_ID	0%	Avira URL Cloud	safe
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzM4MiZ0bD0xMjk2MDA%3D%26piggybackCookie%3D86b58bad-5100-415b-b2de-9e5cb46a939d%26r%3Dhttps%3A%2F%2Fpxl.iqm.com%2Fi%2Fck%2Fpubmatic%3Fpuid%3D%24%7BPUBMATIC_UID%7D	0%	Avira URL Cloud	safe
https://us-u.openx.net/w/1.0/sd?cc=1&id=537134162&val=86b58bad-5100-415b-b2de-9e5cb46a939d	0%	Avira URL Cloud	safe
https://pxl.iqm.com/i/ck/adx?google_gid=CAESELZMQz57FkVjUdHfdj_9pRw&google_cver=1	0%	Avira URL Cloud	safe
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202502060101/pubads_impl.js	0%	Avira URL Cloud	safe
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzM4MiZ0bD0xMjk2MDA=&piggybackCookie=86b58bad-5100-415b-b2de-9e5cb46a939d&r=https://pxl.iqm.com/i/ck/pubmatic?puid=${PUBMATIC_UID}	0%	Avira URL Cloud	safe
https://pxl.iqm.com/i/ck/pubmatic?puid=203C6FA7-9907-4F61-B35D-627F31C91DE8	0%	Avira URL Cloud	safe
https://securepubads.g.doubleclick.net/pagead/managed/dict/m202502110101/gpt	0%	Avira URL Cloud	safe
https://s.ad.smaato.net/c/?dspInit=1001145&dspCookie=86b58bad-5100-415b-b2de-9e5cb46a939d	0%	Avira URL Cloud	safe
https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHiYxz7pS_iYPkqryrfLki4&google_cver=1&google_push=AXcoOmQmyeWy6i5oVFJNa5NrYthu3Pf6JaBeHDuQog6oKZyfqOXXU7Vrrru9SLdTyoVpY2Z8CbSiLAbyNksKT8vGkWOufbn-r18WTQ	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4886830547503726&output=html&h=600&slotname=1741730887&adk=3518114871&adf=3175109377&pi=t.ma~as.1741730887&w=272&abgtt=6&fwrn=4&fwrnh=100&lmt=1741640951&rafmt=1&format=272x600&url=https%3A%2F%2Famericanliberty.news%2F&host=ca-host-pub-2644536267352236&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1741785840682&bpp=1&bdt=24468&idt=3561&shv=r20250305&mjsv=m202503110101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C889x280&nras=1&correlator=8788816613590&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=940&ady=1096&biw=1263&bih=897&scr_x=0&scr_y=1088&eid=31090875%2C42531514%2C95331833%2C95354314%2C95354334%2C95354598%2C31090954%2C95352178&oid=2&pvsid=3884848815089720&tmod=1679423523&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&pgls=CAEaBTYuNy4y~CAA.~CAEQBBoHMS4xNDcuMA..~CAA.&ifi=4&uci=a!4&fsb=1&dtd=3564	0%	Avira URL Cloud	safe
https://sync.ipredictive.com/d/sync/cookie/generic?https://cm.g.doubleclick.net/pixel?google_nid=adelphic_mobile&google_gid=CAESEJFsWAH1Yj9e4EcNCZCprW0&google_cver=1&google_push=AXcoOmT2KGgkYzbN_cWgMgciRQI3AiYRJHc_mniJvvx4GrKIL1hdpFtXAgS-ZwGMNkBZQZPWSx0YBhGP5c0iGIDG_5uoTh3SgSlTDvc&google_hm=${ADELPHIC_CUID_B64}	0%	Avira URL Cloud	safe
https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_gid=CAESEINVmehCdaQnb-XlcDOp8J8&google_cver=1&google_push=AXcoOmTjS3OwCcXsnvE3WLsIbHFohZXgAlJ3qHL1yUPcVOEgGWVB9k--yd9Cjdw69NNO4HLLQlCTMMMGH2R2UbCLvE83aLtKmL1EArqA	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=admaster&google_push=AXcoOmQAatflBUWwvxWrj8wG3zbuBvDqqyD_ke-zhL5xULyha_uSWU-mZeF7Jxx2KR959eqrjIrwgEadWlRHZ37AkqdWJNca4aJ0aL0&google_hm=3fa31b52d283e3542adxsl00m85ybqrh	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IYo7Dn2w1ZMxZkF5trGBpjIi-9gcNrzxAEz6kZ76jotJMexuifmqJ_4eMD1_gF7NOPOeELfA	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmTjS3OwCcXsnvE3WLsIbHFohZXgAlJ3qHL1yUPcVOEgGWVB9k--yd9Cjdw69NNO4HLLQlCTMMMGH2R2UbCLvE83aLtKmL1EArqA&google_hm=bFBwdjZVU3YwZFMx	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/f/AGSKWxWBandY-RkHKHav3pxgyOVVwVwyaQlodBCiV9T3EuH6YdeiuNX5bI-lIG3xqV8-3rSYqC61l9VGGigDeF5KK3eT6XqMWiGgVAapbDp8c3iCCovOb7cs_RY5jd-MrRDLKDWlaUJH7Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQxNzg1ODU0LDI3NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vYW1lcmljYW5saWJlcnR5Lm5ld3MvIixudWxsLFtbOCwiejY5cjZuU0NtWXciXSxbOSwiZW4tVVMiXSxbMjMsIjE3NDE3ODU4NDciXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiIl1dXQ	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K_7OaDTag0SdGCL5d0r61F1MbQGk0dkcgmst2ZN_5x251jI_jN481X3Dly0vtcaxfLm-vC9YQSGQ	0%	Avira URL Cloud	safe
https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_gid=CAESEINVmehCdaQnb-XlcDOp8J8&google_cver=1&google_push=AXcoOmSGZ3YNpJCMBqFgmpWJMy5aejQBbEUYpSVXbJ2y2u9fp5IG-CQJ1YEubPAxOfdZe-zZyAWgJt69PgLOaO42p0bt4GCtQyp12_dG	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LdotqjB6hKNRdwyBR72EeUfG7Fx2TXzFaccFGeXVkTO5dXfg42KtkUrWA3JIIXV_TeSB9z7tgZifU	0%	Avira URL Cloud	safe
https://gtrace.mediago.io/ju/cs/google?google_gid=CAESENlDefNtYr4xHTBjf6jUneg&google_cver=1&google_push=AXcoOmSGrKf_QvSG7A_d0UyX7WZ5iS0dqbm9BxAtpVvVtiBkskRuJKja9bp25NU_mLvV8g8eTO6Y3mapQtvKrD7zGWoZzQlxMYnvUts	0%	Avira URL Cloud	safe
https://gtracenep.admaster.cc/ju/cs/google?google_gid=CAESEDAfQp8MSJ84fVjtYu4io7A&google_cver=1&google_push=AXcoOmQAatflBUWwvxWrj8wG3zbuBvDqqyD_ke-zhL5xULyha_uSWU-mZeF7Jxx2KR959eqrjIrwgEadWlRHZ37AkqdWJNca4aJ0aL0	0%	Avira URL Cloud	safe
https://a.c.appier.net/gcm?google_gid=CAESEN8rMJN3NMdnmOvyGsbsxhE&google_cver=1&google_push=AXcoOmTGe3zRrihmTcgziFI01NHIDh3oE3rnnXhE57IswqIoM-9A98R0Jlnlfh5GKhWiI5M-ymwObS-lfWa4QIjDVxhOW7-GY_wyFD4	0%	Avira URL Cloud	safe
https://t.adx.opera.com/pub/sync?pubid=pub6871767557696&google_push=AXcoOmRrRU6bUKIUGbYTksiw501owxesAcoFbHrZvrojS4sVAics_6fvpTmkATT7GKpqHPQjMzZryEctXhGeYppwWbEKsz3j18zF-xCo&google_gid=CAESEAJIm4GMfeavQTy_Hhpp-sw&google_cver=1	0%	Avira URL Cloud	safe
https://www.google.com/pagead/drt/ui	0%	Avira URL Cloud	safe
https://a.c.appier.net/gcm?google_gid=CAESEN8rMJN3NMdnmOvyGsbsxhE&google_cver=1&google_push=AXcoOmSTC37UUITZtX-RsxC2AYPZA0ayO63qiyoJcNZfJI2zQZmXhAwFJKMIJmLO8FYGEfbyewa5hdnSXnD1UvSPaojED_KIBTGwuA	0%	Avira URL Cloud	safe
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQzszv9q9-MPAkhyTsXeEk9J3YUilFBNAc-7rOge9gVEbkCEcHrOou7DS5fJKPzKbbIQUl2jg4ys-Fif-mObHa_9y6Nwg	0%	Avira URL Cloud	safe
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFoY72_MMgz4wJIpe-D-lfU&google_cver=1&google_push=AXcoOmT1-DVBGLU-2q4ue8M0KaCLMIuGC_2TqB4HU3eVvnqxdkBTUkz_5XfysMM7_FSDEZvVvpUQyDNDOqwaJWxvhSlmPelI5MhFh5c	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4886830547503726&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1741640951&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Famericanliberty.news%2F&host=ca-host-pub-2644536267352236&pra=5&wgl=1&aihb=0&asro=0&ailel=1~2~4~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~3~4~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aiapm=0.15&aiapmi=0.33938&aiact=0.4&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1741785840676&bpp=3&bdt=24462&idt=3498&shv=r20250305&mjsv=m202503110101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=8788816613590&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1263&bih=897&scr_x=0&scr_y=1088&eid=31090875%2C42531514%2C95331833%2C95354314%2C95354334%2C95354598%2C31090954%2C95352178&oid=2&pvsid=3884848815089720&tmod=1679423523&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&pgls=CAEaBTYuNy4y~CAA.~CAEQBBoHMS4xNDcuMA..~CAA.&ifi=1&uci=a!1&fsb=1&dtd=3528	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4886830547503726&output=html&h=280&slotname=7937529607&adk=2285279923&adf=3601447045&pi=t.ma~as.7937529607&w=889&abgtt=6&fwrn=4&fwrnh=100&lmt=1741640951&rafmt=1&format=889x280&url=https%3A%2F%2Famericanliberty.news%2F&host=ca-host-pub-2644536267352236&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1741785840681&bpp=1&bdt=24467&idt=3550&shv=r20250305&mjsv=m202503110101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=8788816613590&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=20&ady=1925&biw=1263&bih=897&scr_x=0&scr_y=1088&eid=31090875%2C42531514%2C95331833%2C95354314%2C95354334%2C95354598%2C31090954%2C95352178&oid=2&pvsid=3884848815089720&tmod=1679423523&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&pgls=CAEaBTYuNy4y~CAA.~CAEQBBoHMS4xNDcuMA..~CAA.&ifi=3&uci=a!3&fsb=1&dtd=3554	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmTj8OL9IT3mkE9j5u7eO8erC7ufpMlx9GfoRJcofrUUKevePBwWIWDYfA3KyeJ_6fdxl2uQ7k8vkYVuS7o-vNy-fq7JExJOo0A&google_hm=3fa31b5271bcc8412zqd2600m85ybqrd	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmSGrKf_QvSG7A_d0UyX7WZ5iS0dqbm9BxAtpVvVtiBkskRuJKja9bp25NU_mLvV8g8eTO6Y3mapQtvKrD7zGWoZzQlxMYnvUts&google_hm=3fa31b52fcd69e262o05dd00m85ybqt3	0%	Avira URL Cloud	safe
https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEPaOYVuA-rldS4G0njZoDW8&google_cver=1&google_push=AXcoOmQ16iCywg9Osn1BOKNIplXmrCQjs-bmhGqldQK3f0drdz78mFAVcLejZrz9YeizqoDBUS6sPjcqSTV6KOzJQWf-n2MzuN1QlDQ	0%	Avira URL Cloud	safe
https://b1sync.outbrain.com/usersync/googleadx/?google_cver=1&google_gid=CAESEHCWZKz2qdvet2Rc9J6BDRs&google_push=AXcoOmR0fGM3jEFIhJnvSZkvw08tECwVX98f6bVIqN0rRQDtafl4aBER64YSdTMF1UTgwp4Q3zs04O1YE2IccOJbtj1NmwAhLOGg99c&s=2	0%	Avira URL Cloud	safe
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSxz3QL-CXnWEUTEkk9ghrY1wo7QLU0-QuzN_JM1X5_IUKmSnAhe3fxnhAe52_aV-Hp9_MG4gXtL2gluFGGcnGvxxOrKw	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/el/AGSKWxX5dYsmA5nd67yzPzfoqeNjlKxfyD5KxqNt2OiSoYnU8Tsb0Faz_Swf4nyzWXqVta2EvYoX6OimPIG1G4nT03D_Qwt1Oi-EU-PAeofnoHrgFFaFcTkCo0f-IGZPemcVNy8KnBjIbA==	0%	Avira URL Cloud	safe
https://www.google.com/ads/measurement/l?ebcid=ALh7CaS7lCINWw14Wgw9-uWMbHl1z59c18lJ49ZCM7GJanLZmuQhsftea__OIvUoaywRU2xgX71t8kYbTUKv69wSIWDtw1wdNw	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/i/ca-pub-4886830547503726?href=https%3A%2F%2Famericanliberty.news&ers=2	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4886830547503726&output=html&h=280&slotname=1144578901&adk=3430028035&adf=673178629&pi=t.ma~as.1144578901&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1741640951&rafmt=1&format=1200x280&url=https%3A%2F%2Famericanliberty.news%2F&host=ca-host-pub-2644536267352236&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1741785840679&bpp=2&bdt=24465&idt=3537&shv=r20250305&mjsv=m202503110101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=8788816613590&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=20&ady=243&biw=1263&bih=897&scr_x=0&scr_y=1088&eid=31090875%2C42531514%2C95331833%2C95354314%2C95354334%2C95354598%2C31090954%2C95352178&oid=2&pvsid=3884848815089720&tmod=1679423523&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&pgls=CAEaBTYuNy4y~CAA.~CAEQBBoHMS4xNDcuMA..~CAA.&ifi=2&uci=a!2&fsb=1&dtd=3543	0%	Avira URL Cloud	safe
https://a.c.appier.net/gcm?google_gid=CAESEN8rMJN3NMdnmOvyGsbsxhE&google_cver=1&google_push=AXcoOmSj0EFizUAzwY5AGtgKq7TKPb5lxc1Edg4Sfxd5WAXKlLBKSijzlb8dyVeMvPpOMUaTU7iJtzFq0T93iUr8m_LQcUrBgMDyiw	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmSGZ3YNpJCMBqFgmpWJMy5aejQBbEUYpSVXbJ2y2u9fp5IG-CQJ1YEubPAxOfdZe-zZyAWgJt69PgLOaO42p0bt4GCtQyp12_dG&google_hm=SnBJeTI2V2c3bno3	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/html/r20250305/r20190131/zrt_lookup_fy2021.html	0%	Avira URL Cloud	safe
https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEHCWZKz2qdvet2Rc9J6BDRs&google_cver=1&google_push=AXcoOmR0fGM3jEFIhJnvSZkvw08tECwVX98f6bVIqN0rRQDtafl4aBER64YSdTMF1UTgwp4Q3zs04O1YE2IccOJbtj1NmwAhLOGg99c	0%	Avira URL Cloud	safe
https://gtrace.mediago.io/ju/cs/google?google_gid=CAESENlDefNtYr4xHTBjf6jUneg&google_cver=1&google_push=AXcoOmTj8OL9IT3mkE9j5u7eO8erC7ufpMlx9GfoRJcofrUUKevePBwWIWDYfA3KyeJ_6fdxl2uQ7k8vkYVuS7o-vNy-fq7JExJOo0A	0%	Avira URL Cloud	safe
https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEEPRCs6Y03zbXJlo9cObZb4&google_cver=1&google_push=AXcoOmRDZgnDVPy6E9TyXH99RR4NDJph23yMESWWowsme-LXK1eqkavI2mOm985Q0br_uwbaMiNxilNY9WDd3Tre7EQnQUqiQJE0nYFD	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA	0%	Avira URL Cloud	safe
https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_gid=CAESEINVmehCdaQnb-XlcDOp8J8&google_cver=1&google_push=AXcoOmSP_1c5L1q2X3zx3ohfhDRWB8OrxLJ3fDsmeHUF9NGviZURlakpSwFi3_NXq9zojEX5VrzYSWE-qOInVpIyBKSCi4DH3NMHD-p1	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_hm=Rm1ZZlN0a2ZEOTJfRHVyWF9vclJadw%3D%3D&google_nid=appier&google_push=AXcoOmTGe3zRrihmTcgziFI01NHIDh3oE3rnnXhE57IswqIoM-9A98R0Jlnlfh5GKhWiI5M-ymwObS-lfWa4QIjDVxhOW7-GY_wyFD4	0%	Avira URL Cloud	safe
https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gda&tv=r20250305&st=env	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQmyeWy6i5oVFJNa5NrYthu3Pf6JaBeHDuQog6oKZyfqOXXU7Vrrru9SLdTyoVpY2Z8CbSiLAbyNksKT8vGkWOufbn-r18WTQ&google_hm=eS01T1VTNHYxRTJwRVhqM2VZZmlDZ09TWkNoYWpHc2UxZ35B	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmRCEp7nQ_NK9ANzuj0nehv7Z3Ly_dOaAzASl06K28rW2wSLG6pBWCfumrB4pyGvPcEAOR76wKY4xChJX3X_PLhHF96cZV5Y4p6w&google_nid=whaleco_services_llc	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEAJIm4GMfeavQTy_Hhpp-sw&google_hm=T1BVMTA2N2U4NDQ0NzFiNGExMzhlZWQxODUxNjFhOGJkMWM&google_nid=opera_norway_as&google_push=AXcoOmRrRU6bUKIUGbYTksiw501owxesAcoFbHrZvrojS4sVAics_6fvpTmkATT7GKpqHPQjMzZryEctXhGeYppwWbEKsz3j18zF-xCo	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/el/AGSKWxWbXAIRWHtmoabEikmmY6cu8e6glSpAfo_QHW_56PqZnbvJxcPVhZGfkYhXOlinuQU5enbYPMhLW4VMMPIt0iPao_QH8-TnSqQxByT3N-jnS8TP7bdlTsAkyKGlq-0wJySVRuSe6Q==	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQg6KAb18kkVjKbOSpX7u_1-GQACxY3gLiwB7cjbY8QXLQnMYfYeJw4gagpaD9vG0xJQFCqJH9E-jURo-PDgo2wI0DwRuPM5zY	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmSP_1c5L1q2X3zx3ohfhDRWB8OrxLJ3fDsmeHUF9NGviZURlakpSwFi3_NXq9zojEX5VrzYSWE-qOInVpIyBKSCi4DH3NMHD-p1&google_hm=Mjd6bUZVc2t1bTZ3	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_hm=T0Q3dHl0Z3NDTnllUHFKdV9vclJadw%3D%3D&google_nid=appier&google_push=AXcoOmSj0EFizUAzwY5AGtgKq7TKPb5lxc1Edg4Sfxd5WAXKlLBKSijzlb8dyVeMvPpOMUaTU7iJtzFq0T93iUr8m_LQcUrBgMDyiw	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmR0fGM3jEFIhJnvSZkvw08tECwVX98f6bVIqN0rRQDtafl4aBER64YSdTMF1UTgwp4Q3zs04O1YE2IccOJbtj1NmwAhLOGg99c&google_hm=ZDQ4NWM1MzQtZjYzMy00NDk2LWIxZjMtMjc3YzUzYTIxZGQy	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmRDZgnDVPy6E9TyXH99RR4NDJph23yMESWWowsme-LXK1eqkavI2mOm985Q0br_uwbaMiNxilNY9WDd3Tre7EQnQUqiQJE0nYFD&google_hm=MTAyMzcyNDA1MjYwNjA0MTYwMg==	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzQ4MDkxMzI4ODE3NTI4NjYzNA%3D%3D&google_push=AXcoOmSc95Aa6oJdKAkdQemwoIBki2lZTUa1148zTpqB3mCs2Qk7tR3gUmCSGmR_JojEkSH-LKWZ5QUxkZjyecsLvOPX5DwWlBR4jNo	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=adelphic_mobile&google_gid=CAESEJFsWAH1Yj9e4EcNCZCprW0&google_cver=1&google_push=AXcoOmT2KGgkYzbN_cWgMgciRQI3AiYRJHc_mniJvvx4GrKIL1hdpFtXAgS-ZwGMNkBZQZPWSx0YBhGP5c0iGIDG_5uoTh3SgSlTDvc&google_hm=frOvSO7iThC-zEBa9V78tQ==	0%	Avira URL Cloud	safe
https://www.googletagservices.com/agrp/prod/model_person_country_code_US_person_region_code_494e5f353237.json	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmT1-DVBGLU-2q4ue8M0KaCLMIuGC_2TqB4HU3eVvnqxdkBTUkz_5XfysMM7_FSDEZvVvpUQyDNDOqwaJWxvhSlmPelI5MhFh5c&google_hm=voQiChQK5dZvuVRMSmyrMQ	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzQ4MDkxMzI4ODE3NDY5NjgxNQ%3D%3D&google_push=AXcoOmSSLFezJiaajaZ9MsiEnGyv_dk3TpIY2cAMZ0j06MwtZ1qYjSICYuVP3Njhoe0zboypxdRBZDp0VC0lnL2cckEZCkpezCZFrg	0%	Avira URL Cloud	safe
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEHCWZKz2qdvet2Rc9J6BDRs&google_push=AXcoOmR0fGM3jEFIhJnvSZkvw08tECwVX98f6bVIqN0rRQDtafl4aBER64YSdTMF1UTgwp4Q3zs04O1YE2IccOJbtj1NmwAhLOGg99c&obuid=d485c534-f633-4496-b1f3-277c53a21dd2&s=2	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_hm=OVBMcWc2LTFEVU94OU1iQ19vclJadw%3D%3D&google_nid=appier&google_push=AXcoOmSTC37UUITZtX-RsxC2AYPZA0ayO63qiyoJcNZfJI2zQZmXhAwFJKMIJmLO8FYGEfbyewa5hdnSXnD1UvSPaojED_KIBTGwuA	0%	Avira URL Cloud	safe
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEEMElUOJrYnHuyrDl18U8D8&google_cver=1&google_push=AXcoOmRARLR8AY1flYjMh_pE-_uJqw-wTB67gM9loa4c2V1kw2n6McS2fr_ZO4AFWW8OgF1_ad3O5dDpTLpM7ydyno0EyXsdBUGCjA	0%	Avira URL Cloud	safe
https://i.liadm.com/s/c/a-08d5?duid=56b099d6a41d--01jp58cz7pcx8ehyr01w0xw6j4&euns=0&s=CjYKBQgKEKMaCgYI3QEQoxoKBgilARCjGgoGCIACEKUaCgYIogEQoxoKBgjSARCjGgoFCH4Qoxo&version=v3.8.0&cd=.americanliberty.news&pv=2b13d886-32f6-48ca-b62a-f14d9ab2571f	0%	Avira URL Cloud	safe
https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEEMElUOJrYnHuyrDl18U8D8&google_cver=1&google_push=AXcoOmRARLR8AY1flYjMh_pE-_uJqw-wTB67gM9loa4c2V1kw2n6McS2fr_ZO4AFWW8OgF1_ad3O5dDpTLpM7ydyno0EyXsdBUGCjA	0%	Avira URL Cloud	safe
https://secure.gravatar.com/avatar/?s=96&d=mm&r=pg	0%	Avira URL Cloud	safe
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmQZY0Hgb0hrEMEcnztfhqMw5LmA0QItRpBb4OTriOyDe0u--NEdThamMGrAzX1KQ6aoPTpe8Augs2wh9CaHOfN9AryMkODyuUw	0%	Avira URL Cloud	safe
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmT8QbKBadUUCUeWvePaqK9m3PsmF2Er2SmuL5BkkAlfYKqvCLf_cbXyPW9caclDrFAU_WdLLgbszasFv6p_giukkMadwWS3	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEUGxFN1BveFlBQUJvRlN1ZkRjQQ&google_push=AXcoOmQZY0Hgb0hrEMEcnztfhqMw5LmA0QItRpBb4OTriOyDe0u--NEdThamMGrAzX1KQ6aoPTpe8Augs2wh9CaHOfN9AryMkODyuUw&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1	0%	Avira URL Cloud	safe
https://apmaffiliates.com/creatives/LIGHT_NEWOP2_241104_PostElection_Trump_Banner-Ads_JP_970x90.jpg	0%	Avira URL Cloud	safe
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmQqeTvbQ6fMLPbV7JrAOzhT6EJtEt6uRxZfk_dIVUZGq2msjUyu7Y4gqJKhWoYfby71iA8LMi288x9ptSNO_nACdP1Z5lIQGw	0%	Avira URL Cloud	safe
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmRj1-aUI58w2ZLw0Lp3lG628UnFDNIl1cayqT0ydTT06yOLrXUoP_BjdrRzA7Dy7QoDRpDwbppr5rgz86nx5CG_4j_ylLrAG1vK	0%	Avira URL Cloud	safe
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEBFMIbEaOraMp-aZGEgg2FU&google_cver=1&google_push=AXcoOmTCWNxFPgzeBHU-8vIYtG7Gq0qLPSnANucjRCjdkEq1i_sJf1xUgfF7wRURO41fCiJ9DFuN27jkaDd5FXi3wjY9ewBW2kViq4g	0%	Avira URL Cloud	safe
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEBFMIbEaOraMp-aZGEgg2FU&google_cver=1&google_push=AXcoOmTCWNxFPgzeBHU-8vIYtG7Gq0qLPSnANucjRCjdkEq1i_sJf1xUgfF7wRURO41fCiJ9DFuN27jkaDd5FXi3wjY9ewBW2kViq4g	0%	Avira URL Cloud	safe
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmQZY0Hgb0hrEMEcnztfhqMw5LmA0QItRpBb4OTriOyDe0u--NEdThamMGrAzX1KQ6aoPTpe8Augs2wh9CaHOfN9AryMkODyuUw&_bee_ppp=1	0%	Avira URL Cloud	safe
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmRj1-aUI58w2ZLw0Lp3lG628UnFDNIl1cayqT0ydTT06yOLrXUoP_BjdrRzA7Dy7QoDRpDwbppr5rgz86nx5CG_4j_ylLrAG1vK&_bee_ppp=1	0%	Avira URL Cloud	safe
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFNbWwwN1BveFlBQUZJaklQdGt5UQ&google_push=AXcoOmT8QbKBadUUCUeWvePaqK9m3PsmF2Er2SmuL5BkkAlfYKqvCLf_cbXyPW9caclDrFAU_WdLLgbszasFv6p_giukkMadwWS3&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
securepubads.g.doubleclick.net	142.250.186.130	true	false	high
global.px.quantserve.com	91.228.74.200	true	false	high
i.ytimg.com	172.217.18.22	true	false	high
d-ams1.turn.com	46.228.164.13	true	false	high
live.rezync.com	65.9.66.64	true	false	unknown
eu-eb2.3lift.com	13.248.245.213	true	false	high
sync-sc-main-was.aniview.com	172.240.45.96	true	false	high
americanlibertywatch.com	104.21.24.204	true	false	unknown
www.temu.com.cdn.cloudflare.net	104.18.43.206	true	false	high
stats.g.doubleclick.net	108.177.15.154	true	false	high
beacons6.gvt2.com	142.250.74.195	true	false	high
l-0005.l-msedge.net	13.107.42.14	true	false	high
livepixel-production.bln.liveintent.com	34.228.243.70	true	false	unknown
apmaffiliates.com	35.208.16.215	true	false	high
cm.g.doubleclick.net	142.250.184.226	true	false	high
idaas-ext.cph.liveintent.com	34.227.249.190	true	false	unknown
ds-pr-bh.ybp.gysm.yahoodns.net	52.212.73.41	true	false	high
www.google.com	142.250.186.164	true	false	high
publickeyservice-a.msmt-3.gcp.privacysandboxservices.com	34.49.23.1	true	false	high
partners-1864332697.us-east-1.elb.amazonaws.com	34.232.142.33	true	false	high
match.adsrvr.org	15.197.193.217	true	false	high
router.infolinks.com	172.66.42.247	true	false	high
dsp-cookie.adfarm1.adition.com	80.82.210.217	true	false	high
rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com	23.23.204.100	true	false	high
match.prod.bidr.io	52.19.97.248	true	false	high
nydc1.outbrain.org	64.202.112.63	true	false	high
us-u.openx.net	34.98.64.218	true	false	high
a-emea.rfihub.com.akadns.net	193.0.160.130	true	false	high
ep2.adtrafficquality.google	142.250.186.65	true	false	high
pixel-sync.sitescout.com	34.36.216.150	true	false	high
euw-ice.360yield.com	54.216.23.179	true	false	high
gtrace.mediago.io	35.214.168.80	true	false	high
cs.media.net	2.19.100.239	true	false	high
wt.rqtrk.eu	57.129.18.105	true	false	unknown
googleads.g.doubleclick.net	142.250.181.226	true	false	high
www3.l.google.com	142.250.181.238	true	false	high
a.tribalfusion.com	172.64.150.63	true	false	high
td.doubleclick.net	142.250.186.66	true	false	high
mid.rkdms.com	18.233.146.69	true	false	unknown
h2.shared.global.fastly.net	151.101.194.49	true	false	high
s.tribalfusion.com	172.64.150.63	true	false	high
secure.gravatar.com	192.0.73.2	true	false	high
static.cloudflareinsights.com	104.16.80.73	true	false	high
www.googletagservices.com	142.250.181.226	true	false	high
am1-direct-bgp.contextweb.com	208.93.169.131	true	false	high
beacons-handoff.gcp.gvt2.com	142.251.143.35	true	false	high
pugm-amsfpairbc.pubmnet.com	198.47.127.19	true	false	high
americanliberty.news	104.18.26.248	true	false	high
user-data-eu.bidswitch.net	35.214.136.108	true	false	high
idsync.rlcdn.com	35.244.174.68	true	false	high
widget.nl3.vip.prod.criteo.com	178.250.1.9	true	false	unknown
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	52.30.38.132	true	false	high
sync.srv.stackadapt.com	34.205.194.237	true	false	high
thrtle.com	52.201.118.45	true	false	unknown
io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com	52.86.1.23	true	false	unknown
am-vip001.taboola.com	141.226.228.48	true	false	high
rtb-csync-euw2.smartadserver.com	91.134.110.137	true	false	high
sync.ipredictive.com	54.175.218.176	true	false	high
gocm-jp.c.appier.net.akadns.net	172.105.203.31	true	false	high
ep1.adtrafficquality.google	142.250.185.130	true	false	high
pxl.iqm.com	54.88.142.103	true	false	unknown
dtsv6jbh1lgcv.cloudfront.net	13.32.99.104	true	false	unknown
adizio-stable-europe-west1.pumpkin.uverse.iponweb.net	35.206.140.87	true	false	high
beacons.gvt2.com	142.250.180.99	true	false	high
dsum-sec.casalemedia.com	104.18.26.193	true	false	high
s.ad.smaato.net	34.1.242.226	true	false	high
outspot2-ams.adx.opera.com	82.145.213.8	true	false	high
onetag-sys.com	51.89.9.254	true	false	high
pug-ams-bc.pubmnet.com	198.47.127.205	true	false	high
analytics.google.com	142.250.186.78	true	false	high
ib.anycast.adnxs.com	185.89.210.244	true	false	high
a.rfihub.com	unknown	unknown	false	unknown
dis.criteo.com	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
d.turn.com	unknown	unknown	false	unknown
bh.contextweb.com	unknown	unknown	false	high
simage2.pubmatic.com	unknown	unknown	false	high
partners.tremorhub.com	unknown	unknown	false	high
sli.americanliberty.news	unknown	unknown	false	unknown
users.api.jeeng.com	unknown	unknown	false	unknown
sync-tm.everesttech.net	unknown	unknown	false	high
t.adx.opera.com	unknown	unknown	false	high
image6.pubmatic.com	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
fundingchoicesmessages.google.com	unknown	unknown	false	high
a.c.appier.net	unknown	unknown	false	high
dsp.360yield.com	unknown	unknown	false	high
rtb-csync.smartadserver.com	unknown	unknown	false	high
www.temu.com	unknown	unknown	false	high
sync.bfmio.com	unknown	unknown	false	unknown
dpm.demdex.net	unknown	unknown	false	high
sync.outbrain.com	unknown	unknown	false	high
sync.aniview.com	unknown	unknown	false	unknown
publickeyservice.msmt.gcp.privacysandboxservices.com	unknown	unknown	false	high
pr-bh.ybp.yahoo.com	unknown	unknown	false	high
sync.taboola.com	unknown	unknown	false	unknown
x.bidswitch.net	unknown	unknown	false	high
b1sync.outbrain.com	unknown	unknown	false	unknown
i.liadm.com	unknown	unknown	false	high
gtracenep.admaster.cc	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cm.g.doubleclick.net/pixel?google_hm=Rm1ZZlN0a2ZEOTJfRHVyWF9vclJadw%3D%3D&google_nid=appier&google_push=AXcoOmTGe3zRrihmTcgziFI01NHIDh3oE3rnnXhE57IswqIoM-9A98R0Jlnlfh5GKhWiI5M-ymwObS-lfWa4QIjDVxhOW7-GY_wyFD4	false	Avira URL Cloud: safe	unknown
https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gda&tv=r20250305&st=env	false	Avira URL Cloud: safe	unknown
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015	false		high
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxWBandY-RkHKHav3pxgyOVVwVwyaQlodBCiV9T3EuH6YdeiuNX5bI-lIG3xqV8-3rSYqC61l9VGGigDeF5KK3eT6XqMWiGgVAapbDp8c3iCCovOb7cs_RY5jd-MrRDLKDWlaUJH7Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQxNzg1ODU0LDI3NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vYW1lcmljYW5saWJlcnR5Lm5ld3MvIixudWxsLFtbOCwiejY5cjZuU0NtWXciXSxbOSwiZW4tVVMiXSxbMjMsIjE3NDE3ODU4NDciXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiIl1dXQ	false	Avira URL Cloud: safe	unknown
https://us-u.openx.net/w/1.0/sd?cc=1&id=537134162&val=86b58bad-5100-415b-b2de-9e5cb46a939d	false	Avira URL Cloud: safe	unknown
https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_gid=CAESEINVmehCdaQnb-XlcDOp8J8&google_cver=1&google_push=AXcoOmTjS3OwCcXsnvE3WLsIbHFohZXgAlJ3qHL1yUPcVOEgGWVB9k--yd9Cjdw69NNO4HLLQlCTMMMGH2R2UbCLvE83aLtKmL1EArqA	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEAJIm4GMfeavQTy_Hhpp-sw&google_hm=T1BVMTA2N2U4NDQ0NzFiNGExMzhlZWQxODUxNjFhOGJkMWM&google_nid=opera_norway_as&google_push=AXcoOmRrRU6bUKIUGbYTksiw501owxesAcoFbHrZvrojS4sVAics_6fvpTmkATT7GKpqHPQjMzZryEctXhGeYppwWbEKsz3j18zF-xCo	false	Avira URL Cloud: safe	unknown
https://apmaffiliates.com/creatives/LIGHT_NEWOP2_241104_PostElection_Trump_Banner-Ads_JP_970x90.jpg	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEQ2xFN1BveGNBQUJzb2ZwbDFaZw&google_push=AXcoOmQqeTvbQ6fMLPbV7JrAOzhT6EJtEt6uRxZfk_dIVUZGq2msjUyu7Y4gqJKhWoYfby71iA8LMi288x9ptSNO_nACdP1Z5lIQGw&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JjKySHRSHPDjmqaEkhjrGNQCkKkvvmcPtK89EeQ8wHnExwCHIc	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCdm8wN1BveFlBQUVfbVI0eE5ydw&google_push=AXcoOmRj1-aUI58w2ZLw0Lp3lG628UnFDNIl1cayqT0ydTT06yOLrXUoP_BjdrRzA7Dy7QoDRpDwbppr5rgz86nx5CG_4j_ylLrAG1vK&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=iqm&google_cm	false	Avira URL Cloud: safe	unknown
https://bpi.rtactivate.com/tag/?id=21328&user_id=86b58bad-5100-415b-b2de-9e5cb46a939d	false	Avira URL Cloud: safe	unknown
https://eb2.3lift.com/getuid?redir=https://i.liadm.com/s/88342?bidder_id%3D246498%26bidder_uuid%3D$UID	false	Avira URL Cloud: safe	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmQqeTvbQ6fMLPbV7JrAOzhT6EJtEt6uRxZfk_dIVUZGq2msjUyu7Y4gqJKhWoYfby71iA8LMi288x9ptSNO_nACdP1Z5lIQGw&_bee_ppp=1	false	Avira URL Cloud: safe	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmQZY0Hgb0hrEMEcnztfhqMw5LmA0QItRpBb4OTriOyDe0u--NEdThamMGrAzX1KQ6aoPTpe8Augs2wh9CaHOfN9AryMkODyuUw	false	Avira URL Cloud: safe	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmT8QbKBadUUCUeWvePaqK9m3PsmF2Er2SmuL5BkkAlfYKqvCLf_cbXyPW9caclDrFAU_WdLLgbszasFv6p_giukkMadwWS3	false	Avira URL Cloud: safe	unknown
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEBFMIbEaOraMp-aZGEgg2FU&google_cver=1&google_push=AXcoOmSDUvl6Hr4JWKY7M1cXU5W21bMgbJ7rE1faciTWyfKgZJGUSKxLK0T4gnk52hkX0LHU7peZVg1okrunALTgr3qlRjptHynqIw	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LdotqjB6hKNRdwyBR72EeUfG7Fx2TXzFaccFGeXVkTO5dXfg42KtkUrWA3JIIXV_TeSB9z7tgZifU	false	Avira URL Cloud: safe	unknown
https://a.c.appier.net/gcm?google_gid=CAESEN8rMJN3NMdnmOvyGsbsxhE&google_cver=1&google_push=AXcoOmTGe3zRrihmTcgziFI01NHIDh3oE3rnnXhE57IswqIoM-9A98R0Jlnlfh5GKhWiI5M-ymwObS-lfWa4QIjDVxhOW7-GY_wyFD4	false	Avira URL Cloud: safe	unknown
https://pxl.iqm.com/i/ck/telaria?cid=67537e1f417546819ee5a7670d36297d&UIIQ=86b58bad-5100-415b-b2de-9e5cb46a939d	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/el/AGSKWxWbXAIRWHtmoabEikmmY6cu8e6glSpAfo_QHW_56PqZnbvJxcPVhZGfkYhXOlinuQU5enbYPMhLW4VMMPIt0iPao_QH8-TnSqQxByT3N-jnS8TP7bdlTsAkyKGlq-0wJySVRuSe6Q==	false	Avira URL Cloud: safe	unknown
https://i.ytimg.com/vi/aP3IphJH7zM/hqdefault.jpg	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmSP_1c5L1q2X3zx3ohfhDRWB8OrxLJ3fDsmeHUF9NGviZURlakpSwFi3_NXq9zojEX5VrzYSWE-qOInVpIyBKSCi4DH3NMHD-p1&google_hm=Mjd6bUZVc2t1bTZ3	false	Avira URL Cloud: safe	unknown
https://pxl.iqm.com/c/2e5b6cbe-5624-4339-b0bf-ad6dedd9e541	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmRCEp7nQ_NK9ANzuj0nehv7Z3Ly_dOaAzASl06K28rW2wSLG6pBWCfumrB4pyGvPcEAOR76wKY4xChJX3X_PLhHF96cZV5Y4p6w&google_nid=whaleco_services_llc	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmRDZgnDVPy6E9TyXH99RR4NDJph23yMESWWowsme-LXK1eqkavI2mOm985Q0br_uwbaMiNxilNY9WDd3Tre7EQnQUqiQJE0nYFD&google_hm=MTAyMzcyNDA1MjYwNjA0MTYwMg==	false	Avira URL Cloud: safe	unknown
https://cs.media.net/cksync?cs=3&type=iqm&ovsid=86b58bad-5100-415b-b2de-9e5cb46a939d	false	Avira URL Cloud: safe	unknown
https://t.adx.opera.com/pub/sync?pubid=pub6871767557696&google_push=AXcoOmRrRU6bUKIUGbYTksiw501owxesAcoFbHrZvrojS4sVAics_6fvpTmkATT7GKpqHPQjMzZryEctXhGeYppwWbEKsz3j18zF-xCo&google_gid=CAESEAJIm4GMfeavQTy_Hhpp-sw&google_cver=1	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCdm8wN1BveFlBQUVfbVI0eE5ydw&google_push=AXcoOmRRl5gWp2ayie3GOGIpX0wWLu2W-FHsDId8GFewlQ3kOlLOMccpLK1WxTE_qSpi18ccf1I0S6Rxcn0YnZABKd_E6S4Ykzs-xg&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=adelphic_mobile&google_gid=CAESEJFsWAH1Yj9e4EcNCZCprW0&google_cver=1&google_push=AXcoOmT2KGgkYzbN_cWgMgciRQI3AiYRJHc_mniJvvx4GrKIL1hdpFtXAgS-ZwGMNkBZQZPWSx0YBhGP5c0iGIDG_5uoTh3SgSlTDvc&google_hm=frOvSO7iThC-zEBa9V78tQ==	false	Avira URL Cloud: safe	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQzszv9q9-MPAkhyTsXeEk9J3YUilFBNAc-7rOge9gVEbkCEcHrOou7DS5fJKPzKbbIQUl2jg4ys-Fif-mObHa_9y6Nwg	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmTj8OL9IT3mkE9j5u7eO8erC7ufpMlx9GfoRJcofrUUKevePBwWIWDYfA3KyeJ_6fdxl2uQ7k8vkYVuS7o-vNy-fq7JExJOo0A&google_hm=3fa31b5271bcc8412zqd2600m85ybqrd	false	Avira URL Cloud: safe	unknown
https://sync.aniview.com/cookiesyncendpoint?biddername=212&key=86b58bad-5100-415b-b2de-9e5cb46a939d	false	Avira URL Cloud: safe	unknown
https://idsync.rlcdn.com/709732.gif?partner_uid=86b58bad-5100-415b-b2de-9e5cb46a939d	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4886830547503726&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1741640951&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Famericanliberty.news%2F&host=ca-host-pub-2644536267352236&pra=5&wgl=1&aihb=0&asro=0&ailel=1~2~4~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~3~4~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aiapm=0.15&aiapmi=0.33938&aiact=0.4&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1741785840676&bpp=3&bdt=24462&idt=3498&shv=r20250305&mjsv=m202503110101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=8788816613590&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1263&bih=897&scr_x=0&scr_y=1088&eid=31090875%2C42531514%2C95331833%2C95354314%2C95354334%2C95354598%2C31090954%2C95352178&oid=2&pvsid=3884848815089720&tmod=1679423523&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&pgls=CAEaBTYuNy4y~CAA.~CAEQBBoHMS4xNDcuMA..~CAA.&ifi=1&uci=a!1&fsb=1&dtd=3528	false	Avira URL Cloud: safe	unknown
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=google&bsw_custom_parameter=880d573e-b91a-40dd-8897-3b742f694bae	false	Avira URL Cloud: safe	unknown
https://rtb-csync.smartadserver.com/redir/?partnerid=154&partneruserid=86b58bad-5100-415b-b2de-9e5cb46a939d&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fpxl.iqm.com%2Fi%2Fck%2Fequativ%3Fcid%3DSMART_USER_ID	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzQ4MDkxMzI4ODE3NTI4NjYzNA%3D%3D&google_push=AXcoOmSc95Aa6oJdKAkdQemwoIBki2lZTUa1148zTpqB3mCs2Qk7tR3gUmCSGmR_JojEkSH-LKWZ5QUxkZjyecsLvOPX5DwWlBR4jNo	false	Avira URL Cloud: safe	unknown
https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEPaOYVuA-rldS4G0njZoDW8&google_cver=1&google_push=AXcoOmQ16iCywg9Osn1BOKNIplXmrCQjs-bmhGqldQK3f0drdz78mFAVcLejZrz9YeizqoDBUS6sPjcqSTV6KOzJQWf-n2MzuN1QlDQ	false	Avira URL Cloud: safe	unknown
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=americanliberty.news	false	Avira URL Cloud: safe	unknown
https://b1sync.outbrain.com/usersync/googleadx/?google_cver=1&google_gid=CAESEHCWZKz2qdvet2Rc9J6BDRs&google_push=AXcoOmR0fGM3jEFIhJnvSZkvw08tECwVX98f6bVIqN0rRQDtafl4aBER64YSdTMF1UTgwp4Q3zs04O1YE2IccOJbtj1NmwAhLOGg99c&s=2	false	Avira URL Cloud: safe	unknown
https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html	false		high
https://dpm.demdex.net/ibs:dpid=127444&dpuuid=	false	Avira URL Cloud: safe	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSxz3QL-CXnWEUTEkk9ghrY1wo7QLU0-QuzN_JM1X5_IUKmSnAhe3fxnhAe52_aV-Hp9_MG4gXtL2gluFGGcnGvxxOrKw	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmSGrKf_QvSG7A_d0UyX7WZ5iS0dqbm9BxAtpVvVtiBkskRuJKja9bp25NU_mLvV8g8eTO6Y3mapQtvKrD7zGWoZzQlxMYnvUts&google_hm=3fa31b52fcd69e262o05dd00m85ybqt3	false	Avira URL Cloud: safe	unknown
https://pxl.iqm.com/i/ck/adx?google_gid=CAESELZMQz57FkVjUdHfdj_9pRw&google_cver=1	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/el/AGSKWxX5dYsmA5nd67yzPzfoqeNjlKxfyD5KxqNt2OiSoYnU8Tsb0Faz_Swf4nyzWXqVta2EvYoX6OimPIG1G4nT03D_Qwt1Oi-EU-PAeofnoHrgFFaFcTkCo0f-IGZPemcVNy8KnBjIbA==	false	Avira URL Cloud: safe	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaS9ykv-NjcMGIROtwudZxvgmxNLy8A27vftVsxKvVGtALR8L5HBhYOIgXs6UlVRMYFZujq57s-3SALE7DVkMvY2ihedgA	false	Avira URL Cloud: safe	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaS7lCINWw14Wgw9-uWMbHl1z59c18lJ49ZCM7GJanLZmuQhsftea__OIvUoaywRU2xgX71t8kYbTUKv69wSIWDtw1wdNw	false	Avira URL Cloud: safe	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmRj1-aUI58w2ZLw0Lp3lG628UnFDNIl1cayqT0ydTT06yOLrXUoP_BjdrRzA7Dy7QoDRpDwbppr5rgz86nx5CG_4j_ylLrAG1vK	false	Avira URL Cloud: safe	unknown
https://sync.taboola.com/sg/smaatortb-network/1/rtb-h/?taboola_hm=76e31d5fd0&gdpr=0&gdpr_consent=	false	Avira URL Cloud: safe	unknown
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEHCWZKz2qdvet2Rc9J6BDRs&google_push=AXcoOmR0fGM3jEFIhJnvSZkvw08tECwVX98f6bVIqN0rRQDtafl4aBER64YSdTMF1UTgwp4Q3zs04O1YE2IccOJbtj1NmwAhLOGg99c&obuid=d485c534-f633-4496-b1f3-277c53a21dd2&s=2	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/i/ca-pub-4886830547503726?href=https%3A%2F%2Famericanliberty.news&ers=2	false	Avira URL Cloud: safe	unknown
https://a.c.appier.net/gcm?google_gid=CAESEN8rMJN3NMdnmOvyGsbsxhE&google_cver=1&google_push=AXcoOmSj0EFizUAzwY5AGtgKq7TKPb5lxc1Edg4Sfxd5WAXKlLBKSijzlb8dyVeMvPpOMUaTU7iJtzFq0T93iUr8m_LQcUrBgMDyiw	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmSGZ3YNpJCMBqFgmpWJMy5aejQBbEUYpSVXbJ2y2u9fp5IG-CQJ1YEubPAxOfdZe-zZyAWgJt69PgLOaO42p0bt4GCtQyp12_dG&google_hm=SnBJeTI2V2c3bno3	false	Avira URL Cloud: safe	unknown
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEBFMIbEaOraMp-aZGEgg2FU&google_cver=1&google_push=AXcoOmTCWNxFPgzeBHU-8vIYtG7Gq0qLPSnANucjRCjdkEq1i_sJf1xUgfF7wRURO41fCiJ9DFuN27jkaDd5FXi3wjY9ewBW2kViq4g	false	Avira URL Cloud: safe	unknown
https://s.ad.smaato.net/c/?dspInit=1001145&dspCookie=86b58bad-5100-415b-b2de-9e5cb46a939d	false	Avira URL Cloud: safe	unknown
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzM4MiZ0bD0xMjk2MDA=&piggybackCookie=86b58bad-5100-415b-b2de-9e5cb46a939d&r=https://pxl.iqm.com/i/ck/pubmatic?puid=${PUBMATIC_UID}	false	Avira URL Cloud: safe	unknown
https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEHCWZKz2qdvet2Rc9J6BDRs&google_cver=1&google_push=AXcoOmR0fGM3jEFIhJnvSZkvw08tECwVX98f6bVIqN0rRQDtafl4aBER64YSdTMF1UTgwp4Q3zs04O1YE2IccOJbtj1NmwAhLOGg99c	false	Avira URL Cloud: safe	unknown
https://pxl.iqm.com/i/ck/indexch?cmid=Z9GK6NHM56QAONmbASP78wAA	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/html/r20250305/r20190131/zrt_lookup_fy2021.html	false	Avira URL Cloud: safe	unknown
https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEEPRCs6Y03zbXJlo9cObZb4&google_cver=1&google_push=AXcoOmRDZgnDVPy6E9TyXH99RR4NDJph23yMESWWowsme-LXK1eqkavI2mOm985Q0br_uwbaMiNxilNY9WDd3Tre7EQnQUqiQJE0nYFD	false	Avira URL Cloud: safe	unknown
https://pxl.iqm.com/i/cookie/service/redirect?tagId=2e5b6cbe-5624-4339-b0bf-ad6dedd9e541	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAeJZ9UmqtoSbUh2nHJQ23s&google_push=AXcoOmSG2EF8emezcnarhzQ88PJ7LTn0bca4ny9Y_DxlyYNEe41xT3e_L8NKqjeOaqMRYzWUct2JCVX086pEw7lYdZnDbvKLo5Ckxg	false	Avira URL Cloud: safe	unknown
https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_gid=CAESEINVmehCdaQnb-XlcDOp8J8&google_cver=1&google_push=AXcoOmSP_1c5L1q2X3zx3ohfhDRWB8OrxLJ3fDsmeHUF9NGviZURlakpSwFi3_NXq9zojEX5VrzYSWE-qOInVpIyBKSCi4DH3NMHD-p1	false	Avira URL Cloud: safe	unknown
https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHiYxz7pS_iYPkqryrfLki4&google_cver=1&google_push=AXcoOmQmyeWy6i5oVFJNa5NrYthu3Pf6JaBeHDuQog6oKZyfqOXXU7Vrrru9SLdTyoVpY2Z8CbSiLAbyNksKT8vGkWOufbn-r18WTQ	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQg6KAb18kkVjKbOSpX7u_1-GQACxY3gLiwB7cjbY8QXLQnMYfYeJw4gagpaD9vG0xJQFCqJH9E-jURo-PDgo2wI0DwRuPM5zY	false	Avira URL Cloud: safe	unknown
https://sync.outbrain.com/cookie-sync?p=iqm&uid=86b58bad-5100-415b-b2de-9e5cb46a939d&initiator=partner&obUid=&gdpr=&gdpr_consent=&us_privacy=	false	Avira URL Cloud: safe	unknown
https://americanliberty.news/	true		unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmRRl5gWp2ayie3GOGIpX0wWLu2W-FHsDId8GFewlQ3kOlLOMccpLK1WxTE_qSpi18ccf1I0S6Rxcn0YnZABKd_E6S4Ykzs-xg	false	Avira URL Cloud: safe	unknown
https://sync.ipredictive.com/d/sync/cookie/generic?https://cm.g.doubleclick.net/pixel?google_nid=adelphic_mobile&google_gid=CAESEJFsWAH1Yj9e4EcNCZCprW0&google_cver=1&google_push=AXcoOmT2KGgkYzbN_cWgMgciRQI3AiYRJHc_mniJvvx4GrKIL1hdpFtXAgS-ZwGMNkBZQZPWSx0YBhGP5c0iGIDG_5uoTh3SgSlTDvc&google_hm=${ADELPHIC_CUID_B64}	false	Avira URL Cloud: safe	unknown
https://publickeyservice.msmt.gcp.privacysandboxservices.com/.well-known/aggregation-service/v1/public-keys	false		high
https://ep2.adtrafficquality.google/sodar/sodar2.js	false		high
https://partners.tremorhub.com/sync?UIIQ=86b58bad-5100-415b-b2de-9e5cb46a939d	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEUGxFN1BveFlBQUJvRlN1ZkRjQQ&google_push=AXcoOmQZY0Hgb0hrEMEcnztfhqMw5LmA0QItRpBb4OTriOyDe0u--NEdThamMGrAzX1KQ6aoPTpe8Augs2wh9CaHOfN9AryMkODyuUw&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4886830547503726&output=html&h=600&slotname=1741730887&adk=3518114871&adf=3175109377&pi=t.ma~as.1741730887&w=272&abgtt=6&fwrn=4&fwrnh=100&lmt=1741640951&rafmt=1&format=272x600&url=https%3A%2F%2Famericanliberty.news%2F&host=ca-host-pub-2644536267352236&fwr=0&fwrattr=true&rpe=1&resp_fmts=4&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTM0LjAuNjk5OC4zNiIsbnVsbCwwLG51bGwsIjY0IixbWyJDaHJvbWl1bSIsIjEzNC4wLjY5OTguMzYiXSxbIk5vdDpBLUJyYW5kIiwiMjQuMC4wLjAiXSxbIkdvb2dsZSBDaHJvbWUiLCIxMzQuMC42OTk4LjM2Il1dLDBd&dt=1741785840682&bpp=1&bdt=24468&idt=3561&shv=r20250305&mjsv=m202503110101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C889x280&nras=1&correlator=8788816613590&frm=20&pv=1&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=940&ady=1096&biw=1263&bih=897&scr_x=0&scr_y=1088&eid=31090875%2C42531514%2C95331833%2C95354314%2C95354334%2C95354598%2C31090954%2C95352178&oid=2&pvsid=3884848815089720&tmod=1679423523&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C897&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&pgls=CAEaBTYuNy4y~CAA.~CAEQBBoHMS4xNDcuMA..~CAA.&ifi=4&uci=a!4&fsb=1&dtd=3564	false	Avira URL Cloud: safe	unknown
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzM4MiZ0bD0xMjk2MDA%3D%26piggybackCookie%3D86b58bad-5100-415b-b2de-9e5cb46a939d%26r%3Dhttps%3A%2F%2Fpxl.iqm.com%2Fi%2Fck%2Fpubmatic%3Fpuid%3D%24%7BPUBMATIC_UID%7D&rdf=1	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmTjS3OwCcXsnvE3WLsIbHFohZXgAlJ3qHL1yUPcVOEgGWVB9k--yd9Cjdw69NNO4HLLQlCTMMMGH2R2UbCLvE83aLtKmL1EArqA&google_hm=bFBwdjZVU3YwZFMx	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=admaster&google_push=AXcoOmQAatflBUWwvxWrj8wG3zbuBvDqqyD_ke-zhL5xULyha_uSWU-mZeF7Jxx2KR959eqrjIrwgEadWlRHZ37AkqdWJNca4aJ0aL0&google_hm=3fa31b52d283e3542adxsl00m85ybqrh	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K_7OaDTag0SdGCL5d0r61F1MbQGk0dkcgmst2ZN_5x251jI_jN481X3Dly0vtcaxfLm-vC9YQSGQ	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/aframe	false		high
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IYo7Dn2w1ZMxZkF5trGBpjIi-9gcNrzxAEz6kZ76jotJMexuifmqJ_4eMD1_gF7NOPOeELfA	false	Avira URL Cloud: safe	unknown
https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEEMElUOJrYnHuyrDl18U8D8&google_cver=1&google_push=AXcoOmRARLR8AY1flYjMh_pE-_uJqw-wTB67gM9loa4c2V1kw2n6McS2fr_ZO4AFWW8OgF1_ad3O5dDpTLpM7ydyno0EyXsdBUGCjA	false	Avira URL Cloud: safe	unknown
https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_gid=CAESEINVmehCdaQnb-XlcDOp8J8&google_cver=1&google_push=AXcoOmSGZ3YNpJCMBqFgmpWJMy5aejQBbEUYpSVXbJ2y2u9fp5IG-CQJ1YEubPAxOfdZe-zZyAWgJt69PgLOaO42p0bt4GCtQyp12_dG	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_hm=T0Q3dHl0Z3NDTnllUHFKdV9vclJadw%3D%3D&google_nid=appier&google_push=AXcoOmSj0EFizUAzwY5AGtgKq7TKPb5lxc1Edg4Sfxd5WAXKlLBKSijzlb8dyVeMvPpOMUaTU7iJtzFq0T93iUr8m_LQcUrBgMDyiw	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmR0fGM3jEFIhJnvSZkvw08tECwVX98f6bVIqN0rRQDtafl4aBER64YSdTMF1UTgwp4Q3zs04O1YE2IccOJbtj1NmwAhLOGg99c&google_hm=ZDQ4NWM1MzQtZjYzMy00NDk2LWIxZjMtMjc3YzUzYTIxZGQy	false	Avira URL Cloud: safe	unknown
https://gtrace.mediago.io/ju/cs/google?google_gid=CAESENlDefNtYr4xHTBjf6jUneg&google_cver=1&google_push=AXcoOmSGrKf_QvSG7A_d0UyX7WZ5iS0dqbm9BxAtpVvVtiBkskRuJKja9bp25NU_mLvV8g8eTO6Y3mapQtvKrD7zGWoZzQlxMYnvUts	false	Avira URL Cloud: safe	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESECWR4z5sGR32acaeT6A3eYE&google_cver=1&google_push=AXcoOmQZY0Hgb0hrEMEcnztfhqMw5LmA0QItRpBb4OTriOyDe0u--NEdThamMGrAzX1KQ6aoPTpe8Augs2wh9CaHOfN9AryMkODyuUw&_bee_ppp=1	false	Avira URL Cloud: safe	unknown
https://i.liadm.com/s/c/a-08d5?duid=56b099d6a41d--01jp58cz7pcx8ehyr01w0xw6j4&euns=0&s=CjYKBQgKEKMaCgYI3QEQoxoKBgilARCjGgoGCIACEKUaCgYIogEQoxoKBgjSARCjGgoFCH4Qoxo&version=v3.8.0&cd=.americanliberty.news&pv=2b13d886-32f6-48ca-b62a-f14d9ab2571f	false	Avira URL Cloud: safe	unknown
https://securepubads.g.doubleclick.net/pagead/managed/dict/m202502110101/gpt	false	Avira URL Cloud: safe	unknown
https://gtracenep.admaster.cc/ju/cs/google?google_gid=CAESEDAfQp8MSJ84fVjtYu4io7A&google_cver=1&google_push=AXcoOmQAatflBUWwvxWrj8wG3zbuBvDqqyD_ke-zhL5xULyha_uSWU-mZeF7Jxx2KR959eqrjIrwgEadWlRHZ37AkqdWJNca4aJ0aL0	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQmyeWy6i5oVFJNa5NrYthu3Pf6JaBeHDuQog6oKZyfqOXXU7Vrrru9SLdTyoVpY2Z8CbSiLAbyNksKT8vGkWOufbn-r18WTQ&google_hm=eS01T1VTNHYxRTJwRVhqM2VZZmlDZ09TWkNoYWpHc2UxZ35B	false	Avira URL Cloud: safe	unknown
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MWJmNTVjZWUtZjQ1Yy00ODFhLTlmNmUtNDFmYTc4MzQ2OWE0&google_push&gdpr=0&gdpr_consent=&ttd_tdid=1bf55cee-f45c-481a-9f6e-41fa783469a4	false	Avira URL Cloud: safe	unknown
https://a.c.appier.net/gcm?google_gid=CAESEN8rMJN3NMdnmOvyGsbsxhE&google_cver=1&google_push=AXcoOmSTC37UUITZtX-RsxC2AYPZA0ayO63qiyoJcNZfJI2zQZmXhAwFJKMIJmLO8FYGEfbyewa5hdnSXnD1UvSPaojED_KIBTGwuA	false	Avira URL Cloud: safe	unknown
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0	false		high
https://www.google.com/pagead/drt/ui	false	Avira URL Cloud: safe	unknown
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFoY72_MMgz4wJIpe-D-lfU&google_cver=1&google_push=AXcoOmT1-DVBGLU-2q4ue8M0KaCLMIuGC_2TqB4HU3eVvnqxdkBTUkz_5XfysMM7_FSDEZvVvpUQyDNDOqwaJWxvhSlmPelI5MhFh5c	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.74.202	unknown	United States	15169	GOOGLEUS	false
35.170.28.172	unknown	United States	14618	AMAZON-AESUS	false
91.228.74.200	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
142.250.186.150	unknown	United States	15169	GOOGLEUS	false
142.250.185.226	unknown	United States	15169	GOOGLEUS	false
34.1.242.226	s.ad.smaato.net	United States	2686	ATGS-MMD-ASUS	false
104.16.80.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
57.129.18.111	unknown	Belgium	2686	ATGS-MMD-ASUS	false
142.251.36.35	unknown	United States	15169	GOOGLEUS	false
198.47.127.205	pug-ams-bc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
34.227.249.190	idaas-ext.cph.liveintent.com	United States	14618	AMAZON-AESUS	false
142.250.186.78	analytics.google.com	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.248.245.213	eu-eb2.3lift.com	United States	16509	AMAZON-02US	false
216.58.206.40	unknown	United States	15169	GOOGLEUS	false
192.0.73.2	secure.gravatar.com	United States	2635	AUTOMATTICUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
2.19.100.239	cs.media.net	European Union	16625	AKAMAI-ASUS	false
172.217.18.2	unknown	United States	15169	GOOGLEUS	false
54.175.218.176	sync.ipredictive.com	United States	14618	AMAZON-AESUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
193.0.160.130	a-emea.rfihub.com.akadns.net	Netherlands	54312	ROCKETFUELUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
35.244.174.68	idsync.rlcdn.com	United States	15169	GOOGLEUS	false
216.58.212.162	unknown	United States	15169	GOOGLEUS	false
35.208.16.215	apmaffiliates.com	United States	19527	GOOGLE-2US	false
34.232.142.33	partners-1864332697.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
142.250.186.130	securepubads.g.doubleclick.net	United States	15169	GOOGLEUS	false
216.58.206.34	unknown	United States	15169	GOOGLEUS	false
208.93.169.131	am1-direct-bgp.contextweb.com	United States	26228	SERVEPATHUS	false
46.228.164.13	d-ams1.turn.com	United Kingdom	56396	TURNGB	false
142.250.181.238	www3.l.google.com	United States	15169	GOOGLEUS	false
52.212.73.41	ds-pr-bh.ybp.gysm.yahoodns.net	United States	16509	AMAZON-02US	false
18.206.29.216	unknown	United States	14618	AMAZON-AESUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
142.250.185.161	unknown	United States	15169	GOOGLEUS	false
141.226.228.48	am-vip001.taboola.com	Israel	200478	TABOOLA-ASIL	false
52.201.118.45	thrtle.com	United States	14618	AMAZON-AESUS	false
172.217.18.98	unknown	United States	15169	GOOGLEUS	false
70.42.32.95	unknown	United States	22075	AS-OUTBRAINUS	false
104.18.26.248	americanliberty.news	United States	13335	CLOUDFLARENETUS	false
3.223.152.2	unknown	United States	14618	AMAZON-AESUS	false
44.196.116.96	unknown	United States	14618	AMAZON-AESUS	false
178.250.1.9	widget.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
34.36.216.150	pixel-sync.sitescout.com	United States	2686	ATGS-MMD-ASUS	false
104.18.26.193	dsum-sec.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
35.214.168.80	gtrace.mediago.io	United States	19527	GOOGLE-2US	false
142.250.181.226	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
18.233.146.69	mid.rkdms.com	United States	14618	AMAZON-AESUS	false
172.217.18.22	i.ytimg.com	United States	15169	GOOGLEUS	false
65.9.66.64	live.rezync.com	United States	16509	AMAZON-02US	false
52.19.97.248	match.prod.bidr.io	United States	16509	AMAZON-02US	false
64.202.112.63	nydc1.outbrain.org	United States	22075	AS-OUTBRAINUS	false
142.250.185.97	unknown	United States	15169	GOOGLEUS	false
142.250.186.66	td.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.186.65	ep2.adtrafficquality.google	United States	15169	GOOGLEUS	false
142.250.185.98	unknown	United States	15169	GOOGLEUS	false
108.177.15.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
91.134.110.137	rtb-csync-euw2.smartadserver.com	France	16276	OVHFR	false
23.23.204.100	rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
52.86.1.23	io-cookie-sync-1725936127.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
54.216.23.179	euw-ice.360yield.com	United States	16509	AMAZON-02US	false
142.250.184.225	unknown	United States	15169	GOOGLEUS	false
142.250.184.226	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.67.220.135	unknown	United States	13335	CLOUDFLARENETUS	false
64.202.112.95	unknown	United States	22075	AS-OUTBRAINUS	false
52.70.202.150	unknown	United States	14618	AMAZON-AESUS	false
172.240.45.96	sync-sc-main-was.aniview.com	United States	7979	SERVERS-COMUS	false
142.250.185.65	unknown	United States	15169	GOOGLEUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.34	unknown	United States	15169	GOOGLEUS	false
34.49.23.1	publickeyservice-a.msmt-3.gcp.privacysandboxservices.com	United States	2686	ATGS-MMD-ASUS	false
185.89.210.244	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
142.250.184.194	unknown	United States	15169	GOOGLEUS	false
172.64.150.63	a.tribalfusion.com	United States	13335	CLOUDFLARENETUS	false
142.251.173.84	unknown	United States	15169	GOOGLEUS	false
13.107.42.14	l-0005.l-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.32.99.3	unknown	United States	16509	AMAZON-02US	false
198.47.127.19	pugm-amsfpairbc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
64.202.112.223	unknown	United States	22075	AS-OUTBRAINUS	false
35.206.140.87	adizio-stable-europe-west1.pumpkin.uverse.iponweb.net	United States	19527	GOOGLE-2US	false
80.82.210.217	dsp-cookie.adfarm1.adition.com	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	false
142.250.186.100	unknown	United States	15169	GOOGLEUS	false
142.250.185.74	unknown	United States	15169	GOOGLEUS	false
82.145.213.8	outspot2-ams.adx.opera.com	United Kingdom	39832	NO-OPERANO	false
172.105.203.31	gocm-jp.c.appier.net.akadns.net	United States	63949	LINODE-APLinodeLLCUS	false
35.214.136.108	user-data-eu.bidswitch.net	United States	19527	GOOGLE-2US	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
151.101.194.49	h2.shared.global.fastly.net	United States	54113	FASTLYUS	false
54.88.142.103	pxl.iqm.com	United States	14618	AMAZON-AESUS	false
142.250.186.174	unknown	United States	15169	GOOGLEUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
15.197.193.217	match.adsrvr.org	United States	7430	TANDEMUS	false
172.217.23.99	unknown	United States	15169	GOOGLEUS	false
104.18.43.206	www.temu.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
172.217.23.98	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636205
Start date and time:	2025-03-12 14:22:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://americanlibertywatch.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@32/223@257/808

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.14, 216.58.212.131, 142.250.185.238, 142.251.173.84, 216.58.206.46, 142.250.185.206, 216.58.206.78
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://americanlibertywatch.com

Source: https://americanliberty.news/	HTTP Parser: Base64 decoded: <script>
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: Base64 decoded: document.write
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: Base64 decoded: <script>

Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CnRlbXBfam1fbG9nY29uc29sZSA9IHdpbmRvdy5jb25zb2xlLmxvZzsgd2luZG93LmNvbnNvbGUubG9nPW51bGw7Cg==
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CndpbmRvdy5jb25zb2xlLmxvZz10ZW1wX2ptX2xvZ2NvbnNvbGU7Cg==
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiAgd2luZG93Lmdvb2dsZXRhZyA9IHdpbmRvdy5nb29nbGV0YWcgfHwge2NtZDogW119OwogIGdvb2dsZXRhZy5jbWQucHVzaChmdW5jdGlvbigpIHsKICAgIGdvb2dsZXRhZy5kZWZpbmVTbG90KCcvMjI3MjQwNjE0MjcvQUxOL0FMTi1JQzEnLCBbWzMwMCwgMjUwXSwgWzMzNiwgMjgwXSwgWz
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmZ1bmN0aW9uIGFpX3dhaXRfZm9yX2Z1bmN0aW9ucygpe2Z1bmN0aW9uIGEoYixjKXsidW5kZWZpbmVkIiE9PXR5cGVvZiBhaV9mdW5jdGlvbnM/YihhaV9mdW5jdGlvbnMpOjVFMzw9RGF0ZS5ub3coKS1kP2MoRXJyb3IoIkFJIEZVTkNUSU9OUyBOT1QgTE9BREVEIikpOnNldFRpbWVvdXQoYS
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNvbnRlbnRMb2FkZWQiLCBmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIGNsYXNzUmVtb3ZlKCkgewogICAgICAgIHZhciBtYXJxdWVlRGl2ID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLm1hcnF1ZWUtMScpOwogICAgICAgIGlmIChtYX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiAgZnVuY3Rpb24gYXBwbHlEYXJrTW9kZVN0eWxlcygpIHsKICAgIGlmIChkb2N1bWVudC5ib2R5LmNsYXNzTGlzdC5jb250YWlucygnZGFyaycpKSB7CiAgICAgICAgY29uc3QgZWxlbWVudHNUb1N0eWxlID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvckFsbCgnaDEsIGgyLCBoMywgaDQsIGg1LC
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiJ1c2Ugc3RyaWN0Ijt2YXIgX2NyZWF0ZUNsYXNzPWZ1bmN0aW9uKCl7ZnVuY3Rpb24gZGVmaW5lUHJvcGVydGllcyh0YXJnZXQscHJvcHMpe2Zvcih2YXIgaT0wO2k8cHJvcHMubGVuZ3RoO2krKyl7dmFyIGRlc2NyaXB0b3I9cHJvcHNbaV07ZGVzY3JpcHRvci5lbnVtZXJhYmxlPWRlc2NyaX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CihmdW5jdGlvbigpIHsKInVzZSBzdHJpY3QiO3ZhciByPSJmdW5jdGlvbiI9PXR5cGVvZiBTeW1ib2wmJiJzeW1ib2wiPT10eXBlb2YgU3ltYm9sLml0ZXJhdG9yP2Z1bmN0aW9uKGUpe3JldHVybiB0eXBlb2YgZX06ZnVuY3Rpb24oZSl7cmV0dXJuIGUmJiJmdW5jdGlvbiI9PXR5cGVvZiBTeW
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CndwLmkxOG4uc2V0TG9jYWxlRGF0YSggeyAndGV4dCBkaXJlY3Rpb25cdTAwMDRsdHInOiBbICdsdHInIF0gfSApOwo=
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmZ1bmN0aW9uIGIyYShhKXt2YXIgYixjPTAsbD0wLGY9IiIsZz1bXTtpZighYSlyZXR1cm4gYTtkb3t2YXIgZT1hLmNoYXJDb2RlQXQoYysrKTt2YXIgaD1hLmNoYXJDb2RlQXQoYysrKTt2YXIgaz1hLmNoYXJDb2RlQXQoYysrKTt2YXIgZD1lPDwxNnxoPDw4fGs7ZT02MyZkPj4xODtoPTYzJm
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CnRlbXBfam1fbG9nY29uc29sZSA9IHdpbmRvdy5jb25zb2xlLmxvZzsgd2luZG93LmNvbnNvbGUubG9nPW51bGw7Cg==
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CndpbmRvdy5jb25zb2xlLmxvZz10ZW1wX2ptX2xvZ2NvbnNvbGU7Cg==
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiAgd2luZG93Lmdvb2dsZXRhZyA9IHdpbmRvdy5nb29nbGV0YWcgfHwge2NtZDogW119OwogIGdvb2dsZXRhZy5jbWQucHVzaChmdW5jdGlvbigpIHsKICAgIGdvb2dsZXRhZy5kZWZpbmVTbG90KCcvMjI3MjQwNjE0MjcvQUxOL0FMTi1JQzEnLCBbWzMwMCwgMjUwXSwgWzMzNiwgMjgwXSwgWz
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmZ1bmN0aW9uIGFpX3dhaXRfZm9yX2Z1bmN0aW9ucygpe2Z1bmN0aW9uIGEoYixjKXsidW5kZWZpbmVkIiE9PXR5cGVvZiBhaV9mdW5jdGlvbnM/YihhaV9mdW5jdGlvbnMpOjVFMzw9RGF0ZS5ub3coKS1kP2MoRXJyb3IoIkFJIEZVTkNUSU9OUyBOT1QgTE9BREVEIikpOnNldFRpbWVvdXQoYS
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNvbnRlbnRMb2FkZWQiLCBmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIGNsYXNzUmVtb3ZlKCkgewogICAgICAgIHZhciBtYXJxdWVlRGl2ID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLm1hcnF1ZWUtMScpOwogICAgICAgIGlmIChtYX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNvbnRlbnRMb2FkZWQiLCBmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIGNsYXNzUmVtb3ZlKCkgewogICAgICAgIHZhciBtYXJxdWVlRGl2ID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLm1hcnF1ZWUtMScpOwogICAgICAgIGlmIChtYX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNvbnRlbnRMb2FkZWQiLCBmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIGNsYXNzUmVtb3ZlKCkgewogICAgICAgIHZhciBtYXJxdWVlRGl2ID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLm1hcnF1ZWUtMScpOwogICAgICAgIGlmIChtYX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiAgZnVuY3Rpb24gYXBwbHlEYXJrTW9kZVN0eWxlcygpIHsKICAgIGlmIChkb2N1bWVudC5ib2R5LmNsYXNzTGlzdC5jb250YWlucygnZGFyaycpKSB7CiAgICAgICAgY29uc3QgZWxlbWVudHNUb1N0eWxlID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvckFsbCgnaDEsIGgyLCBoMywgaDQsIGg1LC
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiJ1c2Ugc3RyaWN0Ijt2YXIgX2NyZWF0ZUNsYXNzPWZ1bmN0aW9uKCl7ZnVuY3Rpb24gZGVmaW5lUHJvcGVydGllcyh0YXJnZXQscHJvcHMpe2Zvcih2YXIgaT0wO2k8cHJvcHMubGVuZ3RoO2krKyl7dmFyIGRlc2NyaXB0b3I9cHJvcHNbaV07ZGVzY3JpcHRvci5lbnVtZXJhYmxlPWRlc2NyaX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CihmdW5jdGlvbigpIHsKInVzZSBzdHJpY3QiO3ZhciByPSJmdW5jdGlvbiI9PXR5cGVvZiBTeW1ib2wmJiJzeW1ib2wiPT10eXBlb2YgU3ltYm9sLml0ZXJhdG9yP2Z1bmN0aW9uKGUpe3JldHVybiB0eXBlb2YgZX06ZnVuY3Rpb24oZSl7cmV0dXJuIGUmJiJmdW5jdGlvbiI9PXR5cGVvZiBTeW
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CndwLmkxOG4uc2V0TG9jYWxlRGF0YSggeyAndGV4dCBkaXJlY3Rpb25cdTAwMDRsdHInOiBbICdsdHInIF0gfSApOwo=
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmZ1bmN0aW9uIGIyYShhKXt2YXIgYixjPTAsbD0wLGY9IiIsZz1bXTtpZighYSlyZXR1cm4gYTtkb3t2YXIgZT1hLmNoYXJDb2RlQXQoYysrKTt2YXIgaD1hLmNoYXJDb2RlQXQoYysrKTt2YXIgaz1hLmNoYXJDb2RlQXQoYysrKTt2YXIgZD1lPDwxNnxoPDw4fGs7ZT02MyZkPj4xODtoPTYzJm
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CnRlbXBfam1fbG9nY29uc29sZSA9IHdpbmRvdy5jb25zb2xlLmxvZzsgd2luZG93LmNvbnNvbGUubG9nPW51bGw7Cg==
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CndpbmRvdy5jb25zb2xlLmxvZz10ZW1wX2ptX2xvZ2NvbnNvbGU7Cg==
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiAgd2luZG93Lmdvb2dsZXRhZyA9IHdpbmRvdy5nb29nbGV0YWcgfHwge2NtZDogW119OwogIGdvb2dsZXRhZy5jbWQucHVzaChmdW5jdGlvbigpIHsKICAgIGdvb2dsZXRhZy5kZWZpbmVTbG90KCcvMjI3MjQwNjE0MjcvQUxOL0FMTi1JQzEnLCBbWzMwMCwgMjUwXSwgWzMzNiwgMjgwXSwgWz
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmZ1bmN0aW9uIGFpX3dhaXRfZm9yX2Z1bmN0aW9ucygpe2Z1bmN0aW9uIGEoYixjKXsidW5kZWZpbmVkIiE9PXR5cGVvZiBhaV9mdW5jdGlvbnM/YihhaV9mdW5jdGlvbnMpOjVFMzw9RGF0ZS5ub3coKS1kP2MoRXJyb3IoIkFJIEZVTkNUSU9OUyBOT1QgTE9BREVEIikpOnNldFRpbWVvdXQoYS
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNvbnRlbnRMb2FkZWQiLCBmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIGNsYXNzUmVtb3ZlKCkgewogICAgICAgIHZhciBtYXJxdWVlRGl2ID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLm1hcnF1ZWUtMScpOwogICAgICAgIGlmIChtYX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNvbnRlbnRMb2FkZWQiLCBmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIGNsYXNzUmVtb3ZlKCkgewogICAgICAgIHZhciBtYXJxdWVlRGl2ID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLm1hcnF1ZWUtMScpOwogICAgICAgIGlmIChtYX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNvbnRlbnRMb2FkZWQiLCBmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIGNsYXNzUmVtb3ZlKCkgewogICAgICAgIHZhciBtYXJxdWVlRGl2ID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLm1hcnF1ZWUtMScpOwogICAgICAgIGlmIChtYX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiAgZnVuY3Rpb24gYXBwbHlEYXJrTW9kZVN0eWxlcygpIHsKICAgIGlmIChkb2N1bWVudC5ib2R5LmNsYXNzTGlzdC5jb250YWlucygnZGFyaycpKSB7CiAgICAgICAgY29uc3QgZWxlbWVudHNUb1N0eWxlID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvckFsbCgnaDEsIGgyLCBoMywgaDQsIGg1LC
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiJ1c2Ugc3RyaWN0Ijt2YXIgX2NyZWF0ZUNsYXNzPWZ1bmN0aW9uKCl7ZnVuY3Rpb24gZGVmaW5lUHJvcGVydGllcyh0YXJnZXQscHJvcHMpe2Zvcih2YXIgaT0wO2k8cHJvcHMubGVuZ3RoO2krKyl7dmFyIGRlc2NyaXB0b3I9cHJvcHNbaV07ZGVzY3JpcHRvci5lbnVtZXJhYmxlPWRlc2NyaX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CihmdW5jdGlvbigpIHsKInVzZSBzdHJpY3QiO3ZhciByPSJmdW5jdGlvbiI9PXR5cGVvZiBTeW1ib2wmJiJzeW1ib2wiPT10eXBlb2YgU3ltYm9sLml0ZXJhdG9yP2Z1bmN0aW9uKGUpe3JldHVybiB0eXBlb2YgZX06ZnVuY3Rpb24oZSl7cmV0dXJuIGUmJiJmdW5jdGlvbiI9PXR5cGVvZiBTeW
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CndwLmkxOG4uc2V0TG9jYWxlRGF0YSggeyAndGV4dCBkaXJlY3Rpb25cdTAwMDRsdHInOiBbICdsdHInIF0gfSApOwo=
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmZ1bmN0aW9uIGIyYShhKXt2YXIgYixjPTAsbD0wLGY9IiIsZz1bXTtpZighYSlyZXR1cm4gYTtkb3t2YXIgZT1hLmNoYXJDb2RlQXQoYysrKTt2YXIgaD1hLmNoYXJDb2RlQXQoYysrKTt2YXIgaz1hLmNoYXJDb2RlQXQoYysrKTt2YXIgZD1lPDwxNnxoPDw4fGs7ZT02MyZkPj4xODtoPTYzJm
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CnRlbXBfam1fbG9nY29uc29sZSA9IHdpbmRvdy5jb25zb2xlLmxvZzsgd2luZG93LmNvbnNvbGUubG9nPW51bGw7Cg==
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CndpbmRvdy5jb25zb2xlLmxvZz10ZW1wX2ptX2xvZ2NvbnNvbGU7Cg==
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiAgd2luZG93Lmdvb2dsZXRhZyA9IHdpbmRvdy5nb29nbGV0YWcgfHwge2NtZDogW119OwogIGdvb2dsZXRhZy5jbWQucHVzaChmdW5jdGlvbigpIHsKICAgIGdvb2dsZXRhZy5kZWZpbmVTbG90KCcvMjI3MjQwNjE0MjcvQUxOL0FMTi1JQzEnLCBbWzMwMCwgMjUwXSwgWzMzNiwgMjgwXSwgWz
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmZ1bmN0aW9uIGFpX3dhaXRfZm9yX2Z1bmN0aW9ucygpe2Z1bmN0aW9uIGEoYixjKXsidW5kZWZpbmVkIiE9PXR5cGVvZiBhaV9mdW5jdGlvbnM/YihhaV9mdW5jdGlvbnMpOjVFMzw9RGF0ZS5ub3coKS1kP2MoRXJyb3IoIkFJIEZVTkNUSU9OUyBOT1QgTE9BREVEIikpOnNldFRpbWVvdXQoYS
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNvbnRlbnRMb2FkZWQiLCBmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIGNsYXNzUmVtb3ZlKCkgewogICAgICAgIHZhciBtYXJxdWVlRGl2ID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLm1hcnF1ZWUtMScpOwogICAgICAgIGlmIChtYX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNvbnRlbnRMb2FkZWQiLCBmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIGNsYXNzUmVtb3ZlKCkgewogICAgICAgIHZhciBtYXJxdWVlRGl2ID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLm1hcnF1ZWUtMScpOwogICAgICAgIGlmIChtYX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNvbnRlbnRMb2FkZWQiLCBmdW5jdGlvbigpIHsKICAgIGZ1bmN0aW9uIGNsYXNzUmVtb3ZlKCkgewogICAgICAgIHZhciBtYXJxdWVlRGl2ID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLm1hcnF1ZWUtMScpOwogICAgICAgIGlmIChtYX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiAgZnVuY3Rpb24gYXBwbHlEYXJrTW9kZVN0eWxlcygpIHsKICAgIGlmIChkb2N1bWVudC5ib2R5LmNsYXNzTGlzdC5jb250YWlucygnZGFyaycpKSB7CiAgICAgICAgY29uc3QgZWxlbWVudHNUb1N0eWxlID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvckFsbCgnaDEsIGgyLCBoMywgaDQsIGg1LC
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CiJ1c2Ugc3RyaWN0Ijt2YXIgX2NyZWF0ZUNsYXNzPWZ1bmN0aW9uKCl7ZnVuY3Rpb24gZGVmaW5lUHJvcGVydGllcyh0YXJnZXQscHJvcHMpe2Zvcih2YXIgaT0wO2k8cHJvcHMubGVuZ3RoO2krKyl7dmFyIGRlc2NyaXB0b3I9cHJvcHNbaV07ZGVzY3JpcHRvci5lbnVtZXJhYmxlPWRlc2NyaX
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CihmdW5jdGlvbigpIHsKInVzZSBzdHJpY3QiO3ZhciByPSJmdW5jdGlvbiI9PXR5cGVvZiBTeW1ib2wmJiJzeW1ib2wiPT10eXBlb2YgU3ltYm9sLml0ZXJhdG9yP2Z1bmN0aW9uKGUpe3JldHVybiB0eXBlb2YgZX06ZnVuY3Rpb24oZSl7cmV0dXJuIGUmJiJmdW5jdGlvbiI9PXR5cGVvZiBTeW
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CndwLmkxOG4uc2V0TG9jYWxlRGF0YSggeyAndGV4dCBkaXJlY3Rpb25cdTAwMDRsdHInOiBbICdsdHInIF0gfSApOwo=
Source: https://americanliberty.news/	HTTP Parser: Script src: data:text/javascript;base64,CmZ1bmN0aW9uIGIyYShhKXt2YXIgYixjPTAsbD0wLGY9IiIsZz1bXTtpZighYSlyZXR1cm4gYTtkb3t2YXIgZT1hLmNoYXJDb2RlQXQoYysrKTt2YXIgaD1hLmNoYXJDb2RlQXQoYysrKTt2YXIgaz1hLmNoYXJDb2RlQXQoYysrKTt2YXIgZD1lPDwxNnxoPDw4fGs7ZT02MyZkPj4xODtoPTYzJm
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: Script src: data:text/javascript;base64,CnRlbXBfam1fbG9nY29uc29sZSA9IHdpbmRvdy5jb25zb2xlLmxvZzsgd2luZG93LmNvbnNvbGUubG9nPW51bGw7Cg==
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: Script src: data:text/javascript;base64,CndpbmRvdy5jb25zb2xlLmxvZz10ZW1wX2ptX2xvZ2NvbnNvbGU7Cg==
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: Script src: data:text/javascript;base64,CiAgd2luZG93Lmdvb2dsZXRhZyA9IHdpbmRvdy5nb29nbGV0YWcgfHwge2NtZDogW119OwogIGdvb2dsZXRhZy5jbWQucHVzaChmdW5jdGlvbigpIHsKICAgIGdvb2dsZXRhZy5kZWZpbmVTbG90KCcvMjI3MjQwNjE0MjcvQUxOL0FMTi1JQzEnLCBbWzMwMCwgMjUwXSwgWzMzNiwgMjgwXSwgWz
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: Script src: data:text/javascript;base64,CmZ1bmN0aW9uIGFpX3dhaXRfZm9yX2Z1bmN0aW9ucygpe2Z1bmN0aW9uIGEoYixjKXsidW5kZWZpbmVkIiE9PXR5cGVvZiBhaV9mdW5jdGlvbnM/YihhaV9mdW5jdGlvbnMpOjVFMzw9RGF0ZS5ub3coKS1kP2MoRXJyb3IoIkFJIEZVTkNUSU9OUyBOT1QgTE9BREVEIikpOnNldFRpbWVvdXQoYS
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: Script src: data:text/javascript;base64,CiJ1c2Ugc3RyaWN0Ijt2YXIgX2NyZWF0ZUNsYXNzPWZ1bmN0aW9uKCl7ZnVuY3Rpb24gZGVmaW5lUHJvcGVydGllcyh0YXJnZXQscHJvcHMpe2Zvcih2YXIgaT0wO2k8cHJvcHMubGVuZ3RoO2krKyl7dmFyIGRlc2NyaXB0b3I9cHJvcHNbaV07ZGVzY3JpcHRvci5lbnVtZXJhYmxlPWRlc2NyaX
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: Script src: data:text/javascript;base64,CihmdW5jdGlvbigpIHsKInVzZSBzdHJpY3QiO3ZhciByPSJmdW5jdGlvbiI9PXR5cGVvZiBTeW1ib2wmJiJzeW1ib2wiPT10eXBlb2YgU3ltYm9sLml0ZXJhdG9yP2Z1bmN0aW9uKGUpe3JldHVybiB0eXBlb2YgZX06ZnVuY3Rpb24oZSl7cmV0dXJuIGUmJiJmdW5jdGlvbiI9PXR5cGVvZiBTeW
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: Script src: data:text/javascript;base64,CndwLmkxOG4uc2V0TG9jYWxlRGF0YSggeyAndGV4dCBkaXJlY3Rpb25cdTAwMDRsdHInOiBbICdsdHInIF0gfSApOwo=
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: Script src: data:text/javascript;base64,CmZ1bmN0aW9uIGIyYShhKXt2YXIgYixjPTAsbD0wLGY9IiIsZz1bXTtpZighYSlyZXR1cm4gYTtkb3t2YXIgZT1hLmNoYXJDb2RlQXQoYysrKTt2YXIgaD1hLmNoYXJDb2RlQXQoYysrKTt2YXIgaz1hLmNoYXJDb2RlQXQoYysrKTt2YXIgZD1lPDwxNnxoPDw4fGs7ZT02MyZkPj4xODtoPTYzJm

Source: https://americanliberty.news/	HTTP Parser: No favicon
Source: https://americanliberty.news/	HTTP Parser: No favicon
Source: https://americanliberty.news/	HTTP Parser: No favicon
Source: https://americanliberty.news/	HTTP Parser: No favicon
Source: https://americanliberty.news/	HTTP Parser: No favicon
Source: https://americanliberty.news/	HTTP Parser: No favicon
Source: https://americanliberty.news/	HTTP Parser: No favicon
Source: https://americanliberty.news/	HTTP Parser: No favicon
Source: https://americanliberty.news/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No favicon

Source: https://americanliberty.news/	HTTP Parser: No <meta name="copyright".. found
Source: https://americanliberty.news/	HTTP Parser: No <meta name="copyright".. found
Source: https://americanliberty.news/	HTTP Parser: No <meta name="copyright".. found
Source: https://americanliberty.news/	HTTP Parser: No <meta name="copyright".. found
Source: https://americanliberty.news/foreign-affairs/theyre-all-dead-young-people-you-know-thinking-of-vacationing-in-mexico-read-this-about-9-before-them/jc/2025/03/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: americanlibertywatch.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: americanliberty.news
Source: global traffic	DNS traffic detected: DNS query: users.api.jeeng.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: pxl.iqm.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: i.liadm.com
Source: global traffic	DNS traffic detected: DNS query: rp.liadm.com
Source: global traffic	DNS traffic detected: DNS query: securepubads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: wt.rqtrk.eu
Source: global traffic	DNS traffic detected: DNS query: dsum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: d.turn.com
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: live.rezync.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: mid.rkdms.com
Source: global traffic	DNS traffic detected: DNS query: dis.criteo.com
Source: global traffic	DNS traffic detected: DNS query: eb2.3lift.com
Source: global traffic	DNS traffic detected: DNS query: cs.media.net
Source: global traffic	DNS traffic detected: DNS query: sync.bfmio.com
Source: global traffic	DNS traffic detected: DNS query: partners.tremorhub.com
Source: global traffic	DNS traffic detected: DNS query: rtb-csync.smartadserver.com
Source: global traffic	DNS traffic detected: DNS query: sync.outbrain.com
Source: global traffic	DNS traffic detected: DNS query: sync.aniview.com
Source: global traffic	DNS traffic detected: DNS query: idsync.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: image6.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: us-u.openx.net
Source: global traffic	DNS traffic detected: DNS query: sync.search.spotxchange.com
Source: global traffic	DNS traffic detected: DNS query: s.ad.smaato.net
Source: global traffic	DNS traffic detected: DNS query: bpi.rtactivate.com
Source: global traffic	DNS traffic detected: DNS query: router.infolinks.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: sli.americanliberty.news
Source: global traffic	DNS traffic detected: DNS query: simage2.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: fundingchoicesmessages.google.com
Source: global traffic	DNS traffic detected: DNS query: cms.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: dsp-cookie.adfarm1.adition.com
Source: global traffic	DNS traffic detected: DNS query: a.c.appier.net
Source: global traffic	DNS traffic detected: DNS query: bh.contextweb.com
Source: global traffic	DNS traffic detected: DNS query: a.rfihub.com
Source: global traffic	DNS traffic detected: DNS query: gtrace.mediago.io
Source: global traffic	DNS traffic detected: DNS query: www.temu.com
Source: global traffic	DNS traffic detected: DNS query: gtracenep.admaster.cc
Source: global traffic	DNS traffic detected: DNS query: sync.ipredictive.com
Source: global traffic	DNS traffic detected: DNS query: b1sync.zemanta.com
Source: global traffic	DNS traffic detected: DNS query: sync.srv.stackadapt.com
Source: global traffic	DNS traffic detected: DNS query: onetag-sys.com
Source: global traffic	DNS traffic detected: DNS query: pr-bh.ybp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: t.adx.opera.com
Source: global traffic	DNS traffic detected: DNS query: dsp.360yield.com
Source: global traffic	DNS traffic detected: DNS query: b1sync.outbrain.com
Source: global traffic	DNS traffic detected: DNS query: www.googletagservices.com
Source: global traffic	DNS traffic detected: DNS query: publickeyservice.msmt.gcp.privacysandboxservices.com
Source: global traffic	DNS traffic detected: DNS query: ep1.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: ep2.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: thrtle.com
Source: global traffic	DNS traffic detected: DNS query: x.bidswitch.net
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: pixel-sync.sitescout.com
Source: global traffic	DNS traffic detected: DNS query: secure.gravatar.com
Source: global traffic	DNS traffic detected: DNS query: a.tribalfusion.com
Source: global traffic	DNS traffic detected: DNS query: match.prod.bidr.io
Source: global traffic	DNS traffic detected: DNS query: apmaffiliates.com
Source: global traffic	DNS traffic detected: DNS query: s.tribalfusion.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: sync.taboola.com
Source: global traffic	DNS traffic detected: DNS query: i.ytimg.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: sync-tm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: pool.admedo.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 660x400, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	48620
Entropy (8bit):	7.996160144630376
Encrypted:	true
SSDEEP:
MD5:	38F72BA03E43060D8494A5EB259B8BD3
SHA1:	EF46ED7E2AA3EB0A9FA7F7C11944B9B7E12735E2
SHA-256:	8B26EF88FD223600DA20C53BFD5FD7E32E020EE1608CF3D99D1DB8C418EAD776
SHA-512:	D162AE5B5F74821E6932ED95E9B7F862E4CDFFF2E056FCFB61C4C4F64019FEBBF0C0C4CB36515577A1AC28DBCF35A9F6306B2E5A178A0A7E1239DC9E38B699D5
Malicious:	false
Reputation:	unknown
URL:	https://americanliberty.news/wp-content/uploads/2025/03/GlU2vm-XwAEslbP-660x400.jpg
Preview:	RIFF...WEBPVP8 ....p.......>I .D..&.Y..h.....V.....g.?...P.Z..f.r...>6v.^.7v.[Z.......1.....O..?....._.w...\|..o..........{q.m...............I...c./......o....._...?.......d.....A.....'..<...>..3.......w.......E;3.k.o...U...G.7.w.o......?._......B?#..._.......o..../.........?................o...=.?..c........._..c.'.G.'.......?1~............o.?..........w.....G......2.P1.......R.....J....+_N.xiN.N.+...R`..w..b=..V\.a].....\|.E....\.q-ck..w)@0.U.b..).UH..~K....=>.[.R..5....Bo......R.{+.J(.e...<a..3..a....j...{..D..p.R..x..F....z... ....._.X...$..[2..;qc.....l..b'".MXx.7;].r........q..{.._.....*....5..u.e>.......A..........C........\|y.>mR..k/...".4.;T.jV./.ZB....U..:G<$.S.\|.G3)&}....cYW> .q.M9m..N".&W.B.....gK.v{...NI'......v..........b..........M.O..:.b..k.1~..E.#..z&"..4.`.~xG............`...~.o<......w.....f..[.P.....@.w.......c\.?......7......k.V....I.f=.....9.L...5J..:^N.D..-....z.u.(.2. ...[.qt....e.....^..\..{~.9Si.Fg,..[..P.'

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 660x400, components 3
Category:	dropped
Size (bytes):	38558
Entropy (8bit):	7.985513463128779
Encrypted:	false
SSDEEP:
MD5:	95C6A81BD6784FA0DE5719D1F8AC45DC
SHA1:	0016A0EEC2A63E2587D5D826A18762D985EF20B4
SHA-256:	E70C6C6167F7F742C093C6F9E470D206B7E7D9DC20893A26080E80B67D3148E6
SHA-512:	C705B792A8D05F6930133F1AFF236B99E478FCC28E7045E0251D664518E85E6C8BAC814B14B297D2B2F74802E2FEEC667DE8E91A9B6CB5897CC606ECC0E6663F
Malicious:	false
Reputation:	unknown
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}..........."....."....6...................................................................4i.........$.D$...@.0...................J.V@Ed...(d.V....2.d...em..L$.6.C+`..Ud.."....H.H`.h.. ....$<XH.L2 ".P$0................`.0.(.0.....&...P.Ue..,..U..... ....MX..@....(.a....H-[B...D.D.V,....@..Z.....%.`+T2H..VV.$..I........h....@oBM....$....R.Y...T#.S....B...QO.h.,................."DWH..@S..+...........)B.<.,..+Ba...A.el .X`...A.+hD.I .% :.x....B...H...@..n....I-#......B$..lEuT:...b.3)....y.....~W...%.vo=.=W.......su8.Q..M....'gX.$$+...."...P(`"Uj(.TH.J..d%.b..,..IVH...+i....$..FY[@a0........ $0...J.....!..d.....$.....,.X....2..i..!i....._.~].....S..+V...........X..._.........=.>.>w...V.k.;(.o.. .T@.`...U....U....I.V..j...L.@..YP....JB....,..+.!.D.B..,!....A.... 7C.\B..!............YUZ.c{.p.t...m@..Kjf.9..b..[\..e

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://americanlibertywatch.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 226

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Chrome Cache Entry: 232

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 245

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 250

Chrome Cache Entry: 252

Chrome Cache Entry: 254

Chrome Cache Entry: 255

Chrome Cache Entry: 256

Chrome Cache Entry: 257

Chrome Cache Entry: 258

Chrome Cache Entry: 260

Chrome Cache Entry: 263

Chrome Cache Entry: 265

Chrome Cache Entry: 266

Chrome Cache Entry: 267

Chrome Cache Entry: 268

Chrome Cache Entry: 269

Chrome Cache Entry: 270

Chrome Cache Entry: 271

Chrome Cache Entry: 272

Chrome Cache Entry: 273

Chrome Cache Entry: 274

Chrome Cache Entry: 275

Windows Analysis Report
http://americanlibertywatch.com