Play interactive tourEdit tour

Windows Analysis Report
https://marchcapitalmanagement.portal.agorareal.com/#/signup?email=fundadmin%40iconiqcapital.com&code=3HOf5LZO&ref_id=7d05c7e4-505b-4532-b990-6a812f1cf7c1

Overview

General Information

Sample URL:	https://marchcapitalmanagement.portal.agorareal.com/#/signup?email=fundadmin%40iconiqcapital.com&code=3HOf5LZO&ref_id=7d05c7e4-505b-4532-b990-6a812f1cf7c1
Analysis ID:	1643140
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected Powershell download and execute

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

×

Joe Sandbox Signatures

• • Phishing
• • Compliance
• • Networking
• • System Summary
• • HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

Phishing

HTML body contains low number of good links

Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO

HTTP Parser: <input type="password" .../> found but no <form action="...

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Source: https://cdn-prod.portal.agorareal.com/main.js?v=bc1eee77620e0bb0f484

HTTP Parser: /*! for license information please see main.js.license.txt */(self.webpackchunkagora_portal=self.webpackchunkagora_portal||[]).push([[179],{47401:(e,t,n)=>{"use strict";n.d(t,{qv:()=>_o,hk:()=>xt,ww:()=>en,s_:()=>mn});var a=n(72307),r=n.n(a),i=n(67294),o=n(87462),s=n(29439),l=n(4942),c=n(38819),u=n(15873),d=n(43061),p=n(73218),m=n(54549),f=n(68855),h=n(57119),g=n(40847),b=n(68628),y=n(94184),v=n.n(y),_=n(5461),w=n(53124);var k=n(96159),x=n(15671),s=n(43144),c=n(60136),e=n(54062);const t=function(e){(0,c.z)(n,e);var t=(0,e.z)(n);function n(){var e;return(0,x.z)(this,n),(e=t.apply(this,arguments)).state={error:void 0,info:{componentstack:""}},e}return(0,s.z)(n,[{key:"componentdidcatch",value:function(e,t){this.setstate({error:e,info:t})}},{key:"render",value:function(){var e=this.props,t=e.message,n=e.description,a=e.children,r=this.state,o=r.error,s=r.info,l=s&&s.componentstack?s.componentstack:null,c=void 0===t?(o||"").tostring():t,u=void 0===n?l:n;return o?i.createelement(n,{type:"error",message:c,descripti...

HTML body contains password input

Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO

HTTP Parser: <input type="password" .../> found

HTML page is missing a favicon

Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO	HTTP Parser: No favicon
Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO	HTTP Parser: No favicon

META author tag missing

Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO	HTTP Parser: No <meta name="author".. found
Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO	HTTP Parser: No <meta name="author".. found
Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO	HTTP Parser: No <meta name="copyright".. found
Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO	HTTP Parser: No <meta name="copyright".. found
Source: https://marchcapitalmanagement.portal.agorareal.com/#/activate-account?email=fundadmin%40iconiqcapital.com&signupCode=3HOf5LZO	HTTP Parser: No <meta name="copyright".. found

Compliance

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.217.16.196:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.164:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.7.109:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.7.109:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.7.109:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.134.19:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.134.19:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.50.88.88:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.50.88.88:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.136.221:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.136.221:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.7.83:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.50.88.88:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 130.211.34.183:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 130.211.34.183:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 130.211.34.183:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.25.25:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.25.25:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.25.25:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.4:49809 version: TLS 1.2

Networking

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.4:52778 -> 1.1.1.1:53

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0BSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /runtime.js?v=ad8deb6f14a9b4599907 HTTP/1.1Host: cdn-prod.portal.agorareal.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main.js?v=bc1eee77620e0bb0f484 HTTP/1.1Host: cdn-prod.portal.agorareal.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/client/portal/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivetraceparent: 00-08165c03ddcec8f041f72e911675825f-8a7847d3b805490f-01sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4038.js?v=0e67c9ad602c0fd4537c HTTP/1.1Host: cdn-prod.portal.agorareal.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/docs/favicon HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/analytics/init-info/investor HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-ed327d6ce0490bb21ed61fb04e339017-f6c85dd813e55da3-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/docs/logo HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-2d9ac073bddafea0519f658dd80ca287-f268d169930360a3-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/docs/background HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-d5eb8bd7724ce30c3beb929fe6f9ee9e-f587e6f8da19b7f8-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/public/settings HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-b080eaff1cc55b06aba72dd2f3d95a84-abf38b77bd30e62d-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/portal/terminology HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-1710b748e62a8060a2f6d636d1d09472-f2474e5c31c13131-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/jsontenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-77760ec2078c4cc53843abd657a5080b-8b73a130f98d0cf2-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-495a8f529f511bec02d8098157f30c73-90f0e889cdfd37ee-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/public/settings HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-7aa6c399f936826d786f13ad0fbae323-eab26fc96f03ed38-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9If-None-Match: W/"a3f-hRktQN0TqdBGAG/fIaNopANM1f4"
Source: global traffic	HTTP traffic detected: GET /api/public/client/portal/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/docs/favicon HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/feature-flags/portal HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/analytics/init-info/investor HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/public/settings HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/docs/logo HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-37f2f6aadb641350181a6dd32fd9af0c-2cb7403ab094a959-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/f1305632-5179-4b03-95b1-9f585712d0bd.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA2RPLR2L7E3QU7SVS%2F20250319%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20250319T141053Z&X-Amz-Expires=900&X-Amz-Signature=dd0c143d4855566e7e8df41ffc99c4379a413e9fe111503b81cd1cdc19d627ea&X-Amz-SignedHeaders=host&response-content-disposition=inline%3B%20filename%3D%22Vector%2520from%2520Figma%2520%281%29.png%22&response-content-type=image%2Fpng HTTP/1.1Host: marchcapitalmanagement-bucket-agora.s3.eu-central-1.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7053.js?v=6eea3887aabf9feae778 HTTP/1.1Host: cdn-prod.portal.agorareal.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/61604346-0979-4dec-874e-4f3cf383667b.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA2RPLR2L7E3QU7SVS%2F20250319%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20250319T141053Z&X-Amz-Expires=900&X-Amz-Signature=df7f063c2d4b20cc10370b897659429ab7751eb325ad3ab7927c6cc336aea7ab&X-Amz-SignedHeaders=host&response-content-disposition=inline%3B%20filename%3D%22w_bg_720.png%22&response-content-type=image%2Fpng HTTP/1.1Host: marchcapitalmanagement-bucket-agora.s3.eu-central-1.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LcuWdYaAAAAAPg_thmnaM8SzqJLU8pyaM1VBYRa&co=aHR0cHM6Ly9tYXJjaGNhcGl0YWxtYW5hZ2VtZW50LnBvcnRhbC5hZ29yYXJlYWwuY29tOjQ0Mw..&hl=en&type=image&v=J79K9xgfxwT6Syzx-UyWdD89&theme=light&size=normal&badge=bottomright&cb=946b8lqou1b8 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0BSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LcuWdYaAAAAAPg_thmnaM8SzqJLU8pyaM1VBYRa&co=aHR0cHM6Ly9tYXJjaGNhcGl0YWxtYW5hZ2VtZW50LnBvcnRhbC5hZ29yYXJlYWwuY29tOjQ0Mw..&hl=en&type=image&v=J79K9xgfxwT6Syzx-UyWdD89&theme=light&size=normal&badge=bottomright&cb=7wu9nvqevoz6 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0BSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/docs/background HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/public/settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/portal/terminology HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/public/settings HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9If-None-Match: W/"a3f-hRktQN0TqdBGAG/fIaNopANM1f4"
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-d49dbd20c9e92d2b207818d4ca9e6350-c0e2cec5a68f8828-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /65e8db8d4e5f2f8fcdb9.svg HTTP/1.1Host: cdn-prod.portal.agorareal.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-0714f5dfbef65b966325a99303eb1075-dad504f6a8f0a880-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/public/events/send HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/f1305632-5179-4b03-95b1-9f585712d0bd.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA2RPLR2L7E3QU7SVS%2F20250319%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20250319T141053Z&X-Amz-Expires=900&X-Amz-Signature=dd0c143d4855566e7e8df41ffc99c4379a413e9fe111503b81cd1cdc19d627ea&X-Amz-SignedHeaders=host&response-content-disposition=inline%3B%20filename%3D%22Vector%2520from%2520Figma%2520%281%29.png%22&response-content-type=image%2Fpng HTTP/1.1Host: marchcapitalmanagement-bucket-agora.s3.eu-central-1.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v2/61604346-0979-4dec-874e-4f3cf383667b.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA2RPLR2L7E3QU7SVS%2F20250319%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20250319T141053Z&X-Amz-Expires=900&X-Amz-Signature=df7f063c2d4b20cc10370b897659429ab7751eb325ad3ab7927c6cc336aea7ab&X-Amz-SignedHeaders=host&response-content-disposition=inline%3B%20filename%3D%22w_bg_720.png%22&response-content-type=image%2Fpng HTTP/1.1Host: marchcapitalmanagement-bucket-agora.s3.eu-central-1.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /65e8db8d4e5f2f8fcdb9.svg HTTP/1.1Host: cdn-prod.portal.agorareal.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-5cd577d03c6d47c6b30c3ad5af8413b7-a58c39afe7ff1989-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /browser/v1beta/logs HTTP/1.1Host: ingress.eu2.rum-ingress-coralogix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=J79K9xgfxwT6Syzx-UyWdD89 HTTP/1.1Host: www.google.comConnection: keep-aliveAccept: */*X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0BSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerSec-Fetch-Storage-Access: activeReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcuWdYaAAAAAPg_thmnaM8SzqJLU8pyaM1VBYRa&co=aHR0cHM6Ly9tYXJjaGNhcGl0YWxtYW5hZ2VtZW50LnBvcnRhbC5hZ29yYXJlYWwuY29tOjQ0Mw..&hl=en&type=image&v=J79K9xgfxwT6Syzx-UyWdD89&theme=light&size=normal&badge=bottomright&cb=946b8lqou1b8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-05a3d88ac66f30ffa3c35f8ea46238ae-de3d4291c8c03eee-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-9a8736dc4837be4288032369ab169e9f-7853ab4aa6b06b7e-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=J79K9xgfxwT6Syzx-UyWdD89&k=6LcuWdYaAAAAAPg_thmnaM8SzqJLU8pyaM1VBYRa HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0BSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-96f662d778aabe05db21cd1a49243972-9c901bb7b7c06496-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /engage/?verbose=1&ip=1&_=1742393457902 HTTP/1.1Host: api-js.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/?verbose=1&ip=1&_=1742393457898 HTTP/1.1Host: api-js.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /groups/?verbose=1&ip=1&_=1742393457904 HTTP/1.1Host: api-js.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /browser/v1beta/logs HTTP/1.1Host: ingress.eu2.rum-ingress-coralogix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=J79K9xgfxwT6Syzx-UyWdD89&k=6LcuWdYaAAAAAPg_thmnaM8SzqJLU8pyaM1VBYRa HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0BSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-99fec6eea268e55d61d58be104c9a6d2-f18a9883ae00de4c-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /browser/v1beta/logs HTTP/1.1Host: ingress.eu2.rum-ingress-coralogix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /browser/v1beta/logs HTTP/1.1Host: ingress.eu2.rum-ingress-coralogix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-a07a45dfd7018f565759dbfe124bc4d6-872d6f7262d10711-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /browser/v1beta/logs HTTP/1.1Host: ingress.eu2.rum-ingress-coralogix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-3134f3ca3932650bc917a49c1ad44a61-880f96fe33814f33-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-133b5dcbe901a6f7883364138632f508-5a49ad1028684850-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /browser/v1beta/logs HTTP/1.1Host: ingress.eu2.rum-ingress-coralogix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /browser/v1beta/logs HTTP/1.1Host: ingress.eu2.rum-ingress-coralogix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-19c1ee5610377a394a24545f0966e43a-bdeab2c02326a3c1-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-61348a96b972ade18fc4e4f6e7c52b3e-b2e303ef385df085-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/investor-portal/general/client-settings/all HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-alivefrom-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-095cb8556844a37a85b2d33b26346f81-4909f32a1ac03737-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*tenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: marchcapitalmanagement.portal.agorareal.com
Source: global traffic	DNS traffic detected: DNS query: cdn-prod.portal.agorareal.com
Source: global traffic	DNS traffic detected: DNS query: marchcapitalmanagement-bucket-agora.s3.eu-central-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: ingress.eu2.rum-ingress-coralogix.com
Source: global traffic	DNS traffic detected: DNS query: api-js.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /api/public/feature-flags/portal HTTP/1.1Host: marchcapitalmanagement.portal.agorareal.comConnection: keep-aliveContent-Length: 83from-app: client_investorsec-ch-ua-platform: "Windows"Authorization: Bearer nullsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0traceparent: 00-dff14830094d31d0fe0bae07a3e983b5-a673825a232096a7-01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, */*Content-Type: application/jsontenant-id: 49ad6223-0d6a-4be3-aa6b-d9c64a905034Origin: https://marchcapitalmanagement.portal.agorareal.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://marchcapitalmanagement.portal.agorareal.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenaccess-control-allow-credentials: trueaccess-control-allow-methods: *access-control-allow-headers: content-typedate: Wed, 19 Mar 2025 14:10:56 GMTconnection: closecontent-length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenaccess-control-allow-credentials: trueaccess-control-allow-methods: *access-control-allow-headers: content-typedate: Wed, 19 Mar 2025 14:11:00 GMTconnection: closecontent-length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenaccess-control-allow-credentials: trueaccess-control-allow-methods: *access-control-allow-headers: content-typedate: Wed, 19 Mar 2025 14:11:01 GMTconnection: closecontent-length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenaccess-control-allow-credentials: trueaccess-control-allow-methods: *access-control-allow-headers: content-typedate: Wed, 19 Mar 2025 14:11:02 GMTconnection: closecontent-length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenaccess-control-allow-credentials: trueaccess-control-allow-methods: *access-control-allow-headers: content-typedate: Wed, 19 Mar 2025 14:11:04 GMTconnection: closecontent-length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenaccess-control-allow-credentials: trueaccess-control-allow-methods: *access-control-allow-headers: content-typedate: Wed, 19 Mar 2025 14:11:08 GMTconnection: closecontent-length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenaccess-control-allow-credentials: trueaccess-control-allow-methods: *access-control-allow-headers: content-typedate: Wed, 19 Mar 2025 14:11:09 GMTconnection: closecontent-length: 0

URLs found in memory or binary data

Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://2k.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://33across.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://360yield.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://3lift.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://a-mo.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://acxiom.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ad-score.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ad-stir.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ad.gt
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adentifi.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adform.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adingo.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://admatrix.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://admission.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://admixer.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adnami.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adnxs.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adroll.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adsafeprotected.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adscale.de
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adsmeasurement.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adsrvr.org
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adswizz.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adthrive.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://adtrafficquality.google
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://advividnetwork.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://aggregation-service-site-dot-clz200258-datateam-italy.ew.r.appspot.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://akpytela.cz
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://alketech.eu
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://amazon-adsystem.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://aniview.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://anonymised.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://apex-football.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://aphub.ai
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://appconsent.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://appier.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://appsflyer.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://appsflyersdk.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://aqfer.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://atirun.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://atomex.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://audience360.com.au
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://audienceproject.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://authorizedvault.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://avads.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ayads.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://azubiyo.de
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://beaconmax.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://bidswitch.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://bidtheatre.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://blendee.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://bluems.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://boost-web.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://bounceexchange.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://bypass.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://casalemedia.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://cazamba.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://cdn-net.com
Source: chromecache_101.2.dr	String found in binary or memory: https://cdn-prod.portal.agorareal.com/main.js?v=bc1eee77620e0bb0f484
Source: chromecache_101.2.dr	String found in binary or memory: https://cdn-prod.portal.agorareal.com/runtime.js?v=ad8deb6f14a9b4599907
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://clickonometrics.pl
Source: chromecache_73.2.dr, chromecache_104.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_73.2.dr, chromecache_104.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_73.2.dr, chromecache_104.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha/docs/troubleshoot-recaptcha-issues#automated-query-error
Source: chromecache_73.2.dr, chromecache_104.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha/docs/troubleshoot-recaptcha-issues#localhost-error
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://connatix.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://connected-stories.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://convertunits.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://coupang.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://cpx.to
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://crcldu.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://creative-serving.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://creativecdn.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://criteo.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ctnsnet.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://d-edgeconnect.media
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://dabbs.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://dailymail.co.uk
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://dailymotion.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://daum.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://deepintent.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://demand.supply
Source: chromecache_73.2.dr, chromecache_104.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://display.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://disqus.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://docomo.ne.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://dotdashmeredith.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://dotomi.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://doubleclick.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://doubleverify.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://dreammail.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://dynalyst.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ebayadservices.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ebis.ne.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://edkt.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://elle.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://elnacional.cat
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://eloan.co.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://euleriancdn.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://explorefledge.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ezoic.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://fanbyte.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://fandom.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://finn.no
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://flashtalking.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://fout.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://fwmrm.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://gama.globo
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://get3rdspace.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://getcapi.co
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://getyourguide.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ghtinc.com
Source: chromecache_75.2.dr, chromecache_107.2.dr	String found in binary or memory: https://github.com/googlefonts/roboto-classic)
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://globo.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://gmossp-sp.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://gokwik.co
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://google-analytics.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://googleadservices.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://googlesyndication.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://grxchange.gr
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://gsspat.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://gumgum.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://gunosy.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://halcy.de
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://html-load.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://i-mobile.co.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://im-apps.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://impact-ad.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://indexww.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ingereck.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://inmobi.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://innovid.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://iobeya.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://jivox.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://jkforum.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://kargo.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://kidoz.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://kompaspublishing.nl
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ladsp.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://linkedin.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://logly.co.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://lucead.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://lwadm.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://mail.ru
Source: chromecache_109.2.dr, chromecache_95.2.dr	String found in binary or memory: https://marchcapitalmanagement-bucket-agora.s3.eu-central-1.amazonaws.com/v2/61604346-0979-4dec-874e
Source: chromecache_76.2.dr, chromecache_92.2.dr	String found in binary or memory: https://marchcapitalmanagement-bucket-agora.s3.eu-central-1.amazonaws.com/v2/f1305632-5179-4b03-95b1
Source: chromecache_80.2.dr, chromecache_106.2.dr	String found in binary or memory: https://marchcapitalmanagement.com/terms-and-conditions-of-use/
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://media.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://media6degrees.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://mediaintelligence.de
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://mediamath.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://mediavine.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://metro.co.uk
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://microad.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://momento.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://moshimo.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://naver.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://nexxen.tech
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://nhnace.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://nodals.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://onet.pl
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://onetag-sys.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://open-bid.com
Source: chromecache_107.2.dr	String found in binary or memory: https://openfontlicense.orgRoboto-BoldVersion
Source: chromecache_75.2.dr	String found in binary or memory: https://openfontlicense.orgRoboto-RegularVersion
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://openx.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://optable.co
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://outbrain.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://paa-reporting-advertising.amazon
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://payment.goog
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://permutive.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://pinterest.com
Source: chromecache_104.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://postrelease.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://presage.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://primecaster.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-ad-server.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-a.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-b.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-x.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-y.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-a.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-b.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-x.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-y.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp.dev
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandbox-test.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-ad-server.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-a1.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-b1.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-x.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-y.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-a.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-b.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-x.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-y.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://ptb-msmt-static-5jyy5ulagq-uc.a.run.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://pub.network
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://pubmatic.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://pubtm.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://quantserve.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://quora.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://r2b2.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://relevant-digital.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://retargetly.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://rubiconproject.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://samplicio.us
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://sascdn.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://seedtag.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://semafor.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://sephora.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://shared-storage-demo-content-producer.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://shared-storage-demo-publisher-a.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://shared-storage-demo-publisher-b.web.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://shinobi.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://shinystat.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://simeola.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://singular.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://sitescout.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://smadexprivacysandbox.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://snapchat.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://socdm.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://sportradarserving.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://stackadapt.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://storygize.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://superfine.org
Source: chromecache_104.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_73.2.dr, chromecache_104.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_73.2.dr, chromecache_104.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_73.2.dr, chromecache_104.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://t13.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://taboola.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://tailtarget.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://tamedia.com.tw
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://tangooserver.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://teads.tv
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://theryn.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://tiktok.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://tncid.app
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://toponad.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://torneos.gg
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://tpmark.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://tribalfusion.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://trip.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://triptease.io
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://trkkn.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://tya-dev.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://uinterbox.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://undertone.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://unrulymedia.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://uol.com.br
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://usemax.de
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://validate.audio
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://verve.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://vg.no
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://vidazoo.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://vpadn.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://washingtonpost.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://weborama-tech.ru
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://weborama.fr
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://wepowerconnections.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://worldhistory.org
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://wp.pl
Source: chromecache_101.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: chromecache_73.2.dr, chromecache_104.2.dr, chromecache_78.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_73.2.dr, chromecache_104.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/J79K9xgfxwT6Syzx-UyWdD89/recaptcha__.
Source: chromecache_82.2.dr, chromecache_78.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/J79K9xgfxwT6Syzx-UyWdD89/recaptcha__en.js
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://yahoo.co.jp
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://yahoo.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://yelp.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://yieldlab.net
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://yieldmo.com
Source: privacy-sandbox-attestations.dat.1.dr	String found in binary or memory: https://youronlinechoices.eu

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52780
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 52780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52782
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 52782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.217.16.196:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.164:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.7.109:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.7.109:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.7.109:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.58.135.32:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.134.19:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.134.19:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.50.88.88:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.50.88.88:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.136.221:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.136.221:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.7.83:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.50.88.88:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 130.211.34.183:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 130.211.34.183:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 130.211.34.183:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.25.25:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.25.25:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.25.25:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.4:49809 version: TLS 1.2

System Summary

Creates files inside the system directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir1228_1443369346			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1041600333			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1041600333\privacy-sandbox-attestations.dat			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1041600333\manifest.json			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1041600333\_metadata\			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1041600333\_metadata\verified_contents.json			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1041600333\manifest.fingerprint			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir1228_979268985			Jump to behavior

Deletes files inside the Windows folder

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir1228_1443369346

Jump to behavior

Classification label

Source: classification engine

Classification label: mal48.evad.win@26/71@39/13

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2036,i,238669714065736736,16993917840205862217,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://marchcapitalmanagement.portal.agorareal.com/#/signup?email=fundadmin%40iconiqcapital.com&code=3HOf5LZO&ref_id=7d05c7e4-505b-4532-b990-6a812f1cf7c1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2036,i,238669714065736736,16993917840205862217,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: dropped/chromecache_108, type: DROPPED