Edit tour

Windows Analysis Report
https://eqrco.de/a/thFNTJ

Overview

General Information

Sample URL:	https://eqrco.de/a/thFNTJ
Analysis ID:	1649360
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains password input but no form action

HTTP GET or POST without a user agent

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 728 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

chrome.exe (PID: 2636 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2164,i,10632415230429981967,258300853272009830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2116 /prefetch:11 MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

chrome.exe (PID: 6544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eqrco.de/a/thFNTJ" MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

chrome.exe (PID: 6880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://qrcode.link/a/RkN6l2 MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

cleanup

HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743008189054&w=0&anoncknm=al_app_anon&NoResponseBody=true HTTP/1.1Accept-Encoding: gzip, deflateContent-Length: 3656Content-Type: application/json; charset=UTF-8Host: browser.events.data.msn.cnConnection: Keep-AliveCache-Control: no-cache

Source: https://console.unitag.io/signup?product=qrcodes	Joe Sandbox AI: Score: 9 Reasons: LVMH is a well-known luxury goods conglomerate., The URL 'console.unitag.io' does not match the legitimate domain 'lvmh.com'., The domain 'unitag.io' does not have any known association with LVMH., The presence of input fields for email and password is suspicious, especially when the domain does not match the brand., The use of a third-party domain with no clear connection to LVMH increases the likelihood of phishing. DOM: 2.10.pages.csv
Source: https://console.unitag.io/signup?product=qrcodes	Joe Sandbox AI: Score: 9 Reasons: LVMH is a well-known luxury goods conglomerate., The URL 'console.unitag.io' does not match the legitimate domain 'lvmh.com'., The domain 'unitag.io' does not have any known association with LVMH., The presence of input fields for email and password is suspicious given the URL does not match the brand's legitimate domain., The use of a third-party domain with no clear association to the brand is a common phishing tactic. DOM: 2.12.pages.csv

Source: https://eqrco.de/a/thFNTJ	HTTP Parser: No favicon
Source: https://www.unitag.io/en-US	HTTP Parser: No favicon
Source: https://www.unitag.io/en-US	HTTP Parser: No favicon
Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No favicon
Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No favicon
Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No favicon

Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No <meta name="author".. found
Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No <meta name="author".. found
Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No <meta name="author".. found
Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No <meta name="author".. found

Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No <meta name="copyright".. found
Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No <meta name="copyright".. found
Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No <meta name="copyright".. found
Source: https://console.unitag.io/signup?product=qrcodes	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.250.64.68:443 -> 192.168.2.24:60838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.56.12.77:443 -> 192.168.2.24:60839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.56.12.77:443 -> 192.168.2.24:60840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.72.231:443 -> 192.168.2.24:60846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.72.231:443 -> 192.168.2.24:60845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.67.45:443 -> 192.168.2.24:60849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.67.45:443 -> 192.168.2.24:60850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.254.12.100:443 -> 192.168.2.24:60852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.254.12.100:443 -> 192.168.2.24:60853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.41.175:443 -> 192.168.2.24:60865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.2.24:60870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.146.81:443 -> 192.168.2.24:60879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.146.81:443 -> 192.168.2.24:60880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.9.173:443 -> 192.168.2.24:60881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.153:443 -> 192.168.2.24:60891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.35.93.10:443 -> 192.168.2.24:60903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.254.12.100:443 -> 192.168.2.24:60911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.146.81:443 -> 192.168.2.24:60927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.254.12.100:443 -> 192.168.2.24:60931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.219.104:443 -> 192.168.2.24:60952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.208.22:443 -> 192.168.2.24:60951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.192.122:443 -> 192.168.2.24:60959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.202.201:443 -> 192.168.2.24:60961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.238.60:443 -> 192.168.2.24:60960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.192.122:443 -> 192.168.2.24:60965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.240.166:443 -> 192.168.2.24:60966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.192.122:443 -> 192.168.2.24:60968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.240.166:443 -> 192.168.2.24:60969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.35.93.96:443 -> 192.168.2.24:60975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.200.16.113:443 -> 192.168.2.24:60980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.241.138.155:443 -> 192.168.2.24:60984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.10.212.243:443 -> 192.168.2.24:60986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.235.209:443 -> 192.168.2.24:60998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.235.209:443 -> 192.168.2.24:60997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.248.203:443 -> 192.168.2.24:61003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.248.203:443 -> 192.168.2.24:61002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.68:443 -> 192.168.2.24:61006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.78:443 -> 192.168.2.24:61007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.35.93.43:443 -> 192.168.2.24:61011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.68:443 -> 192.168.2.24:61020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.67.45:443 -> 192.168.2.24:61018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.67.45:443 -> 192.168.2.24:61015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.67.45:443 -> 192.168.2.24:61014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.67.45:443 -> 192.168.2.24:61017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.67.45:443 -> 192.168.2.24:61016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.67.45:443 -> 192.168.2.24:61019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.176.209:443 -> 192.168.2.24:61022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.235.209:443 -> 192.168.2.24:61026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.235.209:443 -> 192.168.2.24:61029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.235.209:443 -> 192.168.2.24:61038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.35.93.10:443 -> 192.168.2.24:61040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.235.209:443 -> 192.168.2.24:61041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.187.119.242:443 -> 192.168.2.24:61042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.35.93.9:443 -> 192.168.2.24:61045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.186.23.98:443 -> 192.168.2.24:61047 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 208.89.73.29
Source: unknown	TCP traffic detected without corresponding DNS query: 208.89.73.29
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.179.36
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.179.36
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.179.36
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_184.3.dr	String found in binary or memory: "https://www.facebook.com/StripeHQ", equals www.facebook.com (Facebook)
Source: chromecache_184.3.dr	String found in binary or memory: "https://www.linkedin.com/company/stripe/", equals www.linkedin.com (Linkedin)
Source: chromecache_227.3.dr	String found in binary or memory: <a class="MuiButtonBase-root MuiIconButton-root MuiIconButton-sizeMedium mui-style-1yxmbwk" tabindex="0" aria-label="Youtube account" target="_blank" rel="noopener noreferrer" href="https://www.youtube.com/c/UnitagLive"><img alt="Youtube" loading="lazy" width="30" height="30" decoding="async" data-nimg="1" class="svgFooterIcon" style="color:transparent" srcSet="/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Fyoutube.svg&w=32&q=75 1x, /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Fyoutube.svg&w=64&q=75 2x" src="/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Fyoutube.svg&w=64&q=75"/></a><a class="MuiButtonBase-root MuiIconButton-root MuiIconButton-sizeMedium mui-style-1yxmbwk" tabindex="0" aria-label="LinkedIn account" target="_blank" rel="noopener noreferrer" href="https://www.linkedin.com/company/unitag-qr"><img alt="Linkedin" loading="lazy" width="30" height="30" decoding="async" data-nimg="1" class="svgFooterIcon" style="color:transparent" srcSet="/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Flinkedin.svg&w=32&q=75 1x, /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Flinkedin.svg&w=64&q=75 2x" src="/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Flinkedin.svg&w=64&q=75"/></a><br/><br/></div></div></div><div class="MuiBox-root mui-style-0" style="margin:50px 0px 24px 0px;border-top:1px solid grey;padding-top:30px"><p class="MuiTypography-root MuiTypography-subtitle2 MuiTypography-alignCenter MuiTypography-gutterBottom mui-style-1buvqvz"> equals www.linkedin.com (Linkedin)
Source: chromecache_227.3.dr	String found in binary or memory: <a class="MuiButtonBase-root MuiIconButton-root MuiIconButton-sizeMedium mui-style-1yxmbwk" tabindex="0" aria-label="Youtube account" target="_blank" rel="noopener noreferrer" href="https://www.youtube.com/c/UnitagLive"><img alt="Youtube" loading="lazy" width="30" height="30" decoding="async" data-nimg="1" class="svgFooterIcon" style="color:transparent" srcSet="/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Fyoutube.svg&w=32&q=75 1x, /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Fyoutube.svg&w=64&q=75 2x" src="/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Fyoutube.svg&w=64&q=75"/></a><a class="MuiButtonBase-root MuiIconButton-root MuiIconButton-sizeMedium mui-style-1yxmbwk" tabindex="0" aria-label="LinkedIn account" target="_blank" rel="noopener noreferrer" href="https://www.linkedin.com/company/unitag-qr"><img alt="Linkedin" loading="lazy" width="30" height="30" decoding="async" data-nimg="1" class="svgFooterIcon" style="color:transparent" srcSet="/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Flinkedin.svg&w=32&q=75 1x, /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Flinkedin.svg&w=64&q=75 2x" src="/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Ffooter%2Flinkedin.svg&w=64&q=75"/></a><br/><br/></div></div></div><div class="MuiBox-root mui-style-0" style="margin:50px 0px 24px 0px;border-top:1px solid grey;padding-top:30px"><p class="MuiTypography-root MuiTypography-subtitle2 MuiTypography-alignCenter MuiTypography-gutterBottom mui-style-1buvqvz"> equals www.youtube.com (Youtube)
Source: chromecache_227.3.dr	String found in binary or memory: <button class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-1wcc8wp" tabindex="0" type="button" aria-haspopup="true" aria-label="Change language"><img style="height:20px;width:auto" alt="US" src="https://purecatamphetamine.github.io/country-flag-icons/3x2/US.svg"/><span class="MuiButton-endIcon MuiButton-iconSizeMedium mui-style-1n4a93h"><svg class="MuiSvgIcon-root MuiSvgIcon-fontSizeMedium mui-style-vubbuv" focusable="false" aria-hidden="true" viewBox="0 0 24 24" data-testid="KeyboardArrowDownIcon"><path d="M7.41 8.59 12 13.17l4.59-4.58L18 10l-6 6-6-6z"></path></svg></span></button></div></div></header><script type="application/ld+json">{"@context":"https://schema.org","@type":"Organization","@id":"https://unitag.io#organization","name":"Unitag","legalName":"SAS Unitag","description":"Unitag, QR Code Solutions for Businesses. QR code tools featuring Digital Business Cards, Packaging and Labeling, QR codes, and a suite of services for the businesses of the future.","url":"https://unitag.io","email":"team@unitag.io","logo":"https://www.unitag.io/_next/image?url=%2Flogos%2Funitag-logo-300-133.webp&w=640&q=75","foundingDate":"2011","address":{"@type":"PostalAddress","streetAddress":"13 Rue Sainte-Ursule","addressLocality":"Toulouse","addressRegion":"Haute-Garonne","postalCode":"31000","addressCountry":"France"},"contactPoint":[{"@type":"ContactPoint","contactType":"Sales","email":"sales@email.unitag.io"}],"sameAs":["https://www.facebook.com/Unitag","https://twitter.com/UnitagLive","https://www.instagram.com/unitag.qr/","https://www.youtube.com/c/UnitagLive","https://www.linkedin.com/company/unitag/"]}</script><script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"Unitag \| QR code solutions for Enterprises \| Free QR code generator","description":"Unitag, QR Code Solutions for Businesses. QR code tools featuring Digital Business Cards, Packaging and Labeling, QR codes, and a suite of services for the businesses of the future."}</script><header class="MuiPaper-root MuiPaper-elevation MuiPaper-elevation4 MuiAppBar-root MuiAppBar-colorPrimary MuiAppBar-positionFixed mui-fixed mui-style-1ihwlgb"><div class="MuiToolbar-root MuiToolbar-gutters MuiToolbar-regular mui-style-10zx60l"><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#digicardid">Digital business card</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#packalabel">Packaging and Labeling</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#qrcodeid">QR CODE</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-siz
Source: chromecache_227.3.dr	String found in binary or memory: <button class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-1wcc8wp" tabindex="0" type="button" aria-haspopup="true" aria-label="Change language"><img style="height:20px;width:auto" alt="US" src="https://purecatamphetamine.github.io/country-flag-icons/3x2/US.svg"/><span class="MuiButton-endIcon MuiButton-iconSizeMedium mui-style-1n4a93h"><svg class="MuiSvgIcon-root MuiSvgIcon-fontSizeMedium mui-style-vubbuv" focusable="false" aria-hidden="true" viewBox="0 0 24 24" data-testid="KeyboardArrowDownIcon"><path d="M7.41 8.59 12 13.17l4.59-4.58L18 10l-6 6-6-6z"></path></svg></span></button></div></div></header><script type="application/ld+json">{"@context":"https://schema.org","@type":"Organization","@id":"https://unitag.io#organization","name":"Unitag","legalName":"SAS Unitag","description":"Unitag, QR Code Solutions for Businesses. QR code tools featuring Digital Business Cards, Packaging and Labeling, QR codes, and a suite of services for the businesses of the future.","url":"https://unitag.io","email":"team@unitag.io","logo":"https://www.unitag.io/_next/image?url=%2Flogos%2Funitag-logo-300-133.webp&w=640&q=75","foundingDate":"2011","address":{"@type":"PostalAddress","streetAddress":"13 Rue Sainte-Ursule","addressLocality":"Toulouse","addressRegion":"Haute-Garonne","postalCode":"31000","addressCountry":"France"},"contactPoint":[{"@type":"ContactPoint","contactType":"Sales","email":"sales@email.unitag.io"}],"sameAs":["https://www.facebook.com/Unitag","https://twitter.com/UnitagLive","https://www.instagram.com/unitag.qr/","https://www.youtube.com/c/UnitagLive","https://www.linkedin.com/company/unitag/"]}</script><script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"Unitag \| QR code solutions for Enterprises \| Free QR code generator","description":"Unitag, QR Code Solutions for Businesses. QR code tools featuring Digital Business Cards, Packaging and Labeling, QR codes, and a suite of services for the businesses of the future."}</script><header class="MuiPaper-root MuiPaper-elevation MuiPaper-elevation4 MuiAppBar-root MuiAppBar-colorPrimary MuiAppBar-positionFixed mui-fixed mui-style-1ihwlgb"><div class="MuiToolbar-root MuiToolbar-gutters MuiToolbar-regular mui-style-10zx60l"><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#digicardid">Digital business card</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#packalabel">Packaging and Labeling</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#qrcodeid">QR CODE</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-siz
Source: chromecache_227.3.dr	String found in binary or memory: <button class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-1wcc8wp" tabindex="0" type="button" aria-haspopup="true" aria-label="Change language"><img style="height:20px;width:auto" alt="US" src="https://purecatamphetamine.github.io/country-flag-icons/3x2/US.svg"/><span class="MuiButton-endIcon MuiButton-iconSizeMedium mui-style-1n4a93h"><svg class="MuiSvgIcon-root MuiSvgIcon-fontSizeMedium mui-style-vubbuv" focusable="false" aria-hidden="true" viewBox="0 0 24 24" data-testid="KeyboardArrowDownIcon"><path d="M7.41 8.59 12 13.17l4.59-4.58L18 10l-6 6-6-6z"></path></svg></span></button></div></div></header><script type="application/ld+json">{"@context":"https://schema.org","@type":"Organization","@id":"https://unitag.io#organization","name":"Unitag","legalName":"SAS Unitag","description":"Unitag, QR Code Solutions for Businesses. QR code tools featuring Digital Business Cards, Packaging and Labeling, QR codes, and a suite of services for the businesses of the future.","url":"https://unitag.io","email":"team@unitag.io","logo":"https://www.unitag.io/_next/image?url=%2Flogos%2Funitag-logo-300-133.webp&w=640&q=75","foundingDate":"2011","address":{"@type":"PostalAddress","streetAddress":"13 Rue Sainte-Ursule","addressLocality":"Toulouse","addressRegion":"Haute-Garonne","postalCode":"31000","addressCountry":"France"},"contactPoint":[{"@type":"ContactPoint","contactType":"Sales","email":"sales@email.unitag.io"}],"sameAs":["https://www.facebook.com/Unitag","https://twitter.com/UnitagLive","https://www.instagram.com/unitag.qr/","https://www.youtube.com/c/UnitagLive","https://www.linkedin.com/company/unitag/"]}</script><script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"Unitag \| QR code solutions for Enterprises \| Free QR code generator","description":"Unitag, QR Code Solutions for Businesses. QR code tools featuring Digital Business Cards, Packaging and Labeling, QR codes, and a suite of services for the businesses of the future."}</script><header class="MuiPaper-root MuiPaper-elevation MuiPaper-elevation4 MuiAppBar-root MuiAppBar-colorPrimary MuiAppBar-positionFixed mui-fixed mui-style-1ihwlgb"><div class="MuiToolbar-root MuiToolbar-gutters MuiToolbar-regular mui-style-10zx60l"><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#digicardid">Digital business card</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#packalabel">Packaging and Labeling</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#qrcodeid">QR CODE</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-siz
Source: chromecache_227.3.dr	String found in binary or memory: <button class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-1wcc8wp" tabindex="0" type="button" aria-haspopup="true" aria-label="Change language"><img style="height:20px;width:auto" alt="US" src="https://purecatamphetamine.github.io/country-flag-icons/3x2/US.svg"/><span class="MuiButton-endIcon MuiButton-iconSizeMedium mui-style-1n4a93h"><svg class="MuiSvgIcon-root MuiSvgIcon-fontSizeMedium mui-style-vubbuv" focusable="false" aria-hidden="true" viewBox="0 0 24 24" data-testid="KeyboardArrowDownIcon"><path d="M7.41 8.59 12 13.17l4.59-4.58L18 10l-6 6-6-6z"></path></svg></span></button></div></div></header><script type="application/ld+json">{"@context":"https://schema.org","@type":"Organization","@id":"https://unitag.io#organization","name":"Unitag","legalName":"SAS Unitag","description":"Unitag, QR Code Solutions for Businesses. QR code tools featuring Digital Business Cards, Packaging and Labeling, QR codes, and a suite of services for the businesses of the future.","url":"https://unitag.io","email":"team@unitag.io","logo":"https://www.unitag.io/_next/image?url=%2Flogos%2Funitag-logo-300-133.webp&w=640&q=75","foundingDate":"2011","address":{"@type":"PostalAddress","streetAddress":"13 Rue Sainte-Ursule","addressLocality":"Toulouse","addressRegion":"Haute-Garonne","postalCode":"31000","addressCountry":"France"},"contactPoint":[{"@type":"ContactPoint","contactType":"Sales","email":"sales@email.unitag.io"}],"sameAs":["https://www.facebook.com/Unitag","https://twitter.com/UnitagLive","https://www.instagram.com/unitag.qr/","https://www.youtube.com/c/UnitagLive","https://www.linkedin.com/company/unitag/"]}</script><script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"Unitag \| QR code solutions for Enterprises \| Free QR code generator","description":"Unitag, QR Code Solutions for Businesses. QR code tools featuring Digital Business Cards, Packaging and Labeling, QR codes, and a suite of services for the businesses of the future."}</script><header class="MuiPaper-root MuiPaper-elevation MuiPaper-elevation4 MuiAppBar-root MuiAppBar-colorPrimary MuiAppBar-positionFixed mui-fixed mui-style-1ihwlgb"><div class="MuiToolbar-root MuiToolbar-gutters MuiToolbar-regular mui-style-10zx60l"><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#digicardid">Digital business card</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#packalabel">Packaging and Labeling</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-sizeMedium MuiButton-textSizeMedium MuiButtonBase-root mui-style-nl1ivt" tabindex="0" href="#qrcodeid">QR CODE</a><a class="MuiButton-root MuiButton-text MuiButton-textPrimary MuiButton-siz
Source: chromecache_281.3.dr, chromecache_291.3.dr, chromecache_232.3.dr, chromecache_141.3.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Vk:function(){e=rb()},Md:function(){d()}}};var bc=wa(["data-gtm-yt-inspected-"]),nH=["www.youtube.com","www.youtube-nocookie.com"],oH,pH=!1; equals www.youtube.com (Youtube)
Source: chromecache_281.3.dr, chromecache_291.3.dr, chromecache_232.3.dr, chromecache_141.3.dr	String found in binary or memory: U(b)\|\|Gm(a,b)},b)},Gt=function(){return[O.m.R,O.m.T]},Ht=/^(?:www\.)?google(?:\.com?)?(?:\.[a-z]{2}t?)?$/,It=/^www\.googleadservices\.com$/,Mt=/^gad_source[_=](\d+)$/;function Rt(){return po("dedupe_gclid",function(){return jr()})};var St=/^(www\.)?google(\.com?)?(\.[a-z]{2}t?)?$/,Tt=/^www.googleadservices.com$/;function Ut(a){a\|\|(a=Vt());return a.co?!1:a.dn\|\|a.fn\|\|a.jn\|\|a.gn\|\|a.qf\|\|a.Om\|\|a.hn\|\|a.Tm?!0:!1}function Vt(){var a={},b=Pr(!0);a.co=!!b._up;var c=et();a.dn=c.aw!==void 0;a.fn=c.dc!==void 0;a.jn=c.wbraid!==void 0;a.gn=c.gbraid!==void 0;a.hn=c.gclsrc==="aw.ds";a.qf=Et().qf;var d=A.referrer?bk(hk(A.referrer),"host"):"";a.Tm=St.test(d);a.Om=Tt.test(d);return a};var Wt=["https://www.google.com","https://www.youtube.com"]; equals www.youtube.com (Youtube)
Source: chromecache_280.3.dr, chromecache_136.3.dr, chromecache_213.3.dr	String found in binary or memory: function zt(a,b){var c=Qs(b),d=Rs(a,c);if(!d)return 0;var e;e=a==="ag"?Ss(d):Ns(d);for(var f=0,g=0;g<e.length;g++)f=Math.max(f,e[g].timestamp);return f}function At(a){for(var b=0,c=l(Object.keys(a)),d=c.next();!d.done;d=c.next())for(var e=a[d.value],f=0;f<e.length;f++)b=Math.max(b,Number(e[f].timestamp));return b}function Bt(a){var b=Math.max(zt("aw",a),At(Ks(Js())?Ds():{})),c=Math.max(zt("gb",a),At(Ks(Js())?Ds("_gac_gb",!0):{}));c=Math.max(c,zt("ag",a));return c>b};function Rt(){return po("dedupe_gclid",function(){return jr()})};var St=/^(www\.)?google(\.com?)?(\.[a-z]{2}t?)?$/,Tt=/^www.googleadservices.com$/;function Ut(a){a\|\|(a=Vt());return a.co?!1:a.dn\|\|a.fn\|\|a.jn\|\|a.gn\|\|a.qf\|\|a.Om\|\|a.hn\|\|a.Tm?!0:!1}function Vt(){var a={},b=Pr(!0);a.co=!!b._up;var c=et();a.dn=c.aw!==void 0;a.fn=c.dc!==void 0;a.jn=c.wbraid!==void 0;a.gn=c.gbraid!==void 0;a.hn=c.gclsrc==="aw.ds";a.qf=Et().qf;var d=A.referrer?bk(hk(A.referrer),"host"):"";a.Tm=St.test(d);a.Om=Tt.test(d);return a};var Wt=["https://www.google.com","https://www.youtube.com"]; equals www.youtube.com (Youtube)
Source: chromecache_281.3.dr, chromecache_291.3.dr, chromecache_232.3.dr, chromecache_141.3.dr	String found in binary or memory: if(!(f\|\|g\|\|k\|\|m.length\|\|n.length))return;var q={Vh:f,Th:g,Uh:k,Fi:m,Gi:n,pf:p,Rb:e},r=z.YT;if(r)return r.ready&&r.ready(d),e;var u=z.onYouTubeIframeAPIReady;z.onYouTubeIframeAPIReady=function(){u&&u();d()};E(function(){for(var v=A.getElementsByTagName("script"),t=v.length,w=0;w<t;w++){var x=v[w].getAttribute("src");if(yH(x,"iframe_api")\|\|yH(x,"player_api"))return e}for(var y=A.getElementsByTagName("iframe"),B=y.length,C=0;C<B;C++)if(!pH&&wH(y[C],q.pf))return tc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_261.3.dr	String found in binary or memory: inline:{css:1},disableRealtimeCallback:!1,drive_share:{skipInitCommand:!0},csi:{rate:.01},client:{cors:!1},signInDeprecation:{rate:0},include_granted_scopes:!0,llang:"en",iframes:{youtube:{params:{location:["search","hash"]},url:":socialhost:/:session_prefix:_/widget/render/youtube?usegapi=1",methods:["scroll","openwindow"]},ytsubscribe:{url:"https://www.youtube.com/subscribe_embed?usegapi=1"},plus_circle:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/plus/circle?usegapi=1"}, equals www.youtube.com (Youtube)
Source: chromecache_280.3.dr, chromecache_136.3.dr, chromecache_213.3.dr	String found in binary or memory: return f}lH.K="internal.enableAutoEventOnTimer";var bc=wa(["data-gtm-yt-inspected-"]),nH=["www.youtube.com","www.youtube-nocookie.com"],oH,pH=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: eqrco.de
Source: global traffic	DNS traffic detected: DNS query: unitag-public-assets.s3.eu-west-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: qrcode.link
Source: global traffic	DNS traffic detected: DNS query: unitag.io
Source: global traffic	DNS traffic detected: DNS query: www.unitag.io
Source: global traffic	DNS traffic detected: DNS query: calendly.com
Source: global traffic	DNS traffic detected: DNS query: purecatamphetamine.github.io
Source: global traffic	DNS traffic detected: DNS query: assets.calendly.com
Source: global traffic	DNS traffic detected: DNS query: booking-dfp.calendly.com
Source: global traffic	DNS traffic detected: DNS query: js.stripe.com
Source: global traffic	DNS traffic detected: DNS query: api-v2.unitag.io
Source: global traffic	DNS traffic detected: DNS query: js-eu1.hs-scripts.com
Source: global traffic	DNS traffic detected: DNS query: widget.trustpilot.com
Source: global traffic	DNS traffic detected: DNS query: js-eu1.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: js-eu1.hs-analytics.net
Source: global traffic	DNS traffic detected: DNS query: js-eu1.hs-banner.com
Source: global traffic	DNS traffic detected: DNS query: forms-eu1.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: track-eu1.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: m.stripe.network
Source: global traffic	DNS traffic detected: DNS query: m.stripe.com
Source: global traffic	DNS traffic detected: DNS query: stripe.com
Source: global traffic	DNS traffic detected: DNS query: console.unitag.io
Source: global traffic	DNS traffic detected: DNS query: unpkg.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: csp.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: r.stripe.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 16:56:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Headers: Content-type, Origin, Authorization, X-Media-PasswordAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: FilenameSet-Cookie: QoSID=a4bfc9a4-e27b-4344-b705-f42e22b0afa7; Path=/; Domain=eqrco.de; Max-Age=200000000Server: Unitag
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 16:56:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Headers: Content-type, Origin, Authorization, X-Media-PasswordAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: FilenameServer: Unitag
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 26 Mar 2025 16:57:32 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 26 Mar 2025 16:57:33 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 26 Mar 2025 16:57:34 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 26 Mar 2025 16:57:37 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2164,i,10632415230429981967,258300853272009830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2116 /prefetch:11
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eqrco.de/a/thFNTJ"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://qrcode.link/a/RkN6l2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2164,i,10632415230429981967,258300853272009830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2116 /prefetch:11
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: global traffic	HTTP traffic detected: GET /a/thFNTJ HTTP/1.1Host: eqrco.deConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/404topright.png HTTP/1.1Host: unitag-public-assets.s3.eu-west-1.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://eqrco.de/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/unitag-new-logo-hd.png HTTP/1.1Host: unitag-public-assets.s3.eu-west-1.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://eqrco.de/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: eqrco.deConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eqrco.de/a/thFNTJAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: QoSID=a4bfc9a4-e27b-4344-b705-f42e22b0afa7
Source: global traffic	HTTP traffic detected: GET /img/unitag-new-logo-hd.png HTTP/1.1Host: unitag-public-assets.s3.eu-west-1.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/404topright.png HTTP/1.1Host: unitag-public-assets.s3.eu-west-1.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIlqHLAQiKo8sBCIWgzQEI/aXOAQiB1s4BCPzbzgEIxeDOAQiu5M4BCN/kzgEI5OTOAQiM5c4BGJblzgE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a/RkN6l2 HTTP/1.1Host: qrcode.linkConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: unitag.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.unitag.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-US HTTP/1.1Host: www.unitag.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/css/72ef92dd0db9b055.css HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/css/ab00b741547f6893.css HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbeauty.png&w=640&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbucket.png&w=640&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fphone.png&w=640&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2FlittleGuy.png&w=128&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d/2v4-jgc-sq6?background_color=white&embed_type=Inline&embed_domain=1 HTTP/1.1Host: calendly.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://www.unitag.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2FlittleGuyBubble.png&w=640&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/webpack-db79dc8fd7a15167.js HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/media/Museo700Regular.9f379769.otf HTTP/1.1Host: www.unitag.ioConnection: keep-aliveOrigin: https://www.unitag.iosec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.unitag.io/_next/static/css/72ef92dd0db9b055.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/framework-2114f3935436c3d0.js HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /country-flag-icons/3x2/US.svg HTTP/1.1Host: purecatamphetamine.github.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://www.unitag.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbeauty.png&w=640&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fphone.png&w=640&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/main-4e7fb1caeee717e7.js HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbucket.png&w=640&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2FlittleGuy.png&w=128&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flogos%2FunitagLogo.webp&w=384&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fsso-image-al.png&w=640&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Frgpd-compliant.png&w=640&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/booking/css/booking-49a6feea.css HTTP/1.1Host: assets.calendly.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://calendly.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=ByflZppoKWl_B0TOF.WH0XHobDxvaVEZ7uPT9xsxxA0-1743008217-1.0.1.1-3MjGCGKF9DQcpeHLaWO_inbEy9v621li6HLlBpAsbuptQriyqhpYbam3sN.dRNrQPz2Nb3ElBixhmjeeAbRmty1aE4sSKCIrznjDS3weBr4; __cfruid=6688985c9e455976659a00a2e42325a8d8dcc164-1743008217; _cfuvid=Wtu0eDHxLEmfdJZXiOlsrhXOqWrU2EkEv02hHVnqet8-1743008217594-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /telemetry.js HTTP/1.1Host: booking-dfp.calendly.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://calendly.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=ByflZppoKWl_B0TOF.WH0XHobDxvaVEZ7uPT9xsxxA0-1743008217-1.0.1.1-3MjGCGKF9DQcpeHLaWO_inbEy9v621li6HLlBpAsbuptQriyqhpYbam3sN.dRNrQPz2Nb3ElBixhmjeeAbRmty1aE4sSKCIrznjDS3weBr4; __cfruid=6688985c9e455976659a00a2e42325a8d8dcc164-1743008217; _cfuvid=Wtu0eDHxLEmfdJZXiOlsrhXOqWrU2EkEv02hHVnqet8-1743008217594-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/booking/js/booking-c14d0a51.js HTTP/1.1Host: assets.calendly.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://calendly.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=ByflZppoKWl_B0TOF.WH0XHobDxvaVEZ7uPT9xsxxA0-1743008217-1.0.1.1-3MjGCGKF9DQcpeHLaWO_inbEy9v621li6HLlBpAsbuptQriyqhpYbam3sN.dRNrQPz2Nb3ElBixhmjeeAbRmty1aE4sSKCIrznjDS3weBr4; __cfruid=6688985c9e455976659a00a2e42325a8d8dcc164-1743008217; _cfuvid=Wtu0eDHxLEmfdJZXiOlsrhXOqWrU2EkEv02hHVnqet8-1743008217594-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Fgs1%2Fgs1-approved.png&w=640&q=75 HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/_app-c77c23f3b2244afb.js HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/5466-313967085a6938a9.js HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/4332-8af4aeaa19f188cb.js HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/3759-d72d636397a06819.js HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/index-3093e5e7e16c3f38.js HTTP/1.1Host: www.unitag.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.unitag.io/en-USAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbeauty.png&w=640&q=75	0%	Avira URL Cloud	safe
https://console.unitag.io/favicon.ico	0%	Avira URL Cloud	safe
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/img/404topright.png	0%	Avira URL Cloud	safe
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/img/unitag-new-logo-hd.png	0%	Avira URL Cloud	safe
https://console.unitag.io/static/js/main.8e761dbc.js	0%	Avira URL Cloud	safe
https://qrcode.link/a/RkN6l2	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FMigros.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/pricing-a7ae6af70bb8c89f.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fbuzzman.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/website/landing/brands/arthur-lloyd.png	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fsso-image-al.png&w=640&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/webpack-db79dc8fd7a15167.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FCEPOVETT.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://cdn-public.unitag.io/website	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbucket.png&w=640&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2FbackgroundvCardLanding.png&w=640&q=75	0%	Avira URL Cloud	safe
https://unitag.io/	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=%2Fapps%2Fpng%2Fqrcode.png&w=64&q=75	0%	Avira URL Cloud	safe
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/website/landing/brands/lvmh.png	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2Fvcard-transparency2.png&w=640&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=%2Fapps%2Fpng%2Fvcard.png&w=64&q=75	0%	Avira URL Cloud	safe
https://console.unitag.io/static/media/background_login.86ec6fc0724b2671084a.webp	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2FComp1_00220.png&w=256&q=75	0%	Avira URL Cloud	safe
https://unitag.io	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
d1tcqh4bio8cty.cloudfront.net	13.35.93.96	true	false	high
unitag.io	34.110.168.37	true	false	unknown
e5de3d23065c4748b155c28e6fa36f3e.pacloudflare.com	172.65.240.166	true	false	high
18ea70d2d9a945cfb97d818ba71817dc.pacloudflare.com	172.65.238.60	true	false	high
eqrco.de	149.56.12.77	true	false	high
stripe.com	52.10.212.243	true	false	high
www.google.com	142.250.64.68	true	false	high
qrcode.link	51.254.12.100	true	false	unknown
2acdb9b66bb242618283aadb21ede6c1.pacloudflare.com	172.65.208.22	true	false	high
15e49451d4884c2582b2c780d1077dd0.pacloudflare.com	172.65.192.122	true	false	high
csp.withgoogle.com	142.250.176.209	true	false	high
plus.l.google.com	142.250.80.78	true	false	high
assets.calendly.com	172.64.146.81	true	false	high
console.unitag.io	34.110.235.209	true	false	unknown
r.stripe.com	54.187.119.242	true	false	high
s3-r-w.eu-west-1.amazonaws.com	3.5.72.231	true	false	high
fallback.customers.stytch.com.cdn.cloudflare.net	104.18.9.173	true	false	unknown
m.stripe.com	54.200.16.113	true	false	high
dexeqbeb7giwr.cloudfront.net	13.35.93.10	true	false	high
7c7b02d4bc3d48dd81a7c7738d4de1ab.pacloudflare.com	172.65.202.201	true	false	high
api-v2.unitag.io	51.254.12.100	true	false	unknown
calendly.com	104.18.41.175	true	false	high
purecatamphetamine.github.io	185.199.110.153	true	false	high
widget.trustpilot.com	18.173.219.104	true	false	high
unpkg.com	104.17.248.203	true	false	high
www.unitag.io	34.110.168.37	true	false	unknown
track-eu1.hubspot.com	unknown	unknown	false	high
forms-eu1.hscollectedforms.net	unknown	unknown	false	high
m.stripe.network	unknown	unknown	false	high
js-eu1.hs-analytics.net	unknown	unknown	false	high
booking-dfp.calendly.com	unknown	unknown	false	unknown
unitag-public-assets.s3.eu-west-1.amazonaws.com	unknown	unknown	false	unknown
js-eu1.hs-scripts.com	unknown	unknown	false	high
js-eu1.hs-banner.com	unknown	unknown	false	high
js.stripe.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
js-eu1.hscollectedforms.net	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/img/unitag-new-logo-hd.png	false	Avira URL Cloud: safe	unknown
https://js-eu1.hs-scripts.com/145850171.js	false		high
https://eqrco.de/favicon.ico	false		high
https://www.google.com/recaptcha/api2/bframe?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb&k=6Lf--vwZAAAAAI-HsU4O80GvzxDeYKkX_GkQllCW	false		high
https://qrcode.link/a/RkN6l2	false	Avira URL Cloud: safe	unknown
https://purecatamphetamine.github.io/country-flag-icons/3x2/US.svg	false		high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=hbAq-YhJxOnlU-7cpgBoAJHb	false		high
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/website/landing/brands/arthur-lloyd.png	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FMigros.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbeauty.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://js.stripe.com/v3/fingerprinted/js/controller-with-shared-control-ac3a6c8c67f700a5419eb7f5c0fe3d1c.js	false		high
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fbuzzman.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://console.unitag.io/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/pricing-a7ae6af70bb8c89f.js	false	Avira URL Cloud: safe	unknown
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/img/404topright.png	false	Avira URL Cloud: safe	unknown
https://console.unitag.io/static/js/main.8e761dbc.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fsso-image-al.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://unpkg.com/leaflet@1.7.1/dist/leaflet.css	false		high
https://assets.calendly.com/assets/booking/js/booking-c14d0a51.js	false		high
https://www.unitag.io/_next/static/chunks/webpack-db79dc8fd7a15167.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FCEPOVETT.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api.js	false		high
https://unitag.io/	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2FbackgroundvCardLanding.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=%2Fapps%2Fpng%2Fqrcode.png&w=64&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbucket.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/website/landing/brands/lvmh.png	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2Fvcard-transparency2.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://m.stripe.network/inner.html	false		high
https://www.unitag.io/_next/image?url=%2Fapps%2Fpng%2Fvcard.png&w=64&q=75	false	Avira URL Cloud: safe	unknown
https://console.unitag.io/static/media/background_login.86ec6fc0724b2671084a.webp	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2FComp1_00220.png&w=256&q=75	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://b.stripecdn.com/mkt-statics-srv/assets/v1-CopyTitle-c641e014b3946628bc95.css	chromecache_184.3.dr	false		high
https://docs.stripe.com	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-GridLayout-decb2efdf862023c83af.css	chromecache_184.3.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_166.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-FrontdoorConnectGraphic-30f9ea68cfc29ae65dd5.css	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-StripeProductUsedList-9d35065b7106fd9143c1.css	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-CodeEditorLineNumbers-0eded1c84476ec649145.css	chromecache_184.3.dr	false		high
https://pay.google.com/gp/v/widget/save	chromecache_261.3.dr	false		high
https://stripe.com/docs/testing.	chromecache_251.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-ProductListing-3e17d7acee941b127dd1.css	chromecache_184.3.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_221.3.dr, chromecache_287.3.dr	false		high
https://stripe.com/ie	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-FrontdoorConnectFlowDiagramOrderNotification-12b17	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-FrontdoorBillingGraphicTier-c39e78ce45a9380bf169.c	chromecache_184.3.dr	false		high
https://docs.stripe.com/stripe-apps	chromecache_184.3.dr	false		high
https://support.google.com/recaptcha	chromecache_287.3.dr	false		high
https://www.youtube.com/subscribe_embed?usegapi=1	chromecache_261.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1/f965fdf4.woff2)	chromecache_184.3.dr	false		high
https://docs.stripe.com/development	chromecache_184.3.dr	false		high
https://docs.stripe.com/no-code/payment-links	chromecache_184.3.dr	false		high
https://stripe.com/in	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-CodeEditorAsciiLoader-c1a350cb85f7a989f599.css	chromecache_184.3.dr	false		high
https://stripe.com/it	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-StripeSet-423109ad4bf57a2a011c.css	chromecache_184.3.dr	false		high
https://stripe.com/#organization	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-AnimatedCodeEditor-86776e0635434fc49715.css	chromecache_184.3.dr	false		high
https://images.stripeassets.com/fzn2n1nzq965/5F0uhf7cRg9vhR6NmgWzzI/664e14ddebb91375f89f8dcc75242dc0	chromecache_184.3.dr	false		high
https://stripe.com/jp	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-FrontdoorStandaloneAnimation-5aefb3912ae346b5293e.	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-CodeEditorAutocomplete-dc62d89d9e2121e48baf.css	chromecache_184.3.dr	false		high
https://dashboard.stripe.com/	chromecache_184.3.dr	false		high
https://docs.stripe.com/no-code/tap-to-pay	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-FrontdoorConnectAnimation-f4ce77b995975fa55335.css	chromecache_184.3.dr	false		high
http://www.hubspot.com	chromecache_298.3.dr, chromecache_210.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-CustomersCaseStudyCarouselNavItem-fd5a8f8fac232f66	chromecache_184.3.dr	false		high
https://telemetry.stytch.com/submit	chromecache_193.3.dr	false		high
https://www.instagram.com/unitag.qr/	chromecache_227.3.dr	false		high
https://unpkg.com/leaflet	chromecache_273.3.dr	false		high
https://stripe.com/sv-fi	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-FrontdoorIconGrid-f5ddeb3e7d94044a9646.css	chromecache_184.3.dr	false		high
https://support.stripe.com/?referrerLocale=en-us	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-GradientLegend-f1cabc70fbf82f3e9c05.css	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-GlobalizationPicker-cb59e0de1d5c3aeaa184.css	chromecache_184.3.dr	false		high
https://github.com/google/safevalues/issues	chromecache_261.3.dr	false		high
https://cloud.google.com/contact	chromecache_221.3.dr, chromecache_287.3.dr	false		high
https://www.google.com/shopping/customerreviews/badge?usegapi=1	chromecache_261.3.dr	false		high
https://cdn-public.unitag.io/website	chromecache_226.3.dr	false	Avira URL Cloud: safe	unknown
https://stripe.com/de	chromecache_184.3.dr	false		high
https://apis.google.com	chromecache_261.3.dr	false		high
https://docs.stripe.com/payments/checkout	chromecache_184.3.dr	false		high
https://twitter.com/UnitagLive	chromecache_227.3.dr	false		high
https://dashboard.stripe.com/register	chromecache_184.3.dr	false		high
https://assets.stripeassets.com/fzn2n1nzq965/01hMKr6nEEGVfOuhsaMIXQ/c424849423b5f036a8892afa09ac38c7	chromecache_184.3.dr	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_221.3.dr, chromecache_287.3.dr	false		high
http://leafletjs.com	chromecache_311.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-Track-2f2fce741fc3d8fc8450.css	chromecache_184.3.dr	false		high
https://stripe.com/zh-hk	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-ProductBadge-aa2497ab8abdcc6a3d34.css	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-PaymentLinksFeatureGraphic-6c9382201d4ede7c851a.cs	chromecache_184.3.dr	false		high
https://stripe.com/contact/sales	chromecache_184.3.dr	false		high
https://stripe.com/es	chromecache_184.3.dr	false		high
https://images.stripeassets.com/fzn2n1nzq965/3CxKGHQwuus4zchiW7USrb/de51410aec1f616c97a88333dd090e6d	chromecache_184.3.dr	false		high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_221.3.dr, chromecache_287.3.dr	false		high
https://stripe.com/gb	chromecache_184.3.dr	false		high
https://unitag.io	chromecache_227.3.dr	false	Avira URL Cloud: safe	unknown
https://www.linkedin.com/company/stripe/	chromecache_184.3.dr	false		high
https://images.stripeassets.com/fzn2n1nzq965/4zeFefnpB8yh7U3qSQRktP/d583ee93dd3d8910fa27296748699a0f	chromecache_184.3.dr	false		high
https://b.stripecdn.com/mkt-statics-srv/assets/v1-FrontdoorBillingGraphicLogo-2cee099c6b840fb58d86.c	chromecache_184.3.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.35.93.10	dexeqbeb7giwr.cloudfront.net	United States	16509	AMAZON-02US	false
13.35.93.96	d1tcqh4bio8cty.cloudfront.net	United States	16509	AMAZON-02US	false
18.173.219.104	widget.trustpilot.com	United States	3	MIT-GATEWAYSUS	false
104.17.248.203	unpkg.com	United States	13335	CLOUDFLARENETUS	false
104.18.41.175	calendly.com	United States	13335	CLOUDFLARENETUS	false
54.200.16.113	m.stripe.com	United States	16509	AMAZON-02US	false
3.5.67.45	unknown	United States	14618	AMAZON-AESUS	false
142.250.176.209	csp.withgoogle.com	United States	15169	GOOGLEUS	false
54.187.119.242	r.stripe.com	United States	16509	AMAZON-02US	false
172.65.240.166	e5de3d23065c4748b155c28e6fa36f3e.pacloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.65.202.201	7c7b02d4bc3d48dd81a7c7738d4de1ab.pacloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.10.212.243	stripe.com	United States	16509	AMAZON-02US	false
172.64.146.81	assets.calendly.com	United States	13335	CLOUDFLARENETUS	false
172.65.238.60	18ea70d2d9a945cfb97d818ba71817dc.pacloudflare.com	United States	13335	CLOUDFLARENETUS	false
185.199.110.153	purecatamphetamine.github.io	Netherlands	54113	FASTLYUS	false
13.35.93.43	unknown	United States	16509	AMAZON-02US	false
34.110.235.209	console.unitag.io	United States	15169	GOOGLEUS	false
149.56.12.77	eqrco.de	Canada	16276	OVHFR	false
3.5.72.231	s3-r-w.eu-west-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.250.64.68	www.google.com	United States	15169	GOOGLEUS	false
104.18.9.173	fallback.customers.stytch.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
54.186.23.98	unknown	United States	16509	AMAZON-02US	false
172.65.192.122	15e49451d4884c2582b2c780d1077dd0.pacloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.80.78	plus.l.google.com	United States	15169	GOOGLEUS	false
44.241.138.155	unknown	United States	16509	AMAZON-02US	false
51.254.12.100	qrcode.link	France	16276	OVHFR	false
172.65.208.22	2acdb9b66bb242618283aadb21ede6c1.pacloudflare.com	United States	13335	CLOUDFLARENETUS	false
185.199.108.153	unknown	Netherlands	54113	FASTLYUS	false
34.110.168.37	unitag.io	United States	15169	GOOGLEUS	false
13.35.93.9	unknown	United States	16509	AMAZON-02US	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649360
Start date and time:	2025-03-26 17:55:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 57s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://eqrco.de/a/thFNTJ
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@32/301@84/31

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1840 x 773, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	21098
Entropy (8bit):	7.858442791978209
Encrypted:	false
SSDEEP:	384:d9iAvP+PfAdU4kAM0BOJfiVwG8YEqfG8hKWTaK60aaDBbHOd/XL2:9vPiAe0BOJ06ifhnTT6jmbHk/XL2
MD5:	D9E42A77FCE37EADC454CC46BD428FEF
SHA1:	524107DC7610504AF44527176D962BABAB5F2257
SHA-256:	E525D6DE684F145179794C8B3C45058DCE94F4137F68B95D5044C826750FCB5B
SHA-512:	D7E56739228EBC7B79E87BE7FF1A0A252A0FF5D76BA754879B82A15E73B0E3D6D16F1B4C3130609D864F1F0F7474D8E234DA3341D7598886C1C9B9B735DA0253
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0.........,.......PLTELiq....................\|.....tRNS..zB..".....pHYs............... .IDATx....(........^Y..U).....>?f.L.J..................................................................................................................................................................................B..{..x.......B....O.....G....a.}.....BuN...y....l.G.\ur.{....{.M..-6IM..]....Jj...m.=F.g@....6.{V,c.I.,.`n[...?v.M...f..o.#3.......)Df..f....S.....a..!6bg.,.`........q...f.......cI..@ga.1.y....:.US.."...I.]S._D&...+......u...?L....Y&.?'.p...,,.......}.....L......v>....-.u..J&...,AO&.@.../4......./4....<#._.\(..jKN$..../.@...%............\|<}..R.....=f.._$&.@.Y.......r........zhk..f....<.5......{rk......dl~tXM.ue..IT/..Ii........nL..%.........E../.1..1T/....8apl.........e.......{.HY.@.6zi..;...?.....s......l!...g'.~..c&..r2.MR..+7.U..b..:W/?.R...m...lR.......sMI.[...1.........D'e..sE.&...9v.V..L....xfyi..?.~m....x.b...e......,....f.}.1,{F&+....

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 17:56:49.265014887 CET	60838	443	192.168.2.24	142.250.64.68
Mar 26, 2025 17:56:49.265053034 CET	443	60838	142.250.64.68	192.168.2.24
Mar 26, 2025 17:56:49.265125990 CET	60838	443	192.168.2.24	142.250.64.68
Mar 26, 2025 17:56:49.265315056 CET	60838	443	192.168.2.24	142.250.64.68
Mar 26, 2025 17:56:49.265326023 CET	443	60838	142.250.64.68	192.168.2.24
Mar 26, 2025 17:56:49.454727888 CET	443	60838	142.250.64.68	192.168.2.24
Mar 26, 2025 17:56:49.455903053 CET	60838	443	192.168.2.24	142.250.64.68
Mar 26, 2025 17:56:49.456238031 CET	60838	443	192.168.2.24	142.250.64.68
Mar 26, 2025 17:56:49.456264019 CET	443	60838	142.250.64.68	192.168.2.24
Mar 26, 2025 17:56:49.456666946 CET	443	60838	142.250.64.68	192.168.2.24
Mar 26, 2025 17:56:49.505716085 CET	60838	443	192.168.2.24	142.250.64.68
Mar 26, 2025 17:56:50.428987026 CET	60839	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.429048061 CET	443	60839	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.429125071 CET	60839	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.430648088 CET	60840	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.430695057 CET	443	60840	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.430747986 CET	60840	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.431096077 CET	60840	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.431111097 CET	443	60840	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.431313038 CET	60839	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.431343079 CET	443	60839	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.639368057 CET	443	60839	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.639566898 CET	60839	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.639784098 CET	443	60840	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.639853001 CET	60840	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.643270016 CET	60839	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.643301010 CET	443	60839	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.643532991 CET	443	60839	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.644431114 CET	60840	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.644445896 CET	443	60840	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.644572973 CET	60839	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:50.644757986 CET	443	60840	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.692269087 CET	443	60839	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:50.694864988 CET	60840	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:51.150443077 CET	443	60839	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:51.150465012 CET	443	60839	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:51.150540113 CET	443	60839	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:51.150628090 CET	60839	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:51.150629044 CET	60839	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:51.152686119 CET	60839	443	192.168.2.24	149.56.12.77
Mar 26, 2025 17:56:51.152725935 CET	443	60839	149.56.12.77	192.168.2.24
Mar 26, 2025 17:56:51.283648968 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.283658028 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.283823013 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.284152985 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.284157038 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.284161091 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.284181118 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.284262896 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.285486937 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.285495996 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.650090933 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.651180983 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.651180983 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.651199102 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.651612997 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.651753902 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.651787043 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.652287006 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.652614117 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.652625084 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.652874947 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.653134108 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.700268984 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.700304031 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.998990059 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.999054909 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.999073029 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.999440908 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:51.999470949 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:51.999597073 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.004789114 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.004944086 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.004959106 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.005049944 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.005049944 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.005063057 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.007978916 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.169126034 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.169153929 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.169225931 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.169270992 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.169287920 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.169287920 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.169359922 CET	443	60845	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.169414043 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.169919014 CET	60845	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.176331997 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.176354885 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.176403046 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.176541090 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.176559925 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.176572084 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.176594973 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.176651001 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.176651001 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.176651001 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.176661015 CET	443	60846	3.5.72.231	192.168.2.24
Mar 26, 2025 17:56:52.224293947 CET	60846	443	192.168.2.24	3.5.72.231
Mar 26, 2025 17:56:52.339328051 CET	443	60845	3.5.72.231	192.168.2.24

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 26, 2025 17:56:49.179630041 CET	192.168.2.24	1.1.1.1	0x540c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:49.180039883 CET	192.168.2.24	1.1.1.1	0x1ea3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 26, 2025 17:56:50.102154016 CET	192.168.2.24	1.1.1.1	0xe215	Standard query (0)	eqrco.de	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:50.102154016 CET	192.168.2.24	1.1.1.1	0xbe5c	Standard query (0)	eqrco.de	65	IN (0x0001)	false
Mar 26, 2025 17:56:51.180044889 CET	192.168.2.24	1.1.1.1	0x870e	Standard query (0)	unitag-public-assets.s3.eu-west-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:51.180180073 CET	192.168.2.24	1.1.1.1	0x854e	Standard query (0)	unitag-public-assets.s3.eu-west-1.amazonaws.com	65	IN (0x0001)	false
Mar 26, 2025 17:56:52.472313881 CET	192.168.2.24	1.1.1.1	0x9106	Standard query (0)	unitag-public-assets.s3.eu-west-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:52.472624063 CET	192.168.2.24	1.1.1.1	0x7299	Standard query (0)	unitag-public-assets.s3.eu-west-1.amazonaws.com	65	IN (0x0001)	false
Mar 26, 2025 17:56:53.564538002 CET	192.168.2.24	1.1.1.1	0x67a5	Standard query (0)	qrcode.link	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:53.564714909 CET	192.168.2.24	1.1.1.1	0xb436	Standard query (0)	qrcode.link	65	IN (0x0001)	false
Mar 26, 2025 17:56:54.496421099 CET	192.168.2.24	1.1.1.1	0xd88b	Standard query (0)	unitag.io	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:54.496685982 CET	192.168.2.24	1.1.1.1	0x371b	Standard query (0)	unitag.io	65	IN (0x0001)	false
Mar 26, 2025 17:56:55.359347105 CET	192.168.2.24	1.1.1.1	0x2dd0	Standard query (0)	www.unitag.io	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:55.359553099 CET	192.168.2.24	1.1.1.1	0xbee9	Standard query (0)	www.unitag.io	65	IN (0x0001)	false
Mar 26, 2025 17:56:57.072634935 CET	192.168.2.24	1.1.1.1	0xcef4	Standard query (0)	calendly.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:57.072788954 CET	192.168.2.24	1.1.1.1	0xe51	Standard query (0)	calendly.com	65	IN (0x0001)	false
Mar 26, 2025 17:56:57.213067055 CET	192.168.2.24	1.1.1.1	0x60dd	Standard query (0)	purecatamphetamine.github.io	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:57.213414907 CET	192.168.2.24	1.1.1.1	0xd9fa	Standard query (0)	purecatamphetamine.github.io	65	IN (0x0001)	false
Mar 26, 2025 17:56:57.223759890 CET	192.168.2.24	1.1.1.1	0xa5ae	Standard query (0)	www.unitag.io	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:57.224016905 CET	192.168.2.24	1.1.1.1	0x6b9d	Standard query (0)	www.unitag.io	65	IN (0x0001)	false
Mar 26, 2025 17:56:57.655932903 CET	192.168.2.24	1.1.1.1	0x666b	Standard query (0)	assets.calendly.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:57.656131029 CET	192.168.2.24	1.1.1.1	0x33ca	Standard query (0)	assets.calendly.com	65	IN (0x0001)	false
Mar 26, 2025 17:56:57.668773890 CET	192.168.2.24	1.1.1.1	0x6552	Standard query (0)	booking-dfp.calendly.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:57.668966055 CET	192.168.2.24	1.1.1.1	0xa2b4	Standard query (0)	booking-dfp.calendly.com	65	IN (0x0001)	false
Mar 26, 2025 17:56:58.816616058 CET	192.168.2.24	1.1.1.1	0xc120	Standard query (0)	purecatamphetamine.github.io	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:58.816868067 CET	192.168.2.24	1.1.1.1	0xebcd	Standard query (0)	purecatamphetamine.github.io	65	IN (0x0001)	false
Mar 26, 2025 17:56:59.284136057 CET	192.168.2.24	1.1.1.1	0x4e21	Standard query (0)	js.stripe.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:59.284362078 CET	192.168.2.24	1.1.1.1	0x15d9	Standard query (0)	js.stripe.com	65	IN (0x0001)	false
Mar 26, 2025 17:56:59.795279026 CET	192.168.2.24	1.1.1.1	0xadbd	Standard query (0)	api-v2.unitag.io	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:56:59.795452118 CET	192.168.2.24	1.1.1.1	0xeff6	Standard query (0)	api-v2.unitag.io	65	IN (0x0001)	false
Mar 26, 2025 17:57:01.728149891 CET	192.168.2.24	1.1.1.1	0xfed7	Standard query (0)	calendly.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:01.728331089 CET	192.168.2.24	1.1.1.1	0x4e7e	Standard query (0)	calendly.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:01.800491095 CET	192.168.2.24	1.1.1.1	0x9033	Standard query (0)	api-v2.unitag.io	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:01.800651073 CET	192.168.2.24	1.1.1.1	0xe35b	Standard query (0)	api-v2.unitag.io	65	IN (0x0001)	false
Mar 26, 2025 17:57:02.632975101 CET	192.168.2.24	1.1.1.1	0x6c54	Standard query (0)	js-eu1.hs-scripts.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:02.633147955 CET	192.168.2.24	1.1.1.1	0x40c8	Standard query (0)	js-eu1.hs-scripts.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:02.633408070 CET	192.168.2.24	1.1.1.1	0x90ca	Standard query (0)	widget.trustpilot.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:02.633542061 CET	192.168.2.24	1.1.1.1	0x2500	Standard query (0)	widget.trustpilot.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:04.289604902 CET	192.168.2.24	1.1.1.1	0x82a9	Standard query (0)	js-eu1.hscollectedforms.net	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:04.290050030 CET	192.168.2.24	1.1.1.1	0xeee6	Standard query (0)	js-eu1.hscollectedforms.net	65	IN (0x0001)	false
Mar 26, 2025 17:57:04.297440052 CET	192.168.2.24	1.1.1.1	0x3ef5	Standard query (0)	js-eu1.hs-analytics.net	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:04.297754049 CET	192.168.2.24	1.1.1.1	0xf69d	Standard query (0)	js-eu1.hs-analytics.net	65	IN (0x0001)	false
Mar 26, 2025 17:57:04.299531937 CET	192.168.2.24	1.1.1.1	0xb219	Standard query (0)	js-eu1.hs-banner.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:04.299868107 CET	192.168.2.24	1.1.1.1	0x47c4	Standard query (0)	js-eu1.hs-banner.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:05.351429939 CET	192.168.2.24	1.1.1.1	0xa96	Standard query (0)	forms-eu1.hscollectedforms.net	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:05.351587057 CET	192.168.2.24	1.1.1.1	0xa0c7	Standard query (0)	forms-eu1.hscollectedforms.net	65	IN (0x0001)	false
Mar 26, 2025 17:57:05.356978893 CET	192.168.2.24	1.1.1.1	0x3ece	Standard query (0)	track-eu1.hubspot.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:05.357194901 CET	192.168.2.24	1.1.1.1	0x87a6	Standard query (0)	track-eu1.hubspot.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:06.228220940 CET	192.168.2.24	1.1.1.1	0x8064	Standard query (0)	forms-eu1.hscollectedforms.net	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:06.228365898 CET	192.168.2.24	1.1.1.1	0xbf3c	Standard query (0)	forms-eu1.hscollectedforms.net	65	IN (0x0001)	false
Mar 26, 2025 17:57:06.264894009 CET	192.168.2.24	1.1.1.1	0x5420	Standard query (0)	track-eu1.hubspot.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:06.265048027 CET	192.168.2.24	1.1.1.1	0xd6ab	Standard query (0)	track-eu1.hubspot.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:07.890786886 CET	192.168.2.24	1.1.1.1	0x712a	Standard query (0)	m.stripe.network	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:07.890888929 CET	192.168.2.24	1.1.1.1	0xbe92	Standard query (0)	m.stripe.network	65	IN (0x0001)	false
Mar 26, 2025 17:57:09.623733997 CET	192.168.2.24	1.1.1.1	0xdd13	Standard query (0)	m.stripe.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:09.624243975 CET	192.168.2.24	1.1.1.1	0x6910	Standard query (0)	m.stripe.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:10.591906071 CET	192.168.2.24	1.1.1.1	0x22d7	Standard query (0)	m.stripe.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:10.592215061 CET	192.168.2.24	1.1.1.1	0xac37	Standard query (0)	m.stripe.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:11.320029020 CET	192.168.2.24	1.1.1.1	0x9464	Standard query (0)	stripe.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:11.320283890 CET	192.168.2.24	1.1.1.1	0x77f3	Standard query (0)	stripe.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:24.350538015 CET	192.168.2.24	1.1.1.1	0xfc0a	Standard query (0)	console.unitag.io	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:24.350856066 CET	192.168.2.24	1.1.1.1	0xce78	Standard query (0)	console.unitag.io	65	IN (0x0001)	false
Mar 26, 2025 17:57:25.236512899 CET	192.168.2.24	1.1.1.1	0x7e71	Standard query (0)	unpkg.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:25.236644983 CET	192.168.2.24	1.1.1.1	0x6049	Standard query (0)	unpkg.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:25.237839937 CET	192.168.2.24	1.1.1.1	0x6429	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:25.238008022 CET	192.168.2.24	1.1.1.1	0x4f2e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:25.238465071 CET	192.168.2.24	1.1.1.1	0x80bd	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:25.238585949 CET	192.168.2.24	1.1.1.1	0xc1cb	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:26.861095905 CET	192.168.2.24	1.1.1.1	0x54f8	Standard query (0)	js.stripe.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:26.861288071 CET	192.168.2.24	1.1.1.1	0x6e02	Standard query (0)	js.stripe.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:27.017513990 CET	192.168.2.24	1.1.1.1	0x5687	Standard query (0)	unitag-public-assets.s3.eu-west-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:27.017642975 CET	192.168.2.24	1.1.1.1	0x599d	Standard query (0)	unitag-public-assets.s3.eu-west-1.amazonaws.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:27.084413052 CET	192.168.2.24	1.1.1.1	0x6feb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:27.085170031 CET	192.168.2.24	1.1.1.1	0x3b3b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:27.674494028 CET	192.168.2.24	1.1.1.1	0xc71d	Standard query (0)	csp.withgoogle.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:27.674645901 CET	192.168.2.24	1.1.1.1	0x5c11	Standard query (0)	csp.withgoogle.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:28.159727097 CET	192.168.2.24	1.1.1.1	0x6836	Standard query (0)	console.unitag.io	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:28.159946918 CET	192.168.2.24	1.1.1.1	0xb56f	Standard query (0)	console.unitag.io	65	IN (0x0001)	false
Mar 26, 2025 17:57:30.446787119 CET	192.168.2.24	1.1.1.1	0x909b	Standard query (0)	r.stripe.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:30.447007895 CET	192.168.2.24	1.1.1.1	0xb32f	Standard query (0)	r.stripe.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:30.810476065 CET	192.168.2.24	1.1.1.1	0x210b	Standard query (0)	js.stripe.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:30.810750961 CET	192.168.2.24	1.1.1.1	0x1fc6	Standard query (0)	js.stripe.com	65	IN (0x0001)	false
Mar 26, 2025 17:57:31.814867020 CET	192.168.2.24	1.1.1.1	0xd5af	Standard query (0)	r.stripe.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 17:57:31.814990997 CET	192.168.2.24	1.1.1.1	0x3e45	Standard query (0)	r.stripe.com	65	IN (0x0001)	false

Target ID:	0
Start time:	12:56:36
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6820f0000
File size:	3'384'928 bytes
MD5 hash:	DBE43C1D0092437B88CFF7BD9ABC336C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	12:56:42
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2164,i,10632415230429981967,258300853272009830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2116 /prefetch:11
Imagebase:	0x7ff6820f0000
File size:	3'384'928 bytes
MD5 hash:	DBE43C1D0092437B88CFF7BD9ABC336C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	6
Start time:	12:56:48
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eqrco.de/a/thFNTJ"
Imagebase:	0x7ff6820f0000
File size:	3'384'928 bytes
MD5 hash:	DBE43C1D0092437B88CFF7BD9ABC336C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://eqrco.de/a/thFNTJ

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Windows Analysis Report
https://eqrco.de/a/thFNTJ

Target ID:	8
Start time:	12:56:52
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://qrcode.link/a/RkN6l2
Imagebase:	0x7ff6820f0000
File size:	3'384'928 bytes
MD5 hash:	DBE43C1D0092437B88CFF7BD9ABC336C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre