Edit tour

Windows Analysis Report
https://eqrco.de/a/thFNTJ

Overview

General Information

Sample URL:	https://eqrco.de/a/thFNTJ
Analysis ID:	1649365
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Found detection on Joe Sandbox Cloud Basic

Creates files inside the system directory

Deletes files inside the Windows folder

HTTP GET or POST without a user agent

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 1736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

chrome.exe (PID: 4056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,5030251173658242376,3979903367133529276,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2100 /prefetch:11 MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

chrome.exe (PID: 6608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eqrco.de/a/thFNTJ" MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

chrome.exe (PID: 6572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://qrcode.link/a/RkN6l2 MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

cleanup

HTTP traffic detected: POST /6 HTTP/1.1Host: m.stripe.comConnection: keep-aliveContent-Length: 3836sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://m.stripe.networkSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://m.stripe.network/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 17:06:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Headers: Content-type, Origin, Authorization, X-Media-PasswordAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: FilenameSet-Cookie: QoSID=a688f51c-9814-4de8-a1c3-1df48c9e18cd; Path=/; Domain=eqrco.de; Max-Age=200000000Server: Unitag
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 17:06:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Headers: Content-type, Origin, Authorization, X-Media-PasswordAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: FilenameServer: Unitag

Source: unknown	Network traffic detected: HTTP traffic on port 60850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60891
Source: unknown	Network traffic detected: HTTP traffic on port 60947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60890
Source: unknown	Network traffic detected: HTTP traffic on port 60924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60896
Source: unknown	Network traffic detected: HTTP traffic on port 60849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61030
Source: unknown	Network traffic detected: HTTP traffic on port 60892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60972
Source: unknown	Network traffic detected: HTTP traffic on port 61019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61029
Source: unknown	Network traffic detected: HTTP traffic on port 60863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61026
Source: unknown	Network traffic detected: HTTP traffic on port 60886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61027
Source: unknown	Network traffic detected: HTTP traffic on port 60897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60981
Source: unknown	Network traffic detected: HTTP traffic on port 60923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60868
Source: unknown	Network traffic detected: HTTP traffic on port 60940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60867
Source: unknown	Network traffic detected: HTTP traffic on port 60845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60984
Source: unknown	Network traffic detected: HTTP traffic on port 61014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61038
Source: unknown	Network traffic detected: HTTP traffic on port 60978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60871
Source: unknown	Network traffic detected: HTTP traffic on port 60922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60990
Source: unknown	Network traffic detected: HTTP traffic on port 60917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60879
Source: unknown	Network traffic detected: HTTP traffic on port 61036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60874
Source: unknown	Network traffic detected: HTTP traffic on port 61013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60880
Source: unknown	Network traffic detected: HTTP traffic on port 60973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60888
Source: unknown	Network traffic detected: HTTP traffic on port 60900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60887
Source: unknown	Network traffic detected: HTTP traffic on port 60868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60886
Source: unknown	Network traffic detected: HTTP traffic on port 60885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60817
Source: unknown	Network traffic detected: HTTP traffic on port 60909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60937
Source: unknown	Network traffic detected: HTTP traffic on port 61021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60936
Source: unknown	Network traffic detected: HTTP traffic on port 60938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60933
Source: unknown	Network traffic detected: HTTP traffic on port 61038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60930
Source: unknown	Network traffic detected: HTTP traffic on port 61015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60948
Source: unknown	Network traffic detected: HTTP traffic on port 60830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60821
Source: unknown	Network traffic detected: HTTP traffic on port 60887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60940
Source: unknown	Network traffic detected: HTTP traffic on port 60898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60950
Source: unknown	Network traffic detected: HTTP traffic on port 60968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60831
Source: unknown	Network traffic detected: HTTP traffic on port 60869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60830
Source: unknown	Network traffic detected: HTTP traffic on port 61032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60849
Source: unknown	Network traffic detected: HTTP traffic on port 61026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61019
Source: unknown	Network traffic detected: HTTP traffic on port 60921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60968
Source: unknown	Network traffic detected: HTTP traffic on port 60881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60845
Source: unknown	Network traffic detected: HTTP traffic on port 60904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60844
Source: unknown	Network traffic detected: HTTP traffic on port 60864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61016
Source: unknown	Network traffic detected: HTTP traffic on port 60831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60904
Source: unknown	Network traffic detected: HTTP traffic on port 60937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60903
Source: unknown	Network traffic detected: HTTP traffic on port 60975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60901
Source: unknown	Network traffic detected: HTTP traffic on port 61039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60900
Source: unknown	Network traffic detected: HTTP traffic on port 60883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60916
Source: unknown	Network traffic detected: HTTP traffic on port 60936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60913
Source: unknown	Network traffic detected: HTTP traffic on port 60903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60911
Source: unknown	Network traffic detected: HTTP traffic on port 60888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60910
Source: unknown	Network traffic detected: HTTP traffic on port 60865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60926
Source: unknown	Network traffic detected: HTTP traffic on port 60914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60924
Source: unknown	Network traffic detected: HTTP traffic on port 60925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60921
Source: unknown	Network traffic detected: HTTP traffic on port 61016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60920
Source: unknown	Network traffic detected: HTTP traffic on port 61033 -> 443

Source: unknown	HTTPS traffic detected: 149.56.12.77:443 -> 192.168.2.24:60844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.56.12.77:443 -> 192.168.2.24:60845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.71.10:443 -> 192.168.2.24:60850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.71.10:443 -> 192.168.2.24:60849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.218.30.192:443 -> 192.168.2.24:60853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.218.30.192:443 -> 192.168.2.24:60852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.64.68:443 -> 192.168.2.24:60857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.254.12.100:443 -> 192.168.2.24:60859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.254.12.100:443 -> 192.168.2.24:60860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.41.175:443 -> 192.168.2.24:60872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.153:443 -> 192.168.2.24:60881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.41.175:443 -> 192.168.2.24:60886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.41.175:443 -> 192.168.2.24:60888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.8.173:443 -> 192.168.2.24:60887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.153:443 -> 192.168.2.24:60890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.35.93.22:443 -> 192.168.2.24:60908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.254.12.100:443 -> 192.168.2.24:60916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.146.81:443 -> 192.168.2.24:60935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.254.12.100:443 -> 192.168.2.24:60941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.219.101:443 -> 192.168.2.24:60958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.208.22:443 -> 192.168.2.24:60957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.192.122:443 -> 192.168.2.24:60963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.238.60:443 -> 192.168.2.24:60962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.202.201:443 -> 192.168.2.24:60961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.192.122:443 -> 192.168.2.24:60972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.240.166:443 -> 192.168.2.24:60973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.192.122:443 -> 192.168.2.24:60975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.240.166:443 -> 192.168.2.24:60976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.35.93.96:443 -> 192.168.2.24:60979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.168.37:443 -> 192.168.2.24:60983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.238.51.98:443 -> 192.168.2.24:60984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.42.254.61:443 -> 192.168.2.24:60992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.167.54.49:443 -> 192.168.2.24:60993 version: TLS 1.2

System Summary

Found detection on Joe Sandbox Cloud Basic

Source: https://eqrco.de/a/thFNTJ

Joe Sandbox Cloud Basic: Detection: malicious Score: 48 Threat Name: Analyzer: w11x64_office

Perma Link

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir1736_1488108896

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir1736_1488108896

Source: classification engine

Classification label: mal48.win@30/115@106/436

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,5030251173658242376,3979903367133529276,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2100 /prefetch:11
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eqrco.de/a/thFNTJ"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,5030251173658242376,3979903367133529276,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2100 /prefetch:11
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://qrcode.link/a/RkN6l2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://eqrco.de/a/thFNTJ	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fphone.png&w=640&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbucket.png&w=640&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fsso-image-al.png&w=640&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/media/Museo700Regular.9f379769.otf	0%	Avira URL Cloud	safe
https://calendly.com/d/2v4-jgc-sq6?background_color=white&embed_type=Inline&embed_domain=1	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/css/72ef92dd0db9b055.css	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flogos%2FunitagLogo.webp&w=384&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/5466-313967085a6938a9.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/3759-d72d636397a06819.js	0%	Avira URL Cloud	safe
https://qrcode.link/a/RkN6l2	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/main-4e7fb1caeee717e7.js	0%	Avira URL Cloud	safe
https://purecatamphetamine.github.io/country-flag-icons/3x2/US.svg	0%	Avira URL Cloud	safe
https://assets.calendly.com/assets/booking/js/booking-c14d0a51.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Fgs1%2Fgs1-approved.png&w=640&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/webpack-db79dc8fd7a15167.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2FlittleGuy.png&w=128&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/css/ab00b741547f6893.css	0%	Avira URL Cloud	safe
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/img/unitag-new-logo-hd.png	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/4332-8af4aeaa19f188cb.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2FlittleGuyBubble.png&w=640&q=75	0%	Avira URL Cloud	safe
https://eqrco.de/favicon.ico	0%	Avira URL Cloud	safe
https://booking-dfp.calendly.com/telemetry.js	0%	Avira URL Cloud	safe
https://www.unitag.io/	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/_app-c77c23f3b2244afb.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbeauty.png&w=640&q=75	0%	Avira URL Cloud	safe
https://assets.calendly.com/assets/booking/css/booking-49a6feea.css	0%	Avira URL Cloud	safe
https://unitag.io/	0%	Avira URL Cloud	safe
https://www.unitag.io/en-US	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Frgpd-compliant.png&w=640&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/framework-2114f3935436c3d0.js	0%	Avira URL Cloud	safe
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/img/404topright.png	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/case-studies/real-estate-fbb48b07b277fd8c.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Faltice.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FDeltacore.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://js-eu1.hs-scripts.com/145850171.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FDassauld.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/css/726d6bccd2f7bdf0.css	0%	Avira URL Cloud	safe
https://js-eu1.hs-analytics.net/analytics/1743007200000/145850171.js	0%	Avira URL Cloud	safe
https://www.unitag.io/favicon.ico	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/contact-e6e533d21720268a.js	0%	Avira URL Cloud	safe
https://js-eu1.hscollectedforms.net/collectedforms.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FCEPOVETT.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/case-studies/luxury-ce0c01a0eb91864e.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/case-studies/restaurants-6892abec762556bb.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fcortess.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://api-v2.unitag.io/billing/plans	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fcroixrouge.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/case-studies/hotels-4c178b3f0357d5bc.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/products-d9fcb34e01edd9c5.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/case-studies/pharmaceutics-3c410e8f6e2ffc2e.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FDoopera.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2FbackgroundvCardLanding.png&w=640&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/gkRguyPlp7Nz_SkeHZSQb/_buildManifest.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FCHANEL.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/qr-codes-history-570bbcd8258b770f.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/case-studies/cosmetics-03731930741f01b1.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2Fvcard-transparency2.png&w=640&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FMigros.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/gkRguyPlp7Nz_SkeHZSQb/_ssgManifest.js	0%	Avira URL Cloud	safe
https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1280x1024&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2850574025&v=1.1&a=145850171&rcu=https%3A%2F%2Fwww.unitag.io%2F&pu=https%3A%2F%2Fwww.unitag.io%2Fen-US&t=Unitag+%7C+QR+code+solutions+for+Enterprises+%7C+Free+QR+code+generator&cts=1743008822931&vi=bd44b83a90a867f9a80d4cde7dde26c4&nc=true&u=118881238.bd44b83a90a867f9a80d4cde7dde26c4.1743008822927.1743008822927.1743008822927.1&b=118881238.1.1743008822927&cc=15	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/css/f7640d7d6ed26f51.css	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fbonduelle.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2FVincentBiretEN.png&w=384&q=75	0%	Avira URL Cloud	safe
https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=145850171&utk=	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FMKG.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/index-3093e5e7e16c3f38.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/qrcode-a0b90ffb280a63c0.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2FComp1_00220.png&w=256&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/privacy-policy-88fc638432dee029.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/case-studies/construction-70102dda5a5f8d68.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fbarnes.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://js-eu1.hs-banner.com/v2/145850171/banner.js	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fbuzzman.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://www.unitag.io/_next/static/chunks/pages/pricing-a7ae6af70bb8c89f.js	0%	Avira URL Cloud	safe
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3D24b95d9a158549b4b00e8d8051718e83%26HASH%3D24b9%26LV%3D202412%26V%3D4%26LU%3D1733744931931&w=0	0%	Avira URL Cloud	safe
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1743008921662&ext.intweb.msfpc=GUID%3D24b95d9a158549b4b00e8d8051718e83%26HASH%3D24b9%26LV%3D202412%26V%3D4%26LU%3D1733744931931&time-delta-to-apply-millis=use-collector-delta&w=0&NoResponseBody=true	0%	Avira URL Cloud	safe
https://browser.events.data.msn.cn/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743008918128&w=0&anoncknm=al_app_anon&NoResponseBody=true	0%	Avira URL Cloud	safe
https://assets.msn.com/bundles/v1/winWidgets/latest/microsoft.f8d4f1531a183fd0c6fb.js	0%	Avira URL Cloud	safe
https://assets.msn.com/bundles/v1/winWidgets/latest/common.8a3ec92cda1849d2f906.js	0%	Avira URL Cloud	safe
https://assets.msn.com/bundles/v1/winWidgets/latest/vendors.95d7eefcdb1206c4bf05.js	0%	Avira URL Cloud	safe
https://browser.events.data.msn.cn/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743008930881&w=0&anoncknm=al_app_anon&NoResponseBody=true	0%	Avira URL Cloud	safe
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1743008914000&w=0&anoncknm=app_anon	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d1tcqh4bio8cty.cloudfront.net	13.35.93.96	true	false	high
beacons3.gvt2.com	142.250.65.227	true	false	high
unitag.io	34.110.168.37	true	false	unknown
beacons-handoff.gcp.gvt2.com	142.251.116.94	true	false	high
e5de3d23065c4748b155c28e6fa36f3e.pacloudflare.com	172.65.240.166	true	false	high
18ea70d2d9a945cfb97d818ba71817dc.pacloudflare.com	172.65.238.60	true	false	high
eqrco.de	149.56.12.77	true	false	unknown
stripe.com	35.167.54.49	true	false	high
www.google.com	142.250.64.68	true	false	high
qrcode.link	51.254.12.100	true	false	high
2acdb9b66bb242618283aadb21ede6c1.pacloudflare.com	172.65.208.22	true	false	high
15e49451d4884c2582b2c780d1077dd0.pacloudflare.com	172.65.192.122	true	false	unknown
assets.calendly.com	104.18.41.175	true	false	high
beacons2.gvt2.com	142.251.46.163	true	false	high
beacons.gvt2.com	142.250.114.94	true	false	high
s3-r-w.eu-west-1.amazonaws.com	3.5.71.10	true	false	high
fallback.customers.stytch.com.cdn.cloudflare.net	104.18.8.173	true	false	unknown
m.stripe.com	44.238.51.98	true	false	high
dexeqbeb7giwr.cloudfront.net	13.35.93.22	true	false	high
7c7b02d4bc3d48dd81a7c7738d4de1ab.pacloudflare.com	172.65.202.201	true	false	high
api-v2.unitag.io	51.254.12.100	true	false	high
calendly.com	104.18.41.175	true	false	high
purecatamphetamine.github.io	185.199.110.153	true	false	high
widget.trustpilot.com	18.173.219.101	true	false	high
beacons4.gvt2.com	216.239.32.116	true	false	high
www.unitag.io	34.110.168.37	true	false	high
track-eu1.hubspot.com	unknown	unknown	false	high
forms-eu1.hscollectedforms.net	unknown	unknown	false	high
m.stripe.network	unknown	unknown	false	high
js-eu1.hs-analytics.net	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
booking-dfp.calendly.com	unknown	unknown	false	high
unitag-public-assets.s3.eu-west-1.amazonaws.com	unknown	unknown	false	high
js-eu1.hs-scripts.com	unknown	unknown	false	high
js-eu1.hs-banner.com	unknown	unknown	false	high
js.stripe.com	unknown	unknown	false	high
js-eu1.hscollectedforms.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://calendly.com/d/2v4-jgc-sq6?background_color=white&embed_type=Inline&embed_domain=1	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/case-studies/real-estate-fbb48b07b277fd8c.js	false	Avira URL Cloud: safe	unknown
https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js	false		high
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/img/unitag-new-logo-hd.png	false	Avira URL Cloud: safe	unknown
http://c.pki.goog/r/r1.crl	false		high
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2FlittleGuy.png&w=128&q=75	false	Avira URL Cloud: safe	unknown
https://js-eu1.hs-scripts.com/145850171.js	false	Avira URL Cloud: safe	unknown
https://js-eu1.hscollectedforms.net/collectedforms.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FDassauld.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/css/726d6bccd2f7bdf0.css	false	Avira URL Cloud: safe	unknown
https://js.stripe.com/v3	false		high
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fcortess.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://api-v2.unitag.io/billing/plans	false	Avira URL Cloud: safe	unknown
https://eqrco.de/favicon.ico	false	Avira URL Cloud: safe	unknown
https://booking-dfp.calendly.com/telemetry.js	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.cn/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743008930881&w=0&anoncknm=al_app_anon&NoResponseBody=true	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fcroixrouge.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
http://c.pki.goog/r/gsr1.crl	false		high
https://www.unitag.io/_next/static/chunks/pages/case-studies/hotels-4c178b3f0357d5bc.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/case-studies/pharmaceutics-3c410e8f6e2ffc2e.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FDoopera.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1743008914000&w=0&anoncknm=app_anon	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fphone.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/3759-d72d636397a06819.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FCHANEL.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/gkRguyPlp7Nz_SkeHZSQb/_buildManifest.js	false	Avira URL Cloud: safe	unknown
https://qrcode.link/a/RkN6l2	false	Avira URL Cloud: safe	unknown
https://purecatamphetamine.github.io/country-flag-icons/3x2/US.svg	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FMigros.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/4332-8af4aeaa19f188cb.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fbonduelle.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2FVincentBiretEN.png&w=384&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbeauty.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FMKG.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/index-3093e5e7e16c3f38.js	false	Avira URL Cloud: safe	unknown
https://forms-eu1.hscollectedforms.net/collected-forms/v1/config/json?portalId=145850171&utk=	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/privacy-policy-88fc638432dee029.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/_app-c77c23f3b2244afb.js	false	Avira URL Cloud: safe	unknown
https://js-eu1.hs-banner.com/v2/145850171/banner.js	false	Avira URL Cloud: safe	unknown
https://calendly.com/api/booking/initial_settings?	false		high
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fbuzzman.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://assets.calendly.com/assets/booking/css/booking-49a6feea.css	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/framework-2114f3935436c3d0.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/pricing-a7ae6af70bb8c89f.js	false	Avira URL Cloud: safe	unknown
https://unitag-public-assets.s3.eu-west-1.amazonaws.com/img/404topright.png	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fsso-image-al.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3D24b95d9a158549b4b00e8d8051718e83%26HASH%3D24b9%26LV%3D202412%26V%3D4%26LU%3D1733744931931&w=0	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/media/Museo700Regular.9f379769.otf	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/contact-e6e533d21720268a.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Faltice.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flogos%2FunitagLogo.webp&w=384&q=75	false	Avira URL Cloud: safe	unknown
https://assets.calendly.com/assets/booking/js/booking-c14d0a51.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/webpack-db79dc8fd7a15167.js	false	Avira URL Cloud: safe	unknown
http://c.pki.goog/r/r4.crl	false		high
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FDeltacore.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://js-eu1.hs-analytics.net/analytics/1743007200000/145850171.js	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1743008921662&ext.intweb.msfpc=GUID%3D24b95d9a158549b4b00e8d8051718e83%26HASH%3D24b9%26LV%3D202412%26V%3D4%26LU%3D1733744931931&time-delta-to-apply-millis=use-collector-delta&w=0&NoResponseBody=true	false	Avira URL Cloud: safe	unknown
https://stripe.com/	false		high
https://www.unitag.io/_next/static/chunks/pages/case-studies/luxury-ce0c01a0eb91864e.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2FCEPOVETT.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/case-studies/restaurants-6892abec762556bb.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/en-US	false	Avira URL Cloud: safe	unknown
https://m.stripe.network/out-4.5.44.js	false		high
https://assets.msn.com/bundles/v1/winWidgets/latest/microsoft.f8d4f1531a183fd0c6fb.js	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/bundles/v1/winWidgets/latest/vendors.95d7eefcdb1206c4bf05.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Frgpd-compliant.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.cn/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743008918128&w=0&anoncknm=al_app_anon&NoResponseBody=true	false	Avira URL Cloud: safe	unknown
https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html	false		high
https://www.unitag.io/_next/static/chunks/pages/products-d9fcb34e01edd9c5.js	false	Avira URL Cloud: safe	unknown
https://unitag.io/	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2FbackgroundvCardLanding.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/case-studies/cosmetics-03731930741f01b1.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbucket.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/css/72ef92dd0db9b055.css	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/5466-313967085a6938a9.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/css/ab00b741547f6893.css	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2Fvcard-transparency2.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://windows.msn.com/windows/startfeed?aver=1.1.200.0&over=10.0.22631.4169.amd64fre.ni_release.220506-1250&fring=Retail&devicetype=1&oem=VMware%2C%20Inc.&smode=false&machineId=%7BADA0F343-6E11-4C03-89DA-546517CD1A62%7D&clv=3.0&hver=524.30502.30.0&locale=en-US&region=CH&cm=de-ch&cid=14EA2E828C4D639509943BD28D2B6272&msrc=0	false		high
https://m.stripe.network/inner.html	false		high
https://www.unitag.io/_next/static/chunks/pages/qr-codes-history-570bbcd8258b770f.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/gkRguyPlp7Nz_SkeHZSQb/_ssgManifest.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/main-4e7fb1caeee717e7.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Fgs1%2Fgs1-approved.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/css/f7640d7d6ed26f51.css	false	Avira URL Cloud: safe	unknown
https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=1280x1024&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2850574025&v=1.1&a=145850171&rcu=https%3A%2F%2Fwww.unitag.io%2F&pu=https%3A%2F%2Fwww.unitag.io%2Fen-US&t=Unitag+%7C+QR+code+solutions+for+Enterprises+%7C+Free+QR+code+generator&cts=1743008822931&vi=bd44b83a90a867f9a80d4cde7dde26c4&nc=true&u=118881238.bd44b83a90a867f9a80d4cde7dde26c4.1743008822927.1743008822927.1743008822927.1&b=118881238.1.1743008822927&cc=15	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2FlittleGuyBubble.png&w=640&q=75	false	Avira URL Cloud: safe	unknown
https://eqrco.de/a/thFNTJ	true		unknown
https://assets.msn.com/bundles/v1/winWidgets/latest/common.8a3ec92cda1849d2f906.js	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false		high
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Findex%2FComp1_00220.png&w=256&q=75	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/qrcode-a0b90ffb280a63c0.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/static/chunks/pages/case-studies/construction-70102dda5a5f8d68.js	false	Avira URL Cloud: safe	unknown
https://www.unitag.io/_next/image?url=https%3A%2F%2Fcdn-public.unitag.io%2Fwebsite%2Flanding%2Fbrands%2Fbarnes.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://m.stripe.com/6	false		high
https://www.unitag.io/	false	Avira URL Cloud: safe	unknown
https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.35.93.96	d1tcqh4bio8cty.cloudfront.net	United States	16509	AMAZON-02US	false
172.253.63.84	unknown	United States	15169	GOOGLEUS	false
142.251.40.227	unknown	United States	15169	GOOGLEUS	false
18.173.219.101	widget.trustpilot.com	United States	3	MIT-GATEWAYSUS	false
104.18.41.175	assets.calendly.com	United States	13335	CLOUDFLARENETUS	false
142.251.40.104	unknown	United States	15169	GOOGLEUS	false
104.18.8.173	fallback.customers.stytch.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
142.251.32.106	unknown	United States	15169	GOOGLEUS	false
172.65.240.166	e5de3d23065c4748b155c28e6fa36f3e.pacloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.65.202.201	7c7b02d4bc3d48dd81a7c7738d4de1ab.pacloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.64.146.81	unknown	United States	13335	CLOUDFLARENETUS	false
172.65.238.60	18ea70d2d9a945cfb97d818ba71817dc.pacloudflare.com	United States	13335	CLOUDFLARENETUS	false
185.199.110.153	purecatamphetamine.github.io	Netherlands	54113	FASTLYUS	false
3.5.71.10	s3-r-w.eu-west-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.250.65.170	unknown	United States	15169	GOOGLEUS	false
52.218.30.192	unknown	United States	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.35.93.22	dexeqbeb7giwr.cloudfront.net	United States	16509	AMAZON-02US	false
142.251.40.238	unknown	United States	15169	GOOGLEUS	false
149.56.12.77	eqrco.de	Canada	16276	OVHFR	false
185.199.109.153	unknown	Netherlands	54113	FASTLYUS	false
142.250.64.68	www.google.com	United States	15169	GOOGLEUS	false
35.167.54.49	stripe.com	United States	16509	AMAZON-02US	false
52.42.254.61	unknown	United States	16509	AMAZON-02US	false
172.65.192.122	15e49451d4884c2582b2c780d1077dd0.pacloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.65.206	unknown	United States	15169	GOOGLEUS	false
142.251.40.99	unknown	United States	15169	GOOGLEUS	false
51.254.12.100	qrcode.link	France	16276	OVHFR	false
172.65.208.22	2acdb9b66bb242618283aadb21ede6c1.pacloudflare.com	United States	13335	CLOUDFLARENETUS	false
34.110.168.37	unitag.io	United States	15169	GOOGLEUS	false
142.251.35.163	unknown	United States	15169	GOOGLEUS	false
44.238.51.98	m.stripe.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16
192.168.2.5
192.168.2.24

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649365
Start date and time:	2025-03-26 18:05:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://eqrco.de/a/thFNTJ
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@30/115@106/436

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 104.18.38.233, 172.64.149.23
Excluded domains from analysis (whitelisted): crt.comodoca.com.cdn.cloudflare.net, crt.comodoca.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://eqrco.de/a/thFNTJ

Source: https://eqrco.de/a/thFNTJ	HTTP Parser: No favicon
Source: https://www.unitag.io/en-US	HTTP Parser: No favicon
Source: https://www.unitag.io/en-US	HTTP Parser: No favicon

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743008918128&w=0&anoncknm=al_app_anon&NoResponseBody=true HTTP/1.1Accept-Encoding: gzip, deflateContent-Length: 941Content-Type: application/json; charset=UTF-8Host: browser.events.data.msn.cnConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743008930881&w=0&anoncknm=al_app_anon&NoResponseBody=true HTTP/1.1Accept-Encoding: gzip, deflateContent-Length: 1863Content-Type: application/json; charset=UTF-8Host: browser.events.data.msn.cnConnection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: eqrco.de
Source: global traffic	DNS traffic detected: DNS query: unitag-public-assets.s3.eu-west-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: qrcode.link
Source: global traffic	DNS traffic detected: DNS query: unitag.io
Source: global traffic	DNS traffic detected: DNS query: www.unitag.io
Source: global traffic	DNS traffic detected: DNS query: calendly.com
Source: global traffic	DNS traffic detected: DNS query: purecatamphetamine.github.io
Source: global traffic	DNS traffic detected: DNS query: assets.calendly.com
Source: global traffic	DNS traffic detected: DNS query: booking-dfp.calendly.com
Source: global traffic	DNS traffic detected: DNS query: js.stripe.com
Source: global traffic	DNS traffic detected: DNS query: api-v2.unitag.io
Source: global traffic	DNS traffic detected: DNS query: js-eu1.hs-scripts.com
Source: global traffic	DNS traffic detected: DNS query: widget.trustpilot.com
Source: global traffic	DNS traffic detected: DNS query: js-eu1.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: js-eu1.hs-analytics.net
Source: global traffic	DNS traffic detected: DNS query: js-eu1.hs-banner.com
Source: global traffic	DNS traffic detected: DNS query: forms-eu1.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: track-eu1.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: m.stripe.network
Source: global traffic	DNS traffic detected: DNS query: m.stripe.com
Source: global traffic	DNS traffic detected: DNS query: stripe.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons4.gvt2.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1840 x 773, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	21098
Entropy (8bit):	7.858442791978209
Encrypted:	false
SSDEEP:
MD5:	D9E42A77FCE37EADC454CC46BD428FEF
SHA1:	524107DC7610504AF44527176D962BABAB5F2257
SHA-256:	E525D6DE684F145179794C8B3C45058DCE94F4137F68B95D5044C826750FCB5B
SHA-512:	D7E56739228EBC7B79E87BE7FF1A0A252A0FF5D76BA754879B82A15E73B0E3D6D16F1B4C3130609D864F1F0F7474D8E234DA3341D7598886C1C9B9B735DA0253
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0.........,.......PLTELiq....................\|.....tRNS..zB..".....pHYs............... .IDATx....(........^Y..U).....>?f.L.J..................................................................................................................................................................................B..{..x.......B....O.....G....a.}.....BuN...y....l.G.\ur.{....{.M..-6IM..]....Jj...m.=F.g@....6.{V,c.I.,.`n[...?v.M...f..o.#3.......)Df..f....S.....a..!6bg.,.`........q...f.......cI..@ga.1.y....:.US.."...I.]S._D&...+......u...?L....Y&.?'.p...,,.......}.....L......v>....-.u..J&...,AO&.@.../4......./4....<#._.\(..jKN$..../.@...%............\|<}..R.....=f.._$&.@.Y.......r........zhk..f....<.5......{rk......dl~tXM.ue..IT/..Ii........nL..%.........E../.1..1T/....8apl.........e.......{.HY.@.6zi..;...?.....s......l!...g'.~..c&..r2.MR..+7.U..b..:W/?.R...m...lR.......sMI.[...1.........D'e..sE.&...9v.V..L....xfyi..?.~m....x.b...e......,....f.}.1,{F&+....

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2361)
Category:	downloaded
Size (bytes):	239819
Entropy (8bit):	5.543066052680402
Encrypted:	false
SSDEEP:
MD5:	D07574C8B094CFB9333E07EAFA51F20D
SHA1:	FB86063AF63E6B8A13A86019D036F0CEFD0637D6
SHA-256:	31FF5CF6304BFD9AAACB4AC7672BC94AB30E659EC3B046853C6DD776FC06B81C
SHA-512:	9DE067FF83232EAE3B408946F7AAC451E8A412BE8D6C10133D6B125F342846F568B80F1A3D99FC1000714B805748773B856C9CDC10360F694D5F2602A0238E5D
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=UA-213162318-1
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. ,[50,"__e",[46,"a"],[36,[13,[41,"$0"],[3,"$0",["require","internal.getEventData"]],["$0","event"]]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}.,."__e":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}.,."__e":{"read_event_data":{"eventDataAccess":"specific","keyPatterns":["event"]}}...}....,"security_groups":{."google":[."__cid".,."__e"..]...}....};.....var h,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{d

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17272)
Category:	downloaded
Size (bytes):	444118
Entropy (8bit):	5.659823008962691
Encrypted:	false
SSDEEP:
MD5:	5AD44B03AAC14FF311DE9F7E0C5CFE0A
SHA1:	9588FB8334E4B5A7E89990FECC9B72B1CAC8D5C7
SHA-256:	2ABD09252D3B01C933A75C4CCAD5E0D81EB4CEBC72ACC0149C7DD31D489547E9
SHA-512:	CC90806980951561A27AA16E21ABCB95B1251331978114CC80F23497BB2F6438A31FA0399A88334FDBC2452B0494780233617B18B4A59B5AE6C7337055C8A9BE
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=G-7SFBERE2ZP
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cps","priority":14,"vtp_cpsMode":"ALL","tag_id":105},{"function":"__ogt_1p_data_v2","priority":14,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","v

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2361)
Category:	downloaded
Size (bytes):	239820
Entropy (8bit):	5.542987275159467
Encrypted:	false
SSDEEP:
MD5:	53CA363946E429082121E77D1D36D03C
SHA1:	6341D001DB1A59E6A4F1E93705FFA51CC8E8B0D0
SHA-256:	3CD0F7DFA6CA7F27F391E1D577BD191F05E40792300277DE9CB81DB7D9B84B79
SHA-512:	1120004D1BF587170C772D780810EA9700C96A6E4DAF735D609889A5EEA61CEEF9FB2ABC225B59AF933CCCBC2531F08A2233F4562A2EEBBC0B7B8CDB67616C53
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=UA-213162318-1&cx=c&gtm=45He53p4h2v867647171za200&tag_exp=102482433~102788824~102803279~102813109~102887799~102926062~102926327
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. ,[50,"__e",[46,"a"],[36,[13,[41,"$0"],[3,"$0",["require","internal.getEventData"]],["$0","event"]]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}.,."__e":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}.,."__e":{"read_event_data":{"eventDataAccess":"specific","keyPatterns":["event"]}}...}....,"security_groups":{."google":[."__cid".,."__e"..]...}....};.....var h,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{d

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://eqrco.de/a/thFNTJ

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 190

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Chrome Cache Entry: 201

Chrome Cache Entry: 202

Chrome Cache Entry: 203

Chrome Cache Entry: 204

Chrome Cache Entry: 205

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Windows Analysis Report
https://eqrco.de/a/thFNTJ