Edit tour

Windows Analysis Report
https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments

Overview

General Information

Sample URL:	https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments
Analysis ID:	1460293

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Connects to several IPs in different countries

Detected non-DNS traffic on DNS port

Executes massive DNS lookups (> 100)

HTML page contains hidden URLs or javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2020,i,18149724085874424341,6048169478964389015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=15536 --field-trial-handle=2020,i,18149724085874424341,6048169478964389015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://imasdk.googleapis.com

LLM: Score: 8 brands: Barstool Sports Reasons: The URL 'https://imasdk.googleapis.com' does not match the legitimate domain 'barstoolsports.com' associated with the brand 'Barstool Sports'. The content and branding on the page appear to mimic Barstool Sports, which is a common social engineering technique used in phishing attacks. Additionally, the presence of a suspicious 'PDF CONTINUE' button suggests an attempt to mislead users into clicking on potentially harmful links. Therefore, the site is highly likely to be a phishing site. DOM: 92.130.pages.csv

Source: https://338e304c11795d1ea01101b4dbe6fcd4.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

HTTP Parser: Base64 decoded: https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEIlPHzuyhZIOQBpEuhouX90&google_cver=1&google_push=AXcoOmSe26yX8I2Y4JCcohEU1xYvlMDMJpXn_g-iO25saA65ERL2BLjvwXGA2OmaeEzNq6bYBKrhVsg6scOddEfpbPblx6EMb1SiHg

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.17:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.145.213.8:443 -> 192.168.2.17:50936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.89.210.46:443 -> 192.168.2.17:51660 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.17:49911 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49915 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:50366 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49911 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49915 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:50366 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49911 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49915 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:50366 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49911 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49915 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:50366 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49911 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49915 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:50366 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49911 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49915 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:50366 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49911 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49915 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:50366 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49911 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49915 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:50366 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49911 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:49915 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:50366 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.barstoolsports.com
Source: global traffic	DNS traffic detected: DNS query: htlbid.com
Source: global traffic	DNS traffic detected: DNS query: union.barstoolsports.com
Source: global traffic	DNS traffic detected: DNS query: chumley.barstoolsports.com
Source: global traffic	DNS traffic detected: DNS query: fastlane.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: a.teads.tv
Source: global traffic	DNS traffic detected: DNS query: hbopenbid.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: barstool-d.openx.net
Source: global traffic	DNS traffic detected: DNS query: js-sec.indexww.com
Source: global traffic	DNS traffic detected: DNS query: as-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: static.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: securepubads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: cadmus.script.ac
Source: global traffic	DNS traffic detected: DNS query: cdn.taboola.com
Source: global traffic	DNS traffic detected: DNS query: gum.criteo.com
Source: global traffic	DNS traffic detected: DNS query: apv-launcher.minute.ly
Source: global traffic	DNS traffic detected: DNS query: snippet.minute.ly
Source: global traffic	DNS traffic detected: DNS query: counter.snackly.co
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: launchpad-wrapper.privacymanager.io
Source: global traffic	DNS traffic detected: DNS query: c.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: cmp.inmobi.com
Source: global traffic	DNS traffic detected: DNS query: i.clean.gg
Source: global traffic	DNS traffic detected: DNS query: whoami-static.barstoolsports.com
Source: global traffic	DNS traffic detected: DNS query: sessions.bugsnag.com
Source: global traffic	DNS traffic detected: DNS query: www3.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: cdn.iframe.ly
Source: global traffic	DNS traffic detected: DNS query: bucket1.mm-syringe.com
Source: global traffic	DNS traffic detected: DNS query: tao.barstoolsports.com
Source: global traffic	DNS traffic detected: DNS query: trc.taboola.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: static.ads-twitter.com
Source: global traffic	DNS traffic detected: DNS query: tag.bounceexchange.com
Source: global traffic	DNS traffic detected: DNS query: marketingplatform.google.com
Source: global traffic	DNS traffic detected: DNS query: ams-pageview-public.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: cdn.mmctsvc.com
Source: global traffic	DNS traffic detected: DNS query: launchpad.privacymanager.io
Source: global traffic	DNS traffic detected: DNS query: iframely.barstoolsports.com
Source: global traffic	DNS traffic detected: DNS query: assets.bounceexchange.com
Source: global traffic	DNS traffic detected: DNS query: events.bouncex.net
Source: global traffic	DNS traffic detected: DNS query: api.bounceexchange.com
Source: global traffic	DNS traffic detected: DNS query: launcher.spot.im
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: vitals.vercel-insights.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: vms-players.minutemediaservices.com
Source: global traffic	DNS traffic detected: DNS query: platform.twitter.com
Source: global traffic	DNS traffic detected: DNS query: amspbs.com
Source: global traffic	DNS traffic detected: DNS query: htlb.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: ap.lijit.com
Source: global traffic	DNS traffic detected: DNS query: rtb.openx.net
Source: global traffic	DNS traffic detected: DNS query: bidders-us-east-1.adelphic.net
Source: global traffic	DNS traffic detected: DNS query: bidder.criteo.com
Source: global traffic	DNS traffic detected: DNS query: aax.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: config.aps.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: s.seedtag.com
Source: global traffic	DNS traffic detected: DNS query: api-2-0.spot.im
Source: global traffic	DNS traffic detected: DNS query: static-cdn.spot.im
Source: global traffic	DNS traffic detected: DNS query: direct-events-collector.spot.im
Source: global traffic	DNS traffic detected: DNS query: publisher-assets.spot.im
Source: global traffic	DNS traffic detected: DNS query: content.voltaxservices.io
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: rtb.gumgum.com
Source: global traffic	DNS traffic detected: DNS query: aax-eu.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: cdn.id5-sync.com
Source: global traffic	DNS traffic detected: DNS query: cdn.prod.uidapi.com
Source: global traffic	DNS traffic detected: DNS query: connectid.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: oa.openxcdn.net
Source: global traffic	DNS traffic detected: DNS query: factor-service.prod.voltaxservices.io
Source: global traffic	DNS traffic detected: DNS query: pbs-cs.yellowblue.io
Source: global traffic	DNS traffic detected: DNS query: static.criteo.net
Source: global traffic	DNS traffic detected: DNS query: cdn-ima.33across.com
Source: global traffic	DNS traffic detected: DNS query: tags.crwdcntrl.net
Source: global traffic	DNS traffic detected: DNS query: invstatic101.creativecdn.com
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: x.bidswitch.net
Source: global traffic	DNS traffic detected: DNS query: us-u.openx.net
Source: global traffic	DNS traffic detected: DNS query: sync.srv.stackadapt.com
Source: global traffic	DNS traffic detected: DNS query: pr-bh.ybp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: sync.ipredictive.com
Source: global traffic	DNS traffic detected: DNS query: match.deepintent.com
Source: global traffic	DNS traffic detected: DNS query: b1sync.zemanta.com
Source: global traffic	DNS traffic detected: DNS query: bh.contextweb.com
Source: global traffic	DNS traffic detected: DNS query: ssbsync.smartadserver.com
Source: global traffic	DNS traffic detected: DNS query: c1.adform.net
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: ads.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: content.wazimo.com
Source: global traffic	DNS traffic detected: DNS query: id5-sync.com
Source: global traffic	DNS traffic detected: DNS query: www.oo-syringe.com
Source: global traffic	DNS traffic detected: DNS query: oajs.openx.net
Source: global traffic	DNS traffic detected: DNS query: syndication.twitter.com
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: www.datadoghq-browser-agent.com
Source: global traffic	DNS traffic detected: DNS query: tg.socdm.com
Source: global traffic	DNS traffic detected: DNS query: creativecdn.com
Source: global traffic	DNS traffic detected: DNS query: secure-assets.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: lexicon.33across.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2020,i,18149724085874424341,6048169478964389015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2020,i,18149724085874424341,6048169478964389015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=15536 --field-trial-handle=2020,i,18149724085874424341,6048169478964389015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=15536 --field-trial-handle=2020,i,18149724085874424341,6048169478964389015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
about:blank	0%	Avira URL Cloud	safe
about:srcdoc	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
securepubads.g.doubleclick.net	216.58.212.130	true	false	unknown
um.simpli.fi	34.91.62.186	true	false	unknown
global.px.quantserve.com	91.228.74.166	true	false	unknown
dualstack.video.twitter.map.fastly.net	146.75.120.158	true	false	unknown
ssum.casalemedia.com	172.64.151.101	true	false	unknown
d-ams1.turn.com	46.228.164.13	true	false	unknown
rtb.openx.net	35.227.252.103	true	false	unknown
platform.twitter.map.fastly.net	146.75.120.157	true	false	unknown
1.cpm.ak-is2.net	77.245.57.72	true	false	unknown
bttrack.com	192.132.33.67	true	false	unknown
d2k43k24hwr8fw.cloudfront.net	18.239.83.84	true	false	unknown
content.wazimo.com	172.67.69.121	true	false	unknown
crb.kargo.com	3.70.67.155	true	false	unknown
mwzeom.zeotap.com	104.22.51.98	true	false	unknown
ats-eks.eu-central-1.dcs-online-targeting-prd.aws.oath.cloud	3.75.62.37	true	false	unknown
api-2-0.spot.im	18.239.50.107	true	false	unknown
sync.intentiq.com	18.239.69.99	true	false	unknown
id.rlcdn.com	35.244.174.68	true	false	unknown
bcp.crwdcntrl.net	54.72.245.162	true	false	unknown
match.adsrvr.org	52.223.40.198	true	false	unknown
rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com	3.223.93.237	true	false	unknown
dualstack.ioriver.map.fastly.net	199.232.211.52	true	false	unknown
pagead-googlehosted.l.google.com	142.250.186.65	true	false	unknown
creativecdn.com	185.184.8.90	true	false	unknown
d1giprow6b9psh.cloudfront.net	13.32.27.127	true	false	unknown
uip.semasio.net	77.243.51.121	true	false	unknown
ActivationEdge-activation-1631408035.eu-central-1.elb.amazonaws.com	52.28.14.160	true	false	unknown
m.deepintent.com	169.197.150.8	true	false	unknown
pixel-sync.sitescout.com	34.36.216.150	true	false	unknown
pixel.onaudience.com	141.94.171.215	true	false	unknown
d1ykf07e75w7ss.cloudfront.net	18.239.70.203	true	false	unknown
oajs.openx.net	34.120.135.53	true	false	unknown
ssum-sec.casalemedia.com	172.64.151.101	true	false	unknown
rtb.adgrx.com	52.215.155.11	true	false	unknown
config.aps.amazon-adsystem.com	18.238.243.122	true	false	unknown
d23sp3kzv1t6m5.cloudfront.net	18.239.36.97	true	false	unknown
load-balancer-usync-1612103133.us-west-1.elb.amazonaws.com	52.8.166.173	true	false	unknown
sync-sc.aniview.com	96.46.186.182	true	false	unknown
www3.doubleclick.net	142.250.185.142	true	false	unknown
am1-direct-bgp.contextweb.com	208.93.169.131	true	false	unknown
hbx.media.net	95.101.196.17	true	false	unknown
iad-2-sync.go.sonobi.com	69.166.1.66	true	false	unknown
hde.tynt.com	67.202.105.34	true	false	unknown
pixel-eu.onaudience.com	141.94.171.216	true	false	unknown
scontent.xx.fbcdn.net	157.240.253.1	true	false	unknown
amspbs.com	18.119.36.238	true	false	unknown
dsp-eu.adkernel.com	77.245.57.80	true	false	unknown
d2ljcaegf12t2d.cloudfront.net	18.173.205.4	true	false	unknown
api.rlcdn.com	34.120.133.55	true	false	unknown
cs1561.wpc.edgecastcdn.net	152.199.22.191	true	false	unknown
launchpad.privacymanager.io	13.32.27.122	true	false	unknown
spug-lhrc.pubmnet.com	185.64.190.81	true	false	unknown
am-vip001.taboola.com	141.226.228.48	true	false	unknown
as-sec.casalemedia.com	172.64.151.101	true	false	unknown
pixel.tapad.com	34.111.113.62	true	false	unknown
cs.pgammedia.com	80.77.87.200	true	false	unknown
pubads.g.doubleclick.net	142.250.186.130	true	false	unknown
ioriver.map.fastly.net	199.232.215.52	true	false	unknown
outspot2-ams.adx.opera.com	82.145.213.8	true	false	unknown
match.adsby.bidtheatre.com	64.227.64.62	true	false	unknown
selector.voltaxam.com	18.65.39.71	true	false	unknown
matching.truffle.bid	162.55.120.196	true	false	unknown
d2avimlm6gq3h9.cloudfront.net	18.239.87.194	true	false	unknown
nginx-ingress.wunderkind.co	34.111.8.32	true	false	unknown
eu-u.openx.net	34.98.64.218	true	false	unknown
direct-events-collector.spot.im	108.138.26.70	true	false	unknown
htlbid.com	13.227.219.44	true	false	unknown
launchpad-wrapper.privacymanager.io	18.66.27.29	true	false	unknown
livepixel-production.bln.liveintent.com	3.215.137.140	true	false	unknown
d1ef11iarne5or.cloudfront.net	18.239.50.64	true	false	unknown
ds-pr-bh.ybp.gysm.yahoodns.net	54.229.168.32	true	false	unknown
sync.1rx.io	46.228.174.117	true	false	unknown
idaas-ext.cph.liveintent.com	44.219.146.214	true	false	unknown
d1402xccwihzsp.cloudfront.net	18.66.102.31	true	false	unknown
ssc.33across.com	34.149.20.76	true	false	unknown
spug-amsfpairbc.pubmnet.com	198.47.127.20	true	false	unknown
us-u.openx.net	34.98.64.218	true	false	unknown
nydc1.outbrain.org	64.202.112.95	true	false	unknown
ads.servenobid.com	52.49.237.64	true	false	unknown
d3o5x8ea2m9uqj.cloudfront.net	13.32.99.21	true	false	unknown
go1-sc-main-was.aniview.com	172.240.45.81	true	false	unknown
d1jvc9b8z3vcjs.cloudfront.net	52.84.179.171	true	false	unknown
analytics-alv.google.com	216.239.38.181	true	false	unknown
a9be09319b0a247e4921c2153e4502d8-a6f2beb0335bc90f.elb.us-east-1.amazonaws.com	54.196.227.84	true	false	unknown
prod.appnexus.map.fastly.net	151.101.129.108	true	false	unknown
sb.scorecardresearch.com	18.239.83.126	true	false	unknown
s0.2mdn.net	142.250.185.134	true	false	unknown
htlb.casalemedia.com	104.18.36.155	true	false	unknown
usersync.gumgum.com	34.247.233.198	true	false	unknown
cs.seedtag.com	104.16.183.87	true	false	unknown
bidders-us-east-1.adelphic.net	35.212.72.90	true	false	unknown
gum.aidemsrv.com	104.17.44.93	true	false	unknown
raptor-prd-ew1-alb-2127381300.eu-west-1.elb.amazonaws.com	108.128.26.74	true	false	unknown
cs531.wpc.edgecastcdn.net	192.229.220.133	true	false	unknown
idx.cph.liveintent.com	18.210.96.251	true	false	unknown
u-ams03.e-planning.net	193.3.178.4	true	false	unknown
gum.nl3.vip.prod.criteo.com	178.250.1.11	true	false	unknown
www.datadoghq-browser-agent.com	3.165.111.23	true	false	unknown
static.bounceexchange.com	34.98.72.95	true	false	unknown
adserver.technoratimedia.com	150.136.25.38	true	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Deab8155e9e31bb01%26uid%3D	false		unknown
https://td.doubleclick.net/td/ga/rul?tid=G-6H4LC40BT9&gacid=665244658.1718902467&gtm=45je46h0v895828307za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=1009352393	false		unknown
https://eus.rubiconproject.com/usync.html?p=pulsepoint	false		unknown
https://eus.rubiconproject.com/usync.html?p=12776	false		unknown
https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=&gdpr_consent=	false		unknown
https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&b=1	false		unknown
https://cdn.undertone.com/js/usersync.html?ccpa=1---	false		unknown
https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=BB617099-56FD-4A16-BB80-09C21336C9B7&redir=true&gdpr=0&gdpr_consent=	false		unknown
https://acdn.adnxs.com/dmp/async_usersync.html	false		unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=&gdpr_consent=	false		unknown
https://rtb.gumgum.com/usync/15581?r=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fdc%3D1a6b1d3b3872943b%26fi%3Deab8155e9e31bb01%26uid%3D	false		unknown
https://securepubads.g.doubleclick.net/static/topics/topics_frame.html	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV85MDZiZGJiOC1jMjA4LTRjNGMtYWVmZS03MTllNjc5MTQxNjg=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv	false		unknown
https://c1.adform.net/serving/cookie/match?party=14&cid=BB617099-56FD-4A16-BB80-09C21336C9B7&gdpr=0&gdpr_consent=	false		unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159660&gdpr=0&gdpr_consent=&us_privacy=1---	false		unknown
https://ads.yieldmo.com/ymcas?us_privacy=&gdpr=0&gdpr_consent=&type=iframe&limit=*&lf=	false		unknown
about:blank	false	Avira URL Cloud: safe	unknown
https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=7F6F7800-CC8A-4D9D-B78B-2517F7E16614&redir=true&gdpr=0&gdpr_consent=&dcc=t	false		unknown
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5141210831372828885	false		unknown
https://onetag-sys.com/usync/?pubId=572a470226457b8	false		unknown
https://visitor.omnitagjs.com/visitor/sync?name=AIDEM&ttl=720&uid=b2f604635d0b9abde52139fc8a8034be&visitor=&gdpr=0&gdpr_consent=	false		unknown
https://www.google.com/recaptcha/api2/aframe	false		unknown
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=n-sharethrough_rbd_rx_n-MediaNet_ox-db5_3lift	false		unknown
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_n-minuteMedia_rx_n-acuityads_n-MediaNet_ox-db5_smrt_n-inmobi_n-undertone_n-sharethrough_n-onetag_pm-db5_ym_rbd_ppt_n-baidu_kg_n-nativo_sovrn_n-Outbrain	false		unknown
https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4&us_privacy=1---	false		unknown
https://usersync.gumgum.com/usersync?b=pbm&i=BB617099-56FD-4A16-BB80-09C21336C9B7	false		unknown
https://ad-cdn.technoratimedia.com/html/usersync.html?src=pbjs%2F8.47.0&us_privacy=1---	false		unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=157743&gdpr=0&gdpr_consent=&us_privacy=1---&predirect=https%3A%2F%2Fs.seedtag.com%2Fcs%2Fcookiesync%2Fpubmatic%3Fchanneluid%3D	false		unknown
https://usersync.gumgum.com/usersync?b=ttd&i=6434ed38-aee0-472b-910a-5706a11d38be	false		unknown
https://eus.rubiconproject.com/usync.html?us_privacy=1---	false		unknown
https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID	false		unknown
https://cs.yellowblue.io/cs?aid=11576&id=BB617099-56FD-4A16-BB80-09C21336C9B7	false		unknown
https://eus.rubiconproject.com/usync.html?p=seedtag&endpoint=eu	false		unknown
https://visitor.omnitagjs.com/visitor/isync?uid=513c4e190506981c315d38ccadf488f2&name=SEEDTAG&visitor=&gdpr=0&gdpr_consent_string=&us_privacy=1---	false		unknown
https://vms-players.minutemediaservices.com/mplayer-bridge.html	false		unknown
https://de.tynt.com/deb/?m=xch&rt=html&id=0014000001aXjnGAAS&ru=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D61%26uid%3D33XUSERID33X	false		unknown
https://usersync.gumgum.com/usersync?b=rth&i=nbFoR5FZvwtV1NIRcmDwyysFxa9NfG2r8gTPPYlUnc4&pi=gumgum&tc=1	false		unknown
https://eus.rubiconproject.com/usync.html?p=20986&endpoint=us-east	false		unknown
about:srcdoc	false	Avira URL Cloud: safe	unknown
https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=	false		unknown
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3869199861040652694&gdpr=0&gdpr_consent=	false		unknown
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=uhLXablBgz6hRtlquxbNOboV0TmhRtVvtBaoYZkI	false		unknown
https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.barstoolsports.com	false		unknown
https://us-u.openx.net/w/1.0/cm?id=8da2f9dd-77de-4961-a71d-959c5609fdb1&ph=9c552f28-6766-4d68-8e0e-995276acc8c6&r=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D50%26uid%3D%7BOPENX_ID%7D	false		unknown
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0	false		unknown
https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D88%26uid%3D%24UID	false		unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156344&userIdMacro=%24UID%24&predirect=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D45%26uid%3D%24UID%24	false		unknown
https://barstool-d.openx.net/w/1.0/pd?us_privacy=1---	false		unknown
https://onetag-sys.com/usync/?cb=1718902469918&us_privacy=1---	false		unknown
https://cs.yellowblue.io/cs?aid=11607&uid=I292ABZHV5Mi48soQ3iTkH81	false		unknown
https://match.prod.bidr.io/cookie-msync?ai=ChIIvfLQvwkQ0gIY_Zev99LqhgMSCQoHeWllbGRtbxoCbW9gAJIBAm1v&gdpr=0&gdpr_consent=&gdpr_pd=0&	false		unknown
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fusr.undertone.com%2FuserPixel%2Fsync%3FpartnerId%3D57%26uid%3D&s=197137&C=1	false		unknown
https://csync.smartadserver.com/rtb/csync/CookieSync.html?nwid=3050&dcid=3	false		unknown
https://minutemedia-d.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=&us_privacy=1---	false		unknown
https://td.doubleclick.net/td/ga/rul?tid=G-6H4LC40BT9&gacid=665244658.1718902467&gtm=45je46h0v895828307za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=1907299428	false		unknown
https://ce.lijit.com/merge?pid=71&3pid=BB617099-56FD-4A16-BB80-09C21336C9B7	false		unknown
https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks	false		unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=&gdpr_consent=	false		unknown
https://usersync.gumgum.com/usersync?b=pbm&i=505476AB-BF58-4CC6-A0FA-A17D7D036B2A	false		unknown
https://eus.rubiconproject.com/usync.html?p=adyoulike&endpoint=eu&gdpr=0&gdpr_consent=	false		unknown
https://usersync.gumgum.com/usersync?b=sus&i=ZnReycCo5s0AAE8SPGMAAAAA	false		unknown
https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=	false		unknown
https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]	false		unknown
https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments	false		unknown
https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.barstoolsports.com&gdpr=0&gdpr_consent=&us_privacy=1---#{%22lwid%22:{%22origin%22:0},%22bundle%22:{%22origin%22:0},%22optout%22:{%22value%22:false,%22origin%22:0},%22tld%22:%22barstoolsports.com%22,%22topUrl%22:%22www.barstoolsports.com%22,%22version%22:154,%22cw%22:true,%22lsw%22:true,%22origin%22:%22publishertagids%22,%22requestId%22:%220.7627361419833545%22}	false		unknown
https://eus.rubiconproject.com/usync.html?p=synacor_xapi&endpoint=us-east	false		unknown
https://ce.lijit.com/merge?pid=58&3pid=BB617099-56FD-4A16-BB80-09C21336C9B7	false		unknown
https://onetag-sys.com/usync/?pubId=75601b04186d260	false		unknown
https://assets.bounceexchange.com/assets/bounce/local_storage_frame17.min.html#5908	false		unknown
https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=iframe	false		unknown
https://eus.rubiconproject.com/usync.html?p=gumgum	false		unknown
https://bh.contextweb.com/visitormatch	false		unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156512	false		unknown
https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=	false		unknown
https://ce.lijit.com/beacon?us_privacy=1---&informer=13390753	false		unknown
https://player.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html?pid=62f53b2c7850d0786f227f64&r=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DANIVIEW%26ttl%3D720%26uid%3De8ecb87ff2ef3a3b16ba16c51e7986ac%26visitor%3D%5BAV_UID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	false		unknown
https://eb2.3lift.com/sync?us_privacy=1---&	false		unknown
https://sync.adkernel.com/user-sync?zone=217236&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fs.seedtag.com%2Fcs%2Fcookiesync%2Fxapads%3Fchanneluid%3D%7BUID%7D	false		unknown
https://ads.us.e-planning.net/uspd/1/624cc8b63b155a6a?ct=1&ruidm=1&du=https%3A%2F%2Fs.seedtag.com%2Fcs%2Fcookiesync%2Feplanning%3Fchanneluid%3D%24UID	false		unknown
https://cs.seedtag.com/cs.html?pt=4711-0796-01&pc=US&us=1---	false		unknown
https://eus.rubiconproject.com/usync.html?gdpr=0&us_privacy=1---	false		unknown
https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Famspbs.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D	false		unknown
https://google-bidout-d.openx.net/w/1.0/pd?plm=5	false		unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159829&us_privacy=1---	false		unknown
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU655b194276614b61be0731f733ca4efd	false		unknown
https://cdn.taboola.com/libtrc/static/topics/taboola-browsing-topics.html	false		unknown
https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&redirect=https%3A%2F%2Famspbs.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D	false		unknown
https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=	false		unknown
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=RO9hsv43VjtJegiqx3XZlggueyE&gdpr=0&gdpr_consent=	false		unknown
https://js-sec.indexww.com/um/ixmatch.html	false		unknown
https://usersync.gumgum.com/usersync?b=adf&i=292375243612405186&gdpr=&gdpr_consent=	false		unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
145.40.97.67	am6-prebid.a-mx.net	Netherlands	34108	BREEDBANDDELFTNL	false
37.252.171.149	unknown	European Union	29990	ASN-APPNEXUS	false
52.202.165.61	unknown	United States	14618	AMAZON-AESUS	false
199.232.211.52	dualstack.ioriver.map.fastly.net	United States	54113	FASTLYUS	false
34.250.216.212	unknown	United States	16509	AMAZON-02US	false
18.245.143.30	unknown	United States	16509	AMAZON-02US	false
52.222.149.52	unknown	United States	16509	AMAZON-02US	false
18.239.83.84	d2k43k24hwr8fw.cloudfront.net	United States	16509	AMAZON-02US	false
37.157.2.230	unknown	Denmark	198622	ADFORMDK	false
142.234.204.68	sync.lunamedia.live	United States	396362	LEASEWEB-USA-NYC-11US	false
168.119.146.39	sync.richaudience.com	Germany	24940	HETZNER-ASDE	false
198.47.127.205	pug-ams-bc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
37.252.171.53	unknown	European Union	29990	ASN-APPNEXUS	false
35.71.131.137	unknown	United States	237	MERIT-AS-14US	false
34.200.104.24	unknown	United States	14618	AMAZON-AESUS	false
104.22.53.173	cdn.hadronid.net	United States	13335	CLOUDFLARENETUS	false
18.239.94.86	unknown	United States	16509	AMAZON-02US	false
95.101.54.240	unknown	European Union	34164	AKAMAI-LONGB	false
151.101.130.49	unknown	United States	54113	FASTLYUS	false
192.229.233.50	cs672.wac.edgecastcdn.net	United States	15133	EDGECASTUS	false
52.208.159.70	pbs-cs.yellowblue.io	United States	16509	AMAZON-02US	false
54.170.121.32	unknown	United States	16509	AMAZON-02US	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
54.89.40.69	unknown	United States	14618	AMAZON-AESUS	false
18.239.36.97	d23sp3kzv1t6m5.cloudfront.net	United States	16509	AMAZON-02US	false
107.178.254.65	unknown	United States	15169	GOOGLEUS	false
142.234.204.77	unknown	United States	396362	LEASEWEB-USA-NYC-11US	false
44.205.169.74	unknown	United States	14618	AMAZON-AESUS	false
63.34.134.140	unknown	United States	16509	AMAZON-02US	false
192.229.233.25	cs491.wac.edgecastcdn.net	United States	15133	EDGECASTUS	false
95.101.149.233	unknown	European Union	20940	AKAMAI-ASN1EU	false
185.255.84.152	unknown	France	200271	IGUANE-FR	false
185.255.84.153	visitor-fra02.omnitagjs.com	France	200271	IGUANE-FR	false
216.58.206.34	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
52.49.45.15	sync.crwdcntrl.net	United States	16509	AMAZON-02US	false
3.248.68.207	unknown	United States	16509	AMAZON-02US	false
208.93.169.131	am1-direct-bgp.contextweb.com	United States	26228	SERVEPATHUS	false
18.157.230.4	unknown	United States	16509	AMAZON-02US	false
18.239.50.107	api-2-0.spot.im	United States	16509	AMAZON-02US	false
162.210.196.208	sync.aralego.com	United States	30633	LEASEWEB-USA-WDCUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1460293
Start date and time:	2024-06-20 18:53:50 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@85/395@851/932

Input	Output
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&redirect=https%3A%2F%2Famspbs.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form.","The text does not create a sense of urgency.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
Title: "I Would Fucking Kill You Right Now If I Could!" Kelly And Tate Finally Met In Chicago And Boy Oh Boy Was It FIREWORKS \| Barstool Sports OCR: Keegs vs Tate got off to a hot start. Presented com/MbEqtSV16U PDF The Yak 18, 2024 CONTINUE For full disclosure I forgot this beef was even a thing, but boy oh boy do I remember now. To be honest the whole saga is kinda strange. Like I don't think Tate fully realizes what a weirdo he looked like to people in Barstool (not trolls on twitter) when he kept going after Keegs. And I know the commenters are going to disagree with me but it's true. There is an unwritten rule that you don't really attack someone's livelihood. You can make jokes and that's fine, but if you don't know that person and you keep going and going and going eventually you become the asshole. And I get it, it's tough for new employees to separate internet from reality but at the end of the day a little self awareness goes a long away. I'm not trying to get in the middle of it either because I truly don't care, I'm just saying what 99.9% of people in Barstool are thinking. Nobody likes the effort police. If you've noticed that someone isn't working hard, you can bet your ass that Dave has too. "TOOL-AND-STARS FEATURED ON BARSTOOL
URL: https://imasdk.googleapis.com/js/core/bridge3.647.0_en.html#goog_2001607071 Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form.","The text does not create a sense of urgency.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
Title: "I Would Fucking Kill You Right Now If I Could!" Kelly And Tate Finally Met In Chicago And Boy Oh Boy Was It FIREWORKS \| Barstool Sports OCR: Keny Ana late Finally me In umcago Ana BOY U VIEW THEM HERE. Boy Was It FIREWORKS 0 0000 6/18/2024 400 PM PDF Keegs vs Tate got off to a hot start. Presented CONTINUE The Yak 18, 2024 For full disclosure I forgot this beef was even a thing, but boy oh boy do I remember now. To be honest the whole saga is kinda strange. Like I don't think Tate fully realizes what a weirdo he looked like to people in Barstool (not trolls on twitter) when he kept going after Keegs. And I know the commenters are going to disagree with me but it's true. There is an unwritten rule that you don't really attack someone's livelihood. You can make jokes and that's fine, but if you don't know that person and you keep going and going and going eventually you become the asshole. And I get it, it's tough for new employees to separate internet from reality but at the end of the day a little self awareness goes a long away. I'm not trying to get in the middle of it either because I truly don't care, I'm just saying what 99.9% of people in Barstool are thinking. Nobody likes the effort police. If you've noticed that someone isn't working hard, you can bet your ass that Dave has too. "TOOL-AND-STARS FEATURED ON BARSTOOL
URL: https://imasdk.googleapis.com/js/core/bridge3.647.0_en.html#goog_2001607071 Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": true,"captcha": false,"reasons": ["The webpage contains a title that creates a sense of urgency 'I Would Fucking Kill You Right Now If I Could! We're updating our Terms of use on June 24, 2024.'","The text also creates a sense of urgency 'VIEW THEM HERE. Boy Was It FIREWORKS 0000 6/18/2024 4:00 PM PDF' and 'For full disclosure I forgot this beef was even a thing, but boy oh boy do I remember now.'","The webpage does not contain a login form, captcha or any other anti-robot detection mechanism.","The text does not contain any explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers (CVV)."]}
Title: "I Would Fucking Kill You Right Now If I Could!" Kelly And Tate Finally Met In Chicago And Boy Oh Boy Was It FIREWORKS \| Barstool Sports OCR: BARSTOOL BLOGS VIDS PODS PICS GREENIE BLOGGERS SHOWS TOPICS STORE SPORTS Sign In Reuniting with Pangzai Rundown The Dozen Championship TRENDING TOPICS Jake Marsh NHL Coverage VodhoqcdTeo NO ADDED SUGAR and RON-CARBONATED "I Would Fucking Kill You Right Now If I Could!" We're updating our Terms ot use on June 24, 2024. Kelly And Tate Finally Met In Chicago And Boy Oh VIEW THEM HERE. Boy Was It FIREWORKS 0000 6/18/2024 4:00 PM PDF Keegs vs Tate got off to a hot start. Presented CONTINUE The Yak 18, 2024 For full disclosure I forgot this beef was even a thing, but boy oh boy do I remember now. To be honest the whole saga is kinda strange. Like I don't think Tate fully realizes what a weirdo he looked like to people in Barstool (not trolls on twitter) when he kept going after Keegs. And I know the commenters are going to disagree with me but it's true. There is an unwritten rule that you don't really attack someone's livelihood. You can make jokes and that's fine, but if you don't know that person and you keep going and going and going eventually you become the asshole. And I get it, it's tough for new employees to separate internet from reality but at the end of the day a little self awareness goes a long away. I'm not trying to get in the middle of it either because I truly don't care, I'm just saying what 99.9% of people in Barstool are thinking. Nobody likes the effort police. If you've noticed that someone isn't working hard, you can bet your ass that Dave has too.
URL: https://minutemedia-d.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=&us_privacy=1--- Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form, as there is no explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers, or credit card numbers.","The text does not create a sense of urgency, as there are no calls to action or time-sensitive language used.","There is no CAPTCHA or anti-robot detection mechanism present on the webpage."]}
Title: "I Would Fucking Kill You Right Now If I Could!" Kelly And Tate Finally Met In Chicago And Boy Oh Boy Was It FIREWORKS \| Barstool Sports OCR: 548 Reply Share Read 144 replies PDF "l would fucking kill you right now if I coulff CONTINUE Kelly Keegs drops the HAMMERpic twitter.com/7kYcDJiWaY The Yak 18, 2024 "SAY IT TO MY FACE-Vpic twitter.commuyjeU18 The Yak 18, 2024 What a show. No matter whose side you're on, Tate or Keegs, you have to admit that this was great radio. Well done, ladies. Also credit to Tate for no longer attacking his coworkers. Now hopefully we can all move on and be one big happy family! Check out the entire conversation below..
URL: https://eb2.3lift.com/sync?us_privacy=1---& Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form, so there is no request for sensitive information.","The text does not create a sense of urgency, as it is about a radio show and not offering any immediate actions or rewards.","There is no CAPTCHA or anti-robot detection mechanism present on the webpage."]}
Title: "I Would Fucking Kill You Right Now If I Could!" Kelly And Tate Finally Met In Chicago And Boy Oh Boy Was It FIREWORKS \| Barstool Sports OCR: Kelly Keegs drops the HAMMERpic twitter.com/7kYcDJiWaY The Yak (@BarstoolYak)June 18, 2024 PDF "SAY IT TO MY FACE-Vpic twitter.commuyjeU18 CONTINUE The Yak 18, 2024 What a show. No matter whose side you're on, Tate or Keegs, you have to admit that this was great radio. Well done, ladies. Also credit to Tate for no longer attacking his coworkers. Now hopefully we can all move on and be one big happy family! Check out the entire conversation below..
URL: https://imasdk.googleapis.com Model: gpt-4o	```json{ "phishing_score": 8, "brands": "Barstool Sports", "phishing": true, "suspicious_domain": true, "has_loginform": false, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "barstoolsports.com", "reasons": "The URL 'https://imasdk.googleapis.com' does not match the legitimate domain 'barstoolsports.com' associated with the brand 'Barstool Sports'. The content and branding on the page appear to mimic Barstool Sports, which is a common social engineering technique used in phishing attacks. Additionally, the presence of a suspicious 'PDF CONTINUE' button suggests an attempt to mislead users into clicking on potentially harmful links. Therefore, the site is highly likely to be a phishing site."}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.000317364898367
Encrypted:	false
SSDEEP:
MD5:	9CB2E427FC6EEADFCA349942339DCFB6
SHA1:	83043A7548DD13516DC81CAE5B3EA9EC02F541DD
SHA-256:	E80E72A786EC9D6CB8B5B6CCD10EBACE6A7D0152EC333ACA6C1AEDF93D505490
SHA-512:	CF54173C713A37E312F4D5CC3991DA61A682B9B26C5637293FB74F2D9AB234F64340D2AA79ED6937641B61DAE0B56FE5801B55A85DBDD25790C747741C0FFBAB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......Q.2.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 1003

Chrome Cache Entry: 1004

Chrome Cache Entry: 1009

Chrome Cache Entry: 1010

Chrome Cache Entry: 1012

Chrome Cache Entry: 1013

Chrome Cache Entry: 1015

Chrome Cache Entry: 1016

Chrome Cache Entry: 1020

Chrome Cache Entry: 1021

Chrome Cache Entry: 1022

Chrome Cache Entry: 1023

Chrome Cache Entry: 1027

Chrome Cache Entry: 1028

Chrome Cache Entry: 1033

Chrome Cache Entry: 1034

Chrome Cache Entry: 1035

Chrome Cache Entry: 1038

Chrome Cache Entry: 1039

Chrome Cache Entry: 1043

Chrome Cache Entry: 1044

Chrome Cache Entry: 1046

Chrome Cache Entry: 1050

Chrome Cache Entry: 1051

Chrome Cache Entry: 1053

Chrome Cache Entry: 1054

Chrome Cache Entry: 1055

Chrome Cache Entry: 1058

Chrome Cache Entry: 1059

Chrome Cache Entry: 1063

Chrome Cache Entry: 1065

Chrome Cache Entry: 1066

Chrome Cache Entry: 1067

Windows Analysis Report
https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments