Edit tour

Windows Analysis Report
http://ads.livetv799.me

Overview

General Information

Sample URL:	http://ads.livetv799.me
Analysis ID:	1481789

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Found iframes

HTML body contains password input but no form action

HTML page contains string obfuscation

Stores files to the Windows start menu directory

Suspicious form URL found

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://ads.livetv799.me/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6224 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1948,i,2496275646663445167,9695252291569128383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4848 --field-trial-handle=1948,i,2496275646663445167,9695252291569128383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=1948,i,2496275646663445167,9695252291569128383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: GET / HTTP/1.1Host: livetv.sxConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	LLM: Score: 6 brands: MyStake Reasons: The URL 'https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815' does not match the legitimate domain 'mystake.com' associated with the brand 'MyStake'. The '.gg' TLD is unusual for this brand and could be used to mislead users. The page prominently features login and registration forms, which are common targets for phishing. Additionally, the URL contains query parameters that could be used for tracking or redirecting, which is another common phishing technique. There is no CAPTCHA present, which is often used to increase security on legitimate sites. Overall, these factors suggest that the site is likely a phishing site. DOM: 22.38.pages.csv
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	LLM: Score: 8 Reasons: The unusual domain'mystake.gg' does not match typical domain names for legitimate websites, and the minimalistic design raises concerns about the site's legitimacy and security. The presence of a 'Promo Code' field and a 'Forget Password?' link are common features in registration forms, but the overall design and domain extension suggest it may be related to gaming or entertainment, which is unusual for a legitimate website. DOM: 22.35.pages.csv
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	LLM: Score: 8 Reasons: The domain name'mystake.gg' is unusual and does not match typical domain names for legitimate services. The domain extension '.gg' is commonly associated with gaming websites, which raises suspicions about the site's legitimacy. The brand name'mystake.gg' is not commonly associated with any well-known services, and the minimalistic design with a dark background and purple border around the login form is not typical of legitimate services. The fact that the domain name is not well-known and the design is unusual increases the likelihood of this site being a phishing site. However, the absence of any unusual or notable features in the design or content and the clear visibility of text and links reduces the likelihood of this site being a phishing site. Therefore, I give this site a phishing score of 8 out of 10, indicating that it is likely to be a phishing site, but not with absolute certainty. DOM: 22.38.pages.csv

Source: https://livetv.sx/enx/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-C0NCVWEPBQ&gacid=1391537798.1721907139&gtm=45je47o0v9138016680za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=529276804
Source: https://livetv.sx/enx/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36&rnd=260518623
Source: https://livetv.sx/enx/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36
Source: https://livetv.sx/enx/	HTTP Parser: Iframe src: //ads.livetv799.me/getbanner.php?zone_id=109&rnd=124207069
Source: https://livetv.sx/enx/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=227&rnd=495548889
Source: https://livetv.sx/enx/	HTTP Parser: Iframe src: http://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2FLiveTV.Int&width=292&colorscheme=light&show_faces=false&stream=false&header=false&height=62
Source: https://livetv.sx/enx/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=78&rnd=315751322
Source: https://livetv.sx/enx/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=165&rnd=90246823
Source: https://livetv.sx/enx/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=101&rnd=248647627
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36&rnd=227958174
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Iframe src: //ads.livetv799.me/getbanner.php?zone_id=109&rnd=157105639
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=227&rnd=954032648
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=101&rnd=899372605
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36&rnd=227958174
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Iframe src: //ads.livetv799.me/getbanner.php?zone_id=109&rnd=157105639
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=227&rnd=954032648
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=101&rnd=899372605
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36&rnd=496960024
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: Iframe src: //ads.livetv799.me/getbanner.php?zone_id=109&rnd=943308026
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=227&rnd=307891101
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=114&rnd=570024154
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=114
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=101&rnd=176624053
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=11887425&group=20&embedded=1&widget_version=3&unique_groups=0
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36&rnd=251261545
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //ads.livetv799.me/getbanner.php?zone_id=109&rnd=681210250
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=227&rnd=936800362
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: https://www.youtube.com/embed/SFPvQnBJU4M
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //www.facebook.com/plugins/like.php?href=http%3A%2F%2Flivetv.sx%2Fenx%2Fshowvideo%2F1334345_rb_bragantino_barcelona_sc%2F&send=false&layout=button_count&width=100&show_faces=true&action=like&colorscheme=light&font=arial&height=21&appId=211887722237067
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=101&rnd=86278003
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36&rnd=251261545
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=36
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //ads.livetv799.me/getbanner.php?zone_id=109&rnd=681210250
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=227&rnd=936800362
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: https://www.youtube.com/embed/SFPvQnBJU4M
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //www.facebook.com/plugins/like.php?href=http%3A%2F%2Flivetv.sx%2Fenx%2Fshowvideo%2F1334345_rb_bragantino_barcelona_sc%2F&send=false&layout=button_count&width=100&show_faces=true&action=like&colorscheme=light&font=arial&height=21&appId=211887722237067
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Iframe src: //ads.livetv799.me//getbanner.php?zone_id=101&rnd=86278003
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=11887425&group=20&embedded=1&widget_version=3&unique_groups=0
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=11887425&group=20&embedded=1&widget_version=3&unique_groups=0

Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: Found new string: script ...........if(get_cookie('lq')!='1'){............document.cookie = "lq=1;path=/;expires=Sat, 27 Jul 2024 14:33:04 +0300".................document.write('<scr' + 'ipt charset="utf-8" src="//cip.livetv799.me/export/cip.php?lng=en"></scr' + 'ipt>');..................}........if(get_cookie('apr')==''){.......var pixelRatio = !!window.devicePixelRatio ? window.devicePixelRatio : 1; .......document.cookie = "apr=" + pixelRatio + ";path=/;expires=Wed, 2 Dec 2030 00:00:00"......}......if(get_cookie('brow')==''){.......navigator.sayswho= (function(){.......var ua= navigator.userAgent, tem,.......M= ua.match(/(opera\|chrome\|safari\|firefox\|msie\|trident(?=\/))\/?\s*(\d+)/i) \|\| [];.......if(/trident/i.test(M[1])){........tem= /\brv[ :]+(\d+)/g.exec(ua) \|\| [];........return 'IE '+(tem[1] \|\| '');.......}.......if(M[1]=== 'Chrome'){........tem= ua.match(/\b(OPR\|Edge)\/(\d+)/);........if(tem!= null) return tem.slice(1).join(' ').replace('OPR', 'Opera');.......}.......M= M[2]? [M[1], M[2]]: [navigator.appName, navigator.app...
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: Found new string: script ...if(document.location.hash){....if(document.location.hash.substring(0, 6)=='#reply'){......ar = document.location.hash.split("\|", 3);....if((ar[0]=="#reply")&&(ar[1].length<=7)&&(ar[2].length<=40)){.....document.getElementById('cmf').focus();....replytouserid = ar[1];....showreplytobar(ar[2]);.....$('html, body').animate({ scrollTop: $('#replytobar').offset().top }, 1000);....}.....}else{....ar = document.location.hash.split("_");....if(ar[0]=="#webplayer"){.....arr = ar[1].split("\|");.....show_webplayer(arr[0], arr[1], arr[2], arr[3], arr[4], arr[5], arr[6]);....}..}.}....window.addEventListener("message", function(event) {.. ..if((event.origin=="http://cdn.livetv799.me")\|\|(event.origin=="https://cdn.livetv799.me")){......count = (event.data.split('\|').length - 1);......if(count > 2){.....arr = event.data.split("\|");.....$('#wbplrifr').attr('src', '//cdn.livetv799.me/export/webplayer.iframe.php?t=' + arr[0] + '&c=' + arr[1] + '&lang=' + arr[6] + '&eid=' + arr[2] + '&lid=' + arr[3] + '&ci=' + arr[4] + '&...
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: Found new string: script ...........if(get_cookie('lq')!='1'){............document.cookie = "lq=1;path=/;expires=Sat, 27 Jul 2024 14:32:33 +0300".................document.write('<scr' + 'ipt charset="utf-8" src="//cip.livetv799.me/export/cip.php?lng=en"></scr' + 'ipt>');..................}........if(get_cookie('apr')==''){.......var pixelRatio = !!window.devicePixelRatio ? window.devicePixelRatio : 1; .......document.cookie = "apr=" + pixelRatio + ";path=/;expires=Wed, 2 Dec 2030 00:00:00"......}......if(get_cookie('brow')==''){.......navigator.sayswho= (function(){.......var ua= navigator.userAgent, tem,.......M= ua.match(/(opera\|chrome\|safari\|firefox\|msie\|trident(?=\/))\/?\s*(\d+)/i) \|\| [];.......if(/trident/i.test(M[1])){........tem= /\brv[ :]+(\d+)/g.exec(ua) \|\| [];........return 'IE '+(tem[1] \|\| '');.......}.......if(M[1]=== 'Chrome'){........tem= ua.match(/\b(OPR\|Edge)\/(\d+)/);........if(tem!= null) return tem.slice(1).join(' ').replace('OPR', 'Opera');.......}.......M= M[2]? [M[1], M[2]]: [navigator.appName, navigator.app...
Source: https://livetv.sx/enx/	HTTP Parser: Found new string: script ...........if(get_cookie('lq')!='1'){............document.cookie = "lq=1;path=/;expires=Sat, 27 Jul 2024 14:32:17 +0300".................document.write('<scr' + 'ipt charset="utf-8" src="//cip.livetv799.me/export/cip.php?lng=en"></scr' + 'ipt>');..................}........if(get_cookie('apr')==''){.......var pixelRatio = !!window.devicePixelRatio ? window.devicePixelRatio : 1; .......document.cookie = "apr=" + pixelRatio + ";path=/;expires=Wed, 2 Dec 2030 00:00:00"......}......if(get_cookie('brow')==''){.......navigator.sayswho= (function(){.......var ua= navigator.userAgent, tem,.......M= ua.match(/(opera\|chrome\|safari\|firefox\|msie\|trident(?=\/))\/?\s*(\d+)/i) \|\| [];.......if(/trident/i.test(M[1])){........tem= /\brv[ :]+(\d+)/g.exec(ua) \|\| [];........return 'IE '+(tem[1] \|\| '');.......}.......if(M[1]=== 'Chrome'){........tem= ua.match(/\b(OPR\|Edge)\/(\d+)/);........if(tem!= null) return tem.slice(1).join(' ').replace('OPR', 'Opera');.......}.......M= M[2]? [M[1], M[2]]: [navigator.appName, navigator.app...

Source: https://livetv.sx/enx/	HTTP Parser: <input type="password" .../> found
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: <input type="password" .../> found
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: <input type="password" .../> found
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: <input type="password" .../> found
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: <input type="password" .../> found

Source: https://ads.livetv799.me//getbanner.php?zone_id=36&rnd=260518623	HTTP Parser: No favicon
Source: https://ads.livetv799.me/getbanner.php?zone_id=109&rnd=124207069	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=78&rnd=315751322	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=165&rnd=90246823	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=101&rnd=248647627	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=227&rnd=495548889	HTTP Parser: No favicon
Source: https://ads.livetv799.me/getbanner.php?zone_id=109&rnd=157105639	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=227&rnd=954032648	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=36&rnd=227958174	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=101&rnd=899372605	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=114&rnd=570024154	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/SFPvQnBJU4M	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/SFPvQnBJU4M	HTTP Parser: No favicon
Source: https://secure.livechatinc.com/customer/action/open_chat?license_id=11887425&group=20&embedded=1&widget_version=3&unique_groups=0	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=36&rnd=251261545	HTTP Parser: No favicon
Source: https://ads.livetv799.me/getbanner.php?zone_id=109&rnd=681210250	HTTP Parser: No favicon
Source: https://banners5html2.com/football-22bet-livetv/en/index.php	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=227&rnd=936800362	HTTP Parser: No favicon
Source: https://ads.livetv799.me//getbanner.php?zone_id=101&rnd=86278003	HTTP Parser: No favicon
Source: https://banners5html2.com/banners-louserzed/en/468x60/index.php	HTTP Parser: No favicon
Source: about:blank	HTTP Parser: No favicon
Source: https://secure.livechatinc.com/customer/action/open_chat?license_id=11887425&group=20&embedded=1&widget_version=3&unique_groups=0	HTTP Parser: No favicon

Source: https://livetv.sx/enx/	HTTP Parser: No <meta name="author".. found
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: No <meta name="author".. found
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: No <meta name="author".. found
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: No <meta name="author".. found
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: No <meta name="author".. found
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: No <meta name="author".. found
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: No <meta name="author".. found
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: No <meta name="author".. found
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: No <meta name="author".. found
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: No <meta name="author".. found

Source: https://livetv.sx/enx/	HTTP Parser: No <meta name="copyright".. found
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: No <meta name="copyright".. found
Source: https://livetv.sx/enx/calendar/36/	HTTP Parser: No <meta name="copyright".. found
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: No <meta name="copyright".. found
Source: https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	HTTP Parser: No <meta name="copyright".. found
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: No <meta name="copyright".. found
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: No <meta name="copyright".. found
Source: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	HTTP Parser: No <meta name="copyright".. found
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: No <meta name="copyright".. found
Source: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49734 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: global traffic	DNS traffic detected: DNS query: ads.livetv799.me
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.livetv799.de
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.livetv799.me
Source: global traffic	DNS traffic detected: DNS query: livetv.sx
Source: global traffic	DNS traffic detected: DNS query: pixel-us.convertagain.net
Source: global traffic	DNS traffic detected: DNS query: live-tv.top
Source: global traffic	DNS traffic detected: DNS query: cip.livetv799.me
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: counter.yadro.ru
Source: global traffic	DNS traffic detected: DNS query: cdn.livetv1000.me
Source: global traffic	DNS traffic detected: DNS query: js.revmasters.com
Source: global traffic	DNS traffic detected: DNS query: go.affiliatemystake.com
Source: global traffic	DNS traffic detected: DNS query: mystake.gg
Source: global traffic	DNS traffic detected: DNS query: d0bb5466-d66f-42e7-8a8d-5eaad2c7cd22.curacao-egaming.com
Source: global traffic	DNS traffic detected: DNS query: js.pusher.com
Source: global traffic	DNS traffic detected: DNS query: static.inpcdn.com
Source: global traffic	DNS traffic detected: DNS query: aaa430f1-f7db-4ae2-b3e2-03a85ac370ea.snippet.anjouangaming.org
Source: global traffic	DNS traffic detected: DNS query: g9904216750.co
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: cdn.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: g1188506010.co
Source: global traffic	DNS traffic detected: DNS query: api.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: secure.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: banners5html2.com
Source: global traffic	DNS traffic detected: DNS query: i.ytimg.com
Source: global traffic	DNS traffic detected: DNS query: fonts.cdnfonts.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: static.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: yt3.ggpht.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: accounts.livechatinc.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://ads.livetv799.me/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1948,i,2496275646663445167,9695252291569128383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1948,i,2496275646663445167,9695252291569128383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4848 --field-trial-handle=1948,i,2496275646663445167,9695252291569128383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=1948,i,2496275646663445167,9695252291569128383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4848 --field-trial-handle=1948,i,2496275646663445167,9695252291569128383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=1948,i,2496275646663445167,9695252291569128383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://livetv.sx/	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
i.ytimg.com	142.250.185.246	true	false	unknown
cdn.livetv1000.me	188.114.97.3	true	false	unknown
stats.g.doubleclick.net	142.251.173.155	true	false	unknown
cdn.livetv799.me	104.21.26.168	true	false	unknown
counter.yadro.ru	88.212.202.52	true	false	unknown
scontent.xx.fbcdn.net	157.240.253.1	true	false	unknown
g9904216750.co	34.120.31.228	true	false	unknown
revmasters.elb.myaffiliates.com	104.18.191.136	true	false	unknown
live-tv.top	188.114.97.3	true	false	unknown
go-affiliatemystake-com.cellexpertx.prod2.reblaze.com	35.234.86.61	true	false	unknown
photos-ugc.l.googleusercontent.com	142.250.186.33	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
static.inpcdn.com	104.21.69.162	true	false	unknown
d3dy5gmtp8yhk7.cloudfront.net	108.156.64.41	true	false	unknown
star-mini.c10r.facebook.com	157.240.0.35	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
google.com	142.250.181.238	true	false	unknown
fonts.cdnfonts.com	104.21.72.124	true	false	unknown
livetv.sx	95.169.196.51	true	false	unknown
static.doubleclick.net	142.250.185.102	true	false	unknown
mystake.gg	188.114.97.3	true	true	unknown
g1188506010.co	34.117.209.158	true	false	unknown
banners5html2.com	5.61.52.174	true	false	unknown
cip.livetv799.me	172.67.137.100	true	false	unknown
youtube-ui.l.google.com	172.217.18.110	true	false	unknown
googleads.g.doubleclick.net	172.217.16.194	true	false	unknown
play.google.com	142.250.186.142	true	false	unknown
analytics.google.com	216.58.212.174	true	false	unknown
td.doubleclick.net	142.250.185.194	true	false	unknown
d1m82x4n2l77wl.cloudfront.net	52.85.49.125	true	false	unknown
ads.livetv799.me	172.67.137.100	true	false	unknown
pixel-us-fvmarketing.ubidex.xyz	88.214.195.102	true	false	unknown
js.revmasters.com	unknown	unknown	false	unknown
yt3.ggpht.com	unknown	unknown	false	unknown
cdn.livetv799.de	unknown	unknown	false	unknown
secure.livechatinc.com	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown
aaa430f1-f7db-4ae2-b3e2-03a85ac370ea.snippet.anjouangaming.org	unknown	unknown	false	unknown
www.facebook.com	unknown	unknown	false	unknown
api.livechatinc.com	unknown	unknown	false	unknown
js.pusher.com	unknown	unknown	false	unknown
connect.facebook.net	unknown	unknown	false	unknown
accounts.livechatinc.com	unknown	unknown	false	unknown
cdn.livechatinc.com	unknown	unknown	false	unknown
go.affiliatemystake.com	unknown	unknown	false	unknown
d0bb5466-d66f-42e7-8a8d-5eaad2c7cd22.curacao-egaming.com	unknown	unknown	false	unknown
pixel-us.convertagain.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://ads.livetv799.me//getbanner.php?zone_id=227&rnd=954032648	false		unknown
https://livetv.sx/enx/eventinfo/217354282_loko_76_ska_karelia/	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=101&rnd=248647627	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=101&rnd=899372605	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=36&rnd=260518623	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=227&rnd=307891101	false		unknown
https://td.doubleclick.net/td/ga/rul?tid=G-C0NCVWEPBQ&gacid=1391537798.1721907139&gtm=45je47o0v9138016680za200&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=529276804	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=36&rnd=227958174	false		unknown
about:blank	false	Avira URL Cloud: safe	unknown
https://livetv.sx/enx/	false		unknown
https://banners5html2.com/football-22bet-livetv/en/index.php	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=227&rnd=936800362	false		unknown
https://ads.livetv799.me/getbanner.php?zone_id=109&rnd=943308026	false		unknown
https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815	true		unknown
https://ads.livetv799.me//getbanner.php?zone_id=227&rnd=495548889	false		unknown
https://ads.livetv799.me/getbanner.php?zone_id=109&rnd=157105639	false		unknown
https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/	false		unknown
https://www.youtube.com/embed/SFPvQnBJU4M	false		unknown
https://livetv.sx/enx/calendar/36/	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=114&rnd=570024154	false		unknown
https://ads.livetv799.me/getbanner.php?zone_id=109&rnd=681210250	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=101&rnd=176624053	false		unknown
https://secure.livechatinc.com/customer/action/open_chat?license_id=11887425&group=20&embedded=1&widget_version=3&unique_groups=0	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=101&rnd=86278003	false		unknown
http://livetv.sx/	false	Avira URL Cloud: safe	unknown
https://ads.livetv799.me/getbanner.php?zone_id=109&rnd=124207069	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=36&rnd=251261545	false		unknown
https://banners5html2.com/banners-louserzed/en/468x60/index.php	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=78&rnd=315751322	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=36&rnd=496960024	false		unknown
https://ads.livetv799.me//getbanner.php?zone_id=165&rnd=90246823	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.16.134	unknown	United States	15169	GOOGLEUS	false
142.250.74.202	unknown	United States	15169	GOOGLEUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
88.212.201.198	unknown	Russian Federation	39134	UNITEDNETRU	false
23.38.98.94	unknown	United States	16625	AKAMAI-ASUS	false
142.250.185.102	static.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.191.136	revmasters.elb.myaffiliates.com	United States	13335	CLOUDFLARENETUS	false
88.214.195.102	pixel-us-fvmarketing.ubidex.xyz	United Kingdom	46636	NATCOWEBUS	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
142.251.168.84	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
35.234.86.61	go-affiliatemystake-com.cellexpertx.prod2.reblaze.com	United States	15169	GOOGLEUS	false
142.250.186.33	photos-ugc.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.217.16.142	unknown	United States	15169	GOOGLEUS	false
104.21.26.168	cdn.livetv799.me	United States	13335	CLOUDFLARENETUS	false
142.251.173.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
157.240.0.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
34.117.209.158	g1188506010.co	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
5.61.52.174	banners5html2.com	United Kingdom	58061	SCALAXY-ASNL	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
34.120.31.228	g9904216750.co	United States	15169	GOOGLEUS	false
172.217.18.2	unknown	United States	15169	GOOGLEUS	false
142.250.186.106	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	cdn.livetv1000.me	European Union	13335	CLOUDFLARENETUS	true
142.250.185.194	td.doubleclick.net	United States	15169	GOOGLEUS	false
88.212.202.52	counter.yadro.ru	Russian Federation	39134	UNITEDNETRU	false
95.101.111.146	unknown	European Union	12956	TELEFONICATELXIUSES	false
142.250.186.142	play.google.com	United States	15169	GOOGLEUS	false
172.217.16.194	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.185.72	unknown	United States	15169	GOOGLEUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
216.58.212.168	unknown	United States	15169	GOOGLEUS	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
52.85.49.125	d1m82x4n2l77wl.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.186.174	unknown	United States	15169	GOOGLEUS	false
142.250.185.200	unknown	United States	15169	GOOGLEUS	false
18.66.122.121	unknown	United States	3	MIT-GATEWAYSUS	false
172.67.137.100	cip.livetv799.me	United States	13335	CLOUDFLARENETUS	false
142.250.181.234	unknown	United States	15169	GOOGLEUS	false
142.250.185.246	i.ytimg.com	United States	15169	GOOGLEUS	false
142.250.185.202	unknown	United States	15169	GOOGLEUS	false
142.250.185.164	unknown	United States	15169	GOOGLEUS	false
216.58.212.174	analytics.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
95.101.111.131	unknown	European Union	12956	TELEFONICATELXIUSES	false
172.217.18.110	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
95.101.111.174	unknown	European Union	12956	TELEFONICATELXIUSES	false
142.250.74.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.54	unknown	United States	15169	GOOGLEUS	false
142.250.184.202	unknown	United States	15169	GOOGLEUS	false
95.101.111.170	unknown	European Union	12956	TELEFONICATELXIUSES	false
104.21.69.162	static.inpcdn.com	United States	13335	CLOUDFLARENETUS	false
172.67.210.91	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.72.124	fonts.cdnfonts.com	United States	13335	CLOUDFLARENETUS	false
108.156.64.41	d3dy5gmtp8yhk7.cloudfront.net	United States	16509	AMAZON-02US	false
95.169.196.51	livetv.sx	Bulgaria	41017	GOBULNETBG	false
142.250.185.136	unknown	United States	15169	GOOGLEUS	false
157.240.253.1	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1481789
Start date and time:	2024-07-25 13:30:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://ads.livetv799.me
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@39/400@166/341

Input	Output
URL: https://livetv.sx/enx/calendar/36/ Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form explicitly requesting sensitive information.","The text does not create a sense of urgency.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
Title: Germany. Bundesliga / Fixtures & Results / LiveTV OCR: How to access a LiveTV? Fixtures Germany. Bundesliga I: new livetv799.me Video Broadcasts Results Football 2: detailed insfructions League Table Video Archive 3: Telegrun chanIEI LiveTV 09/10 10/11 11/12 12/13 13/14 14/15 15/16 16/17 17/18 18/19 19/20 20/21 21/22 22/23 24/25 UPCOMING BROADCASTS Upcoming League Matches 90 Moenchengladbach Leverkusen Dortmund Eintracht 22 August, Thursday 23 August, Friday Today (25 July, Thursday) Wolfsburg Bayern Mainz union Berlin WU Iasi 23 August, Friday 23 August, Friday 9:10 Iasi) Freiburg Stuttgart Hoffenheim Kiel Ji-sung Reese Vesely I Barton 23 August, Friday 23 August, Friday 10:05 (Doubles) Alycia Parks (W) Isabe"a Shinikova St. Pauli Heidenheim Augsburg Werder 23 August, Friday 23 August, Friday 10:05 Warsaw) Watanabe / Yuzuki Stevens Pel Leipzig Bochum 10:05 (ATP Challenger. zug_ 23 August, Friday Doubles) WTA Prague Round 2 Round I 10:10 Prague) 30 August, Friday 22 August, Thursday Magdalena Frech (W) Laura o U Samson Moenchengladbach Leverkusen Kiel Wolfsburg 10:10 Prague) 23 August, Friday 8hum Moenchengladbach AT p. Kitzbuhel St. Pauli Heidenheim 10:10 (ATP Kitzbuhel) Union Berlin St. Pauli Thiago Seyboth Wild Yannick Mainz Union Berlin Werder Dortmund Hanfmann 10:10 (ATP Kitzbuhel) Wolfsburg aayern Heidenheim Augsburg ATP Challenger Tampere Augsburg Werder Intracht Hoffenheim 10:10 (ATP Challenger. Tampere) Freiburg Stuttgart Bayem Freiburg ATP Challenger Verona o Hoffenheim Kiel 10:10 (ATP Challenger. Verona) Stuttgart Mainz Fatic / Jianu Demoliner / Duran Dortmund Eintracht Leverkusen Leipzig 10:10 (Ooubles) Leipzig 8hum ATP Challenger zug 10:10 (ATP Challenger. zug) Round 3 Round 4 Abedallah Shelbayh Rudolf Molleker 13 September, Friday 20 September, Friday 10:10 (ATP Challenger. zug) Kiel Bayern st Pauli Leipzig WTA_ Warsaw Moenchengladbach Stuttgart 8hum Kiel 10:10 Warsaw) Francesco Maestrelli Alvaro-GuiWen Mainz Werder Union Berlin Hoffenheim 10:15 (ATP Challenger. Verona) Augsburg Mainz Wolfsburg Eintracht
URL: https://livetv.sx/enx/calendar/36/ Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form explicitly requesting sensitive information.","The text does not create a sense of urgency or interest by using phrases such as 'Click here to view document' or 'To view secured document click here'.","There is no CAPTCHA or anti-robot detection mechanism present on the webpage."]}
Title: Germany. Bundesliga / Fixtures & Results / LiveTV OCR: Sign Up LIVE Free L ive Sport Streams Search aROAOCASTS LIVE SCORE RESULTS VIDEO ARCHIVE FAN CLUas BEST BETTING SITES FORUM FAQ CONTACT Ill New on LiveTV Best Odds Today Matches of Your Teams Hntts RB BarcAona SC In Mder to view this bkx:k you have to rnster or mn Tt-re are currently no with Hntts Wmari(E Atletico Your current time zone: 12:32 ilJTC +1) SPORTSBETTINC Stake BET NOW HIGHEST ODDS How to access a LiveTV? F I xtures -9 Germany. Bundesliga I: new livetv799.me Video Broadcasts Results Football 2: detailed insfructions League Table Video Archive 3: Telegrml chan'kl LiveTV 09/10 10/11 11/12 12/13 13/14 14/15 15/16 16/17 17/18 18/19 19/20 20/21 21/22 22/23 23/24 24/25 UPCOMING BROADCASTS Upcoming League Matches 90 Moenchengladbach Leverkusen Dortmund Eintracht 22 August, Thursday 23 August, Friday Today (25 July, Thursday) Wolfsburg Bayern Mainz Union Berlin WTA. Iasi 23 August, Friday 23 August, Friday 9:10 Iasi) Freiburg Stuttgart Hoffenheim Kiel Ji-sung Reese Vesely / Barton 23 August, Friday 23 August, Friday 10:05 (Ooubles) Alycia Parks (W) Isabe"a Shinikova St. Pauli Heidenheim Augsburg Werder 23 August, Friday 23 August, Friday 10:05 Warsaw) Watanabe / Yuzuki Stevens / Pel Leipzig Bochum 10:05 (ATP Challenger. zug_ 23 August, Friday Doubles) WTA_ Prague 10:10 Prague) Round I Round 2 Magdalena Frech (W) Laura 22 August, Thursday 30 August, Friday Samson U o 10:10 Prague) Moenchengladbach Leverkusen Kiel Wolfsburg AT p. Kitzbuhel 23 August, Friday 8hum Moenchengladbach 10:10 (ATP Kitzbuhel) St. Pauli Heidenheim O, Union Berlin St. Pauli Thiago Seyboth Wild Yannick Hanfmann Mainz Union Berlin Werder Dortmund 10:10 (ATP Kitzbuhel)
URL: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/ Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form explicitly requesting sensitive information.","The text does not create a sense of urgency.","There is no CAPTCHA or any other anti-robot detection mechanism on the webpage."]}
Title: Video RB Bragantino Barcelona SC. Highlights (Football. Copa Sudamericana) / 25 July / LiveTV OCR: Sign Up LIVE Free L ive Sport Streams Search aROAOCASTS LIVE SCORE RESULTS VIDEO ARCHIVE FAN CLUas BEST BETTING SITES FORUM FAQ CONTACT Ill New on LiveTV Best Odds Today Matches of Your Teams Hntts MdlmarE Atletico In Mder to view this bkx:k you have to rnster or mn Tt-re are currently no with Gimpo Seow E-Land Your current time zone: 12:33 ilJTC +1) SPORTSBETTINC Stake BET NOW HIGHEST ODDS Football. Copa Sudamericana How to access a LiveTV? I: new livetv799.me of ttE Game 2: detailed insfructions RB Bragantino Barcelona SC 3: Telegrml chan'kl LiveTV Highlights Videos - RB Bragantino UPCOMING BROADCASTS Barcelona SC RB Bragantino Cruzeir&MG RB Bragantino Sao Paolo RB Braganbno RB Bragantino Atletico-GO Cuiaba RB Bragantino Today (25 July, Thursday) Videos - Barcelona SC WTA. Iasi Barcelona SC RB Bragantino 9:10 Iasi) Mushuc Runa Barcelona SC Barcelona SC Cobresal Ji-sung Reese Vesely / Barton O Sao Paolo Barcelona SC 10:05 (Ooubles) Talleres de Cordoba Barcelona Alycia Parks (W) Isabe"a Shinikova 10:05 Warsaw) Copa M' damericana Watanabe / Yuzuki Stevens / Pel League 10:05 (ATP Challenger. zug_ Doubles) Univ C.atolica Quito Libenad WTA_ Prague Inter-RS Rosario Central Racing de Montevideo 10:10 Prague) Huachipato Highlights (25 July 2024 at 1:30) Magdalena Frech (W) Laura Cerro Porteno Athletico-PR Samson CDU Quito Always Ready 10:10 Prague) Palestino Cuiaba AT p. Kitzbuhel 10:10 (ATP Kitzbuhel) Thiago Seyboth Wild Yannick Search for a Video To leave comments, you have to register or login. Hanfmann 10:10 (ATP Kitzbuhel)
URL: https://livetv.sx/enx/showvideo/1334345_rb_bragantino_barcelona_sc/ Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form explicitly requesting sensitive information.","The text does not create a sense of urgency.","There is no CAPTCHA or any other anti-robot detection mechanism on the webpage."]}
Title: Video RB Bragantino Barcelona SC. Highlights (Football. Copa Sudamericana) / 25 July / LiveTV OCR: Sign Up LIVE Free L ive Sport Streams Search aROAOCASTS LIVE SCORE RESULTS VIDEO ARCHIVE FAN CLUas BEST BETTING SITES FORUM FAQ CONTACT Ill New on LiveTV Best Odds Today Matches of Your Teams Hntts MdlmarE Atletico In Mder to view this bkx:k you have to rnster or mn Tt-re are currently no with Gimpo Seow E-Land Your current time zone: 12:33 ilJTC +1) SPORTSBETTINC Stake BET NOW HIGHEST ODDS Football. Copa Sudamericana How to access a LiveTV? I: new livetv799.me of ttE Game 2: detailed insfructions RB Bragantino Barcelona SC 3: Telegrml chan'kl LiveTV Highlights Videos - RB Bragantino UPCOMING BROADCASTS ANTINO vs. BARCELONA SC I HIGHLIG... Barcelona SC RB Bragantino Cruzeir&MG RB Bragantino Share Sao Paolo RB Braganbno RB Bragantino Atletico-GO Cuiaba RB Bragantino Red.gull Today (25 July, Thursday) Videos - Barcelona SC WTA. Iasi Barcelona SC RB Bragantino 9:10 Iasi) Mushuc Runa Barcelona SC Barcelona SC Cobresal Ji-sung Reese Vesely / Barton O Sao Paolo Barcelona SC 10:05 (Ooubles) Talleres de Cordoba Barcelona Alycia Parks (W) Isabe"a Shinikova 10:05 Warsaw) Copa M' damericana Watanabe / Yuzuki Stevens / Pel League 10:05 (ATP Challenger. zug_ Doubles) Watch on O VouTube Univ C.atolica Quito Libenad WTA_ Prague Inter-RS Rosario Central Racing de Montevideo 10:10 Prague) Huachipato Highlights (25 July 2024 at 1:30) Magdalena Frech (W) Laura Cerro Porteno Athletico-PR Samson CDU Quito Always Ready 10:10 Prague) Palestino Cuiaba AT p. Kitzbuhel 10:10 (ATP Kitzbuhel) Thiago Seyboth Wild Yannick Search for a Video To leave comments, you have to register or login. Hanfmann 10:10 (ATP Kitzbuhel)
URL: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815 Model: Perplexity: mixtral-8x7b-instruct	{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The text 'REGISTER -meil Please fill out this field.' suggests a login form where users are prompted to enter their registration details.","However, there is no urgency created in the text as it does not pressure users to take immediate action.","There is no CAPTCHA or any other anti-robot detection mechanism present on the webpage."]}
Title: Mystake Casino - 170% in deposit bonuses & 300 free spins OCR: Log In Count; EUR v REGISTER -meil Please fill out this field. Galaxy
URL: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815 Model: Perplexity: mixtral-8x7b-instruct	{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The webpage contains a login form which explicitly requests sensitive information such as email addresses and passwords.","The text does not create a sense of urgency or interest.","The webpage does not contain a CAPTCHA or anti-robot detection mechanism."]}
Title: Mystake Casino - 170% in deposit bonuses & 300 free spins OCR: Log In Please fill out this field. Count; EUR v REGISTER SEND Galaxy
URL: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815 Model: gpt-4o	```json { "phishing_score": 5, "brands": "MyStake", "phishing": false, "suspicious_domain": false, "has_prominent_loginform": true, "has_captcha": false, "setechniques": false, "has_suspicious_link": false, "legitmate_domain": "mystake.gg", "reasons": "The URL 'https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815' appears to be legitimate as it uses the 'mystake.gg' domain, which is associated with the MyStake brand. The webpage includes a prominent login form, which is common for legitimate sites. There are no obvious social engineering techniques or suspicious links present. However, the absence of a CAPTCHA and the presence of multiple input fields for sensitive information warrant caution. Overall, there is no conclusive evidence to classify this site as a phishing site." }

URL: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815 Model: gpt-4o	```json { "phishing_score": 6, "brands": "MyStake", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "mystake.com", "reasons": "The URL 'https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815' does not match the legitimate domain 'mystake.com' associated with the brand 'MyStake'. The '.gg' TLD is unusual for this brand and could be used to mislead users. The page prominently features login and registration forms, which are common targets for phishing. Additionally, the URL contains query parameters that could be used for tracking or redirecting, which is another common phishing technique. There is no CAPTCHA present, which is often used to increase security on legitimate sites. Overall, these factors suggest that the site is likely a phishing site." }

URL: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815 Model: custom	{"phishing_score": 8, "brand_name": "mystake.gg", "reasons": "The unusual domain'mystake.gg' does not match typical domain names for legitimate websites, and the minimalistic design raises concerns about the site's legitimacy and security. The presence of a 'Promo Code' field and a 'Forget Password?' link are common features in registration forms, but the overall design and domain extension suggest it may be related to gaming or entertainment, which is unusual for a legitimate website."}

URL: https://mystake.gg/us/static/crypto-landing?affid=3150038&cxd=3150038_836815 Model: custom	{"phishing_score": 8, "brand_name": "mystake.gg", "reasons": "The domain name'mystake.gg' is unusual and does not match typical domain names for legitimate services. The domain extension '.gg' is commonly associated with gaming websites, which raises suspicions about the site's legitimacy. The brand name'mystake.gg' is not commonly associated with any well-known services, and the minimalistic design with a dark background and purple border around the login form is not typical of legitimate services. The fact that the domain name is not well-known and the design is unusual increases the likelihood of this site being a phishing site. However, the absence of any unusual or notable features in the design or content and the clear visibility of text and links reduces the likelihood of this site being a phishing site. Therefore, I give this site a phishing score of 8 out of 10, indicating that it is likely to be a phishing site, but not with absolute certainty."}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 25 10:31:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9923960587605425
Encrypted:	false
SSDEEP:
MD5:	55C19C8AB921D36C7FBF66E9604ADE79
SHA1:	F04B1C02256CA6757327826FE3145876731DF92C
SHA-256:	81320113A5D2D8B8748162CFFD4A826447C9FD7BD1244D93B437ED2A282C8814
SHA-512:	92E8F7560ED464F0628D121E4722057F905C1896A8E830DC2F23045BA05748340535C7813B48FC77D8B864DEE0FF44762FD585CBD9BEF269FA9E777D5F686CB7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......+....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.[....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............m.h.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://ads.livetv799.me

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 178

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 188

Chrome Cache Entry: 190

Chrome Cache Entry: 192

Chrome Cache Entry: 194

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 200

Chrome Cache Entry: 202

Chrome Cache Entry: 204

Chrome Cache Entry: 208

Chrome Cache Entry: 209

Chrome Cache Entry: 213

Chrome Cache Entry: 214

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 219

Chrome Cache Entry: 221

Chrome Cache Entry: 223

Chrome Cache Entry: 226

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 231

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Windows Analysis Report
http://ads.livetv799.me

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre