Edit tour

Windows Analysis Report
https://blmphilly.com/

Overview

General Information

Sample URL:	https://blmphilly.com/
Analysis ID:	1526486
Tags:	urlscan
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Detected suspicious crossdomain redirect

HTML page contains hidden javascript code

HTTP GET or POST without a user agent

Yara signature match

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2028,i,8472074873096495441,8610245428700690833,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://blmphilly.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	MAL_EnvyScout_May_2021_1	Detect EnvyScout downloader	Arkbird_SOLG	0xa83578:$s1: ==typeof window&&window.window===window?window: 0xcb7889:$s1: ==typeof window&&window.window===window?window: 0xa835af:$s2: ==typeof self&&self.self===self?self: 0xcb78c0:$s2: ==typeof self&&self.self===self?self: 0xb0fea6:$s3: 0===t?t={autoBom:!1}: 0xa83d29:$s4: _global.saveAs=saveAs.saveAs=saveAs 0xcb7f1a:$s4: _global.saveAs=saveAs.saveAs=saveAs 0x3cad70:$s5: navigator.userAgent 0x3cad96:$s5: navigator.userAgent 0x3cadba:$s5: navigator.userAgent 0x3caddf:$s5: navigator.userAgent 0x3cafc4:$s5: navigator.userAgent 0x3cb060:$s5: navigator.userAgent 0x3cb174:$s5: navigator.userAgent 0x3cb372:$s5: navigator.userAgent 0x424675:$s5: navigator.userAgent 0x4246b4:$s5: navigator.userAgent 0x4246e9:$s5: navigator.userAgent 0x424748:$s5: navigator.userAgent 0x4247aa:$s5: navigator.userAgent 0x42499f:$s5: navigator.userAgent

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_950	MAL_EnvyScout_May_2021_1	Detect EnvyScout downloader	Arkbird_SOLG	0xd587f:$s1: ==typeof window&&window.window===window?window: 0xd58b6:$s2: ==typeof self&&self.self===self?self: 0x5bd:$s3: 0===t?t={autoBom:!1}: 0xd5eca:$s4: _global.saveAs=saveAs.saveAs=saveAs 0x18db9:$s5: navigator.userAgent 0x1a021:$s5: navigator.userAgent 0x6ce6c:$s5: navigator.userAgent 0x6ce93:$s5: navigator.userAgent 0x98e71:$s5: navigator.userAgent 0x98e9f:$s5: navigator.userAgent 0x98ecb:$s5: navigator.userAgent 0xd4b08:$s5: navigator.userAgent 0xd4b34:$s5: navigator.userAgent 0xd575e:$s5: navigator.userAgent 0xd5d3a:$s5: navigator.userAgent
dropped/chromecache_797	MAL_EnvyScout_May_2021_1	Detect EnvyScout downloader	Arkbird_SOLG	0xd587f:$s1: ==typeof window&&window.window===window?window: 0xd58b6:$s2: ==typeof self&&self.self===self?self: 0x5bd:$s3: 0===t?t={autoBom:!1}: 0xd5eca:$s4: _global.saveAs=saveAs.saveAs=saveAs 0x18db9:$s5: navigator.userAgent 0x1a021:$s5: navigator.userAgent 0x6ce6c:$s5: navigator.userAgent 0x6ce93:$s5: navigator.userAgent 0x98e71:$s5: navigator.userAgent 0x98e9f:$s5: navigator.userAgent 0x98ecb:$s5: navigator.userAgent 0xd4b08:$s5: navigator.userAgent 0xd4b34:$s5: navigator.userAgent 0xd575e:$s5: navigator.userAgent 0xd5d3a:$s5: navigator.userAgent

HTML

Source	Rule	Description	Author	Strings
0.67..script.csv	MAL_EnvyScout_May_2021_1	Detect EnvyScout downloader	Arkbird_SOLG	0xd58fe:$s1: ==typeof window&&window.window===window?window: 0xd5935:$s2: ==typeof self&&self.self===self?self: 0x63c:$s3: 0===t?t={autoBom:!1}: 0xd5f49:$s4: _global.saveAs=saveAs.saveAs=saveAs 0x18e38:$s5: navigator.userAgent 0x1a0a0:$s5: navigator.userAgent 0x6ceeb:$s5: navigator.userAgent 0x6cf12:$s5: navigator.userAgent 0x98ef0:$s5: navigator.userAgent 0x98f1e:$s5: navigator.userAgent 0x98f4a:$s5: navigator.userAgent 0xd4b87:$s5: navigator.userAgent 0xd4bb3:$s5: navigator.userAgent 0xd57dd:$s5: navigator.userAgent 0xd5db9:$s5: navigator.userAgent

HTTP traffic detected: POST /fee_calculator HTTP/1.1Host: blmphilly.allyrafundraising.comConnection: keep-aliveContent-Length: 55sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CSRF-Token: L2Bu8j9olL6unB3fUmVdyeSDPevbG1tHmaiEpXRPmK0y2H2uYrv2bLp799zU/NvfpNUO689exQ4Ek/UBT9WEjw==sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8Accept: */*X-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Origin: https://blmphilly.allyrafundraising.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://blmphilly.allyrafundraising.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _wdi_session_v01102023=NSF0dbMmw%2FMvqdy6IWb1IcNBX56jz%2FRUNYLeOT8MVIxqlfg0OgdshdS%2B6bYVeE%2FXvrDtVzor2EoYNs85lcTzM%2FIcN0bRHoPbhkM8w3HdWqNQpobOw8vlFjDbm%2BqKx3mpY5BDbMPIH%2BrE1oFqa1o3ccjFHEvgNGhL%2FoApmIzqaieI9Q%3D%3D--NcHv%2BB5dwWEug6aF--wTVWUOCZVQcuNVwTN0SjBw%3D%3D; AWSALB=37ykpefVXg6x/O/5ZskDQEkxBmFHHGMuaEo0TxUkIyID4OYvj9PZuJArcIq6SVwTVRq1opTIL61OhNMiYuncCQavT5iMIyZBxGQUuGT+qxpJKh/VeQ1AddDwvW5W; AWSALBCORS=37ykpefVXg6x/O/5ZskDQEkxBmFHHGMuaEo0TxUkIyID4OYvj9PZuJArcIq6SVwTVRq1opTIL61OhNMiYuncCQavT5iMIyZBxGQUuGT+qxpJKh/VeQ1AddDwvW5W

Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No favicon
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No favicon
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No favicon
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No favicon
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No favicon
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No favicon
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No favicon
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No favicon
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No favicon
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No favicon

Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No <meta name="author".. found
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No <meta name="author".. found
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No <meta name="author".. found
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No <meta name="author".. found

Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://blmphilly.allyrafundraising.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:50217 version: TLS 1.2

Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/ces/p2
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/onboarding/sso_init.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/onboarding/task.json

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_596.2.dr	String found in binary or memory: <div id="text-3" class="widget widget_text" data-area="footer_bottom_area_column_1"><div class="textwidget"><div class="qodef-footer-bottom-nav"><a style="color: #fff; margin-right: 33px;" href="https://blmphilly.com/who-we-are/">Who We Are</a><a style="color: #fff; margin-right: 33px;" href="https://blmphilly.com/news/">News</a><a style="color: #fff; margin-right: 33px;" href="/donate/">Donate</a><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px; display: inline;" href="https://www.facebook.com/blacklivesmatterphilly/" target="_blank" rel="noopener"><img decoding="async" style="display: inline;" title="Facebook" src="/wp-content/uploads/2020/06/iconmonstr-facebook-1.svg" /></a><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px; display: inline;" href="https://twitter.com/@BLMPhilly" target="_blank" rel="noopener"><img decoding="async" style="display: inline;" title="Twitter" src="/wp-content/uploads/2020/06/iconmonstr-twitter-1.svg" /></a><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px; display: inline;" href="https://www.instagram.com/blmphilly/" target="_blank" rel="noopener"><img decoding="async" style="display: inline;" title="Instagram" src="/wp-content/uploads/2020/06/iconmonstr-instagram-11.svg" /></a></div> equals www.facebook.com (Facebook)
Source: chromecache_596.2.dr	String found in binary or memory: <div id="text-3" class="widget widget_text" data-area="footer_bottom_area_column_1"><div class="textwidget"><div class="qodef-footer-bottom-nav"><a style="color: #fff; margin-right: 33px;" href="https://blmphilly.com/who-we-are/">Who We Are</a><a style="color: #fff; margin-right: 33px;" href="https://blmphilly.com/news/">News</a><a style="color: #fff; margin-right: 33px;" href="/donate/">Donate</a><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px; display: inline;" href="https://www.facebook.com/blacklivesmatterphilly/" target="_blank" rel="noopener"><img decoding="async" style="display: inline;" title="Facebook" src="/wp-content/uploads/2020/06/iconmonstr-facebook-1.svg" /></a><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px; display: inline;" href="https://twitter.com/@BLMPhilly" target="_blank" rel="noopener"><img decoding="async" style="display: inline;" title="Twitter" src="/wp-content/uploads/2020/06/iconmonstr-twitter-1.svg" /></a><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px; display: inline;" href="https://www.instagram.com/blmphilly/" target="_blank" rel="noopener"><img decoding="async" style="display: inline;" title="Instagram" src="/wp-content/uploads/2020/06/iconmonstr-instagram-11.svg" /></a></div> equals www.twitter.com (Twitter)
Source: chromecache_596.2.dr	String found in binary or memory: <div class="widget widget_text" data-area="social-icons"><div class="textwidget"><p><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px;" href="https://www.facebook.com/blacklivesmatterphilly/" target="_blank" rel="noopener"><img decoding="async" src="/wp-content/uploads/2020/06/iconmonstr-facebook-1.svg" style="display:inline;" title="Facebook" /></a><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px;" href="https://twitter.com/@BLMPhilly" target="_blank" rel="noopener"><img decoding="async" src="/wp-content/uploads/2020/06/iconmonstr-twitter-1.svg" style="display:inline;" title="Twitter" /></a><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px;" href="https://www.instagram.com/blmphilly/" target="_blank" rel="noopener"><img decoding="async" src="/wp-content/uploads/2020/06/iconmonstr-instagram-11.svg" style="display:inline;" title="Instagram" /></a></p> equals www.facebook.com (Facebook)
Source: chromecache_596.2.dr	String found in binary or memory: <div class="widget widget_text" data-area="social-icons"><div class="textwidget"><p><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px;" href="https://www.facebook.com/blacklivesmatterphilly/" target="_blank" rel="noopener"><img decoding="async" src="/wp-content/uploads/2020/06/iconmonstr-facebook-1.svg" style="display:inline;" title="Facebook" /></a><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px;" href="https://twitter.com/@BLMPhilly" target="_blank" rel="noopener"><img decoding="async" src="/wp-content/uploads/2020/06/iconmonstr-twitter-1.svg" style="display:inline;" title="Twitter" /></a><a style="color: #fff; margin: 0px 15px 0px 0px; position: relative; top: 2px;" href="https://www.instagram.com/blmphilly/" target="_blank" rel="noopener"><img decoding="async" src="/wp-content/uploads/2020/06/iconmonstr-instagram-11.svg" style="display:inline;" title="Instagram" /></a></p> equals www.twitter.com (Twitter)
Source: chromecache_588.2.dr	String found in binary or memory: "https://www.facebook.com/StripeHQ", equals www.facebook.com (Facebook)
Source: chromecache_588.2.dr	String found in binary or memory: "https://www.linkedin.com/company/stripe/", equals www.linkedin.com (Linkedin)
Source: chromecache_966.2.dr, chromecache_634.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/A4tfXiHOGrs/ equals www.facebook.com (Facebook)
Source: chromecache_495.2.dr, chromecache_431.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/CCT5pM3qiNk/ equals www.facebook.com (Facebook)
Source: chromecache_966.2.dr, chromecache_634.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/Ga6vBwdwgUx/ equals www.facebook.com (Facebook)
Source: chromecache_566.2.dr, chromecache_549.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/HAC-_9WTKIm/ equals www.facebook.com (Facebook)
Source: chromecache_495.2.dr, chromecache_431.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/MDzNl_j9yvg/ equals www.facebook.com (Facebook)
Source: chromecache_495.2.dr, chromecache_431.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/OKBVmODmb-W/ equals www.facebook.com (Facebook)
Source: chromecache_495.2.dr, chromecache_431.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/V9vdYColc4k/ equals www.facebook.com (Facebook)
Source: chromecache_495.2.dr, chromecache_431.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/WRsJ32R7YJG/ equals www.facebook.com (Facebook)
Source: chromecache_495.2.dr, chromecache_431.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/aJoeSHn7XcN/ equals www.facebook.com (Facebook)
Source: chromecache_495.2.dr, chromecache_431.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/t3hOLs8wlXy/ equals www.facebook.com (Facebook)
Source: chromecache_410.2.dr, chromecache_887.2.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=zb()},nd:function(){d()}}};var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_564.2.dr	String found in binary or memory: __d("Chromedome",["fbt"],(function(a,b,c,d,e,f,g,h){function i(){if(document.domain==null)return null;var a=document.domain,b=/^intern\./.test(a);if(b)return null;b=/(^\|\.)facebook\.(com\|sg)$/.test(a);if(b)return"facebook";b=/(^\|\.)instagram\.com$/.test(a);if(b)return"instagram";b=/(^\|\.)threads\.net$/.test(a);if(b)return"threads";b=/(^\|\.)messenger\.com$/.test(a);return b?"messenger":null}function j(a){if(a==="instagram")return h._("This is a browser feature intended for developers. If someone told you to copy-paste something here to enable an Instagram feature or \"hack\" someone's account, it is a scam and will give them access to your Instagram account.");return a==="threads"?h._("This is a browser feature intended for developers. If someone told you to copy-paste something here to enable a Threads feature or \"hack\" someone's account, it is a scam and will give them access to your Threads account."):h._("This is a browser feature intended for developers. If someone told you to copy and paste something here to enable a Facebook feature or \"hack\" someone's account, it is a scam and will give them access to your Facebook account.")}function a(a){if(top!==window)return;a=i();if(a==null)return;var b=h._("Stop!");a=j(a);var c=h._("See {url} for more information.",[h._param("url","https://www.facebook.com/selfxss")]),d="font-family:helvetica; font-size:20px; ";[[b,d+"font-size:50px; font-weight:bold; color:red; -webkit-text-stroke:1px black;"],[a,d],[c,d],["",""]].map(function(a){window.setTimeout(console.log.bind(console,"\n%c"+a[0].toString(),a[1]))})}g.start=a}),226); equals www.facebook.com (Facebook)
Source: chromecache_718.2.dr	String found in binary or memory: __d("CometLegalFooter.react",["fbt","ix","BaseMiddot.react","CometErrorBoundary.react","CometLink.react","CometPressable.react","FBCookieSettingsLoggedOutConfig","FDSLazyPopoverTrigger.react","FDSText.react","JSResourceForInteraction","ServerTime","TetraIcon.react","XHealthPolicyCometControllerRouteBuilder","XPrivacyPolicyCometControllerRouteBuilder","fbicon","gkx","react","useCurrentRoute"],(function(a,b,c,d,e,f,g,h,i){"use strict";var j,k=j\|\|d("react"),l=c("JSResourceForInteraction")("CometLegalFooterMoreMenu.react").__setRef("CometLegalFooter.react");function m(){try{var a;return(a=new Date(d("ServerTime").getMillis()))==null?void 0:a.getFullYear()}catch(a){return null}}function a(a){var b=a.isHelpCenter;b=b===void 0?!1:b;var e=a.isPage;e=e===void 0?!1:e;var f=a.onClick;a=d("FBCookieSettingsLoggedOutConfig").should_show_cookie_settings;var g=c("useCurrentRoute")(),j=m(),n=c("XPrivacyPolicyCometControllerRouteBuilder").buildUri({entry_point:"comet_dropdown"}),o=c("XHealthPolicyCometControllerRouteBuilder").buildUri({});e=[{href:"https://www.facebook.com/legal/terms/information_about_page_insights_data",label:h._("Information about Page Insights data"),render:e&&c("gkx")("22806")},{href:n.toString(),label:h._("Privacy"),testid:"CometDropdownPrivacy"},{href:o.toString(),label:h._("Consumer Health Privacy"),render:c("gkx")("2828"),testid:"CometDropdownHealthPrivacy"},{href:"/terms?ref=pf",label:"Impressum/Terms/NetzDG/UrhDaG",render:c("gkx")("22807")&&!c("gkx")("22808")},{href:"/terms?ref=pf",label:h._("Imprint\/terms"),render:c("gkx")("22808")},{href:"/legal/germany/",label:"UrhDaG/MStV",render:c("gkx")("22808")},{href:"/policies?ref=pf",label:h._("Terms"),render:!c("gkx")("22807")&&!c("gkx")("22808"),testid:"CometDropdownTerms"},{href:"/business/",label:h._("Advertising")},{href:"/help/568137493302217",label:k.jsxs(k.Fragment,{children:[h._("Ad choices")," ",k.jsx(c("CometErrorBoundary.react"),{children:k.jsx("span",{className:"x1n2onr6 x1qiirwl",children:k.jsx(c("TetraIcon.react"),{color:"secondary",icon:d("fbicon")._(i("871692"),12)})})})]})},{href:"/policies/cookies/",label:h._("Cookies"),testid:"CometDropdownCookies"},{href:"/privacy/cookie_settings/",label:h._("Cookie settings"),render:a},{href:"https://www.facebook.com/help/cancelcontracts?source=facebook.com",label:h._("Cancel contracts here"),open_in_new_tab:!0,render:c("gkx")("4387")}].filter(function(a){return a.render==null\|\|a.render===!0});var p=[];if((g==null?void 0:(n=g.rootView.props)==null?void 0:n.seoCrawlingPool)&&(g==null?void 0:(o=g.rootView.props)==null?void 0:o.seoCrawlingPool.url)){Array.from(Array((g==null?void 0:(a=g.rootView.props)==null?void 0:a.seoCrawlingPool.multiple_links)\|\|0)).forEach(function(a,b){p.push(k.jsxs("li",{className:"xt0psk2",children:[k.jsx(c("CometLink.react"),{color_DEPRECATED:"secondary",href:g==null?void 0:(a=g.rootView.props)==null?void 0:a.seoCrawlingPool.url,onClick:f,weight_DEPRECATED:"normal",children:g==null?void 0:(a=g.rootView.props)==null
Source: chromecache_495.2.dr, chromecache_431.2.dr	String found in binary or memory: __d("FacebookCookieConsentCustomization",["fbt","ix","JSResourceForInteraction","XCookiesPolicyControllerRouteBuilder","isBaseline4EnabledForLoggedOut","isCNILEnabledForLoggedOut","lazyLoadComponent"],(function(a,b,c,d,e,f,g,h,i){"use strict";var j=c("lazyLoadComponent")(c("JSResourceForInteraction")("FacebookCometCookieConsentDialogDataSettings.react").__setRef("FacebookCookieConsentCustomization"));a=function(){var a,b,d,e=null;c("isBaseline4EnabledForLoggedOut")()\|\|c("isCNILEnabledForLoggedOut")()?(b=i("1954651"),d=i("1954649"),e=h._("More options")):(b=i("856481"),d=i("856481"),e=h._("Manage Data Settings"));a=(a=(a=c("XCookiesPolicyControllerRouteBuilder").buildUri({}).getQualifiedUri())==null?void 0:(a=a.setDomain("www.facebook.com"))==null?void 0:a.toString())!=null?a:"";return{essentialCookiesOnly:!1,faviconDark:d,faviconLight:b,policyUrl:a,productName:"FACEBOOK",secondaryAction:{label:e,viewReference:j}}};b=a;g["default"]=b}),226); equals www.facebook.com (Facebook)
Source: chromecache_858.2.dr	String found in binary or memory: __d("RealtimeGraphQLRequest",["invariant","RequestStreamCommonRequestStreamCommonTypes","TransportSelectingClientSingleton","nullthrows","regeneratorRuntime"],(function(a,b,c,d,e,f,g,h){"use strict";a=function(){function a(a){var b=this,e=a.method,f=a.doc_id,g=a.is_intern,i=a.extra_headers,j=a.body,k=a.instrumentation_data;a=a.sandbox;this.$12=function(a){switch(a){case d("RequestStreamCommonRequestStreamCommonTypes").FlowStatus.Started:if(b.$10){b.$9!=null\|\|h(0,13576);a=Date.now()-c("nullthrows")(b.$9);b.$7!=null&&b.$7(a)}else b.$10=!0,b.$5!=null&&b.$5();break;case d("RequestStreamCommonRequestStreamCommonTypes").FlowStatus.Stopped:b.$9=Date.now();b.$6!=null&&b.$6(!1,!1);break;default:break}};this.$10=!1;e={method:e,doc_id:f};g===!0&&(e=babelHelpers["extends"]({},e,{www_tier:"intern"}));a!=null&&(e=babelHelpers["extends"]({},e,{www_sandbox:a.replace(/^not-www\.(\d+\|\w+)\.(od\|sb)\.internalfb\.com$/,"www.$1.$2.facebook.com")}));i!=null&&(e=babelHelpers["extends"]({},e,i));this.$1=e;this.$2=JSON.stringify(j);this.$11=k}var e=a.prototype;e.onResponse=function(a){this.$3=a;return this};e.onError=function(a){this.$4=a;return this};e.onActive=function(a){this.$5=a;return this};e.onPause=function(a){this.$6=a;return this};e.onResume=function(a){this.$7=a;return this};e.onRetryUpdateRequestBody=function(a){this.$8=a;this.$1=babelHelpers["extends"]({},this.$1,{request_stream_retry:"false"});return this};e.send=function(){var a,d;return b("regeneratorRuntime").async(function(e){while(1)switch(e.prev=e.next){case 0:this.$3!=null\|\|h(0,33593);a={onData:c("nullthrows")(this.$3)};this.$4!=null&&(a=babelHelpers["extends"]({},a,{onTermination:this.$4}));a=babelHelpers["extends"]({},a,{onFlowStatus:this.$12});this.$8!=null&&(a=babelHelpers["extends"]({},a,{onRetryUpdateRequestBody:this.$8}));e.next=7;return b("regeneratorRuntime").awrap(c("TransportSelectingClientSingleton").requestStream(this.$1,this.$2,a,this.$11));case 7:d=e.sent;return e.abrupt("return",{cancel:function(){d.cancel()},amendExperimental:function(a){try{d.amendWithoutAck(JSON.stringify(a));return!0}catch(a){return!1}}});case 9:case"end":return e.stop()}},null,this)};return a}();g["default"]=a}),98); equals www.facebook.com (Facebook)
Source: chromecache_410.2.dr, chromecache_887.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=rA(a,c,e);Q(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return Q(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},uA=function(){var a=[],b=function(c){return pb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_410.2.dr, chromecache_887.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={hh:e,fh:f,gh:g,Rh:k,Sh:m,He:n,Cb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(WC(w,"iframe_api")\|\|WC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!NC&&UC(x[A],p.He))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_410.2.dr, chromecache_887.2.dr	String found in binary or memory: var YB=function(a,b,c,d,e){var f=Pz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Pz("fsl","nv.ids",[]):Pz("fsl","ids",[]);if(!g.length)return!0;var k=Uz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);Q(121);if(m==="https://www.facebook.com/tr/")return Q(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!Cy(k,Ey(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: blmphilly.com
Source: global traffic	DNS traffic detected: DNS query: www.blmphilly.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: s.w.org
Source: global traffic	DNS traffic detected: DNS query: blmphilly.wedid.it
Source: global traffic	DNS traffic detected: DNS query: blmphilly.allyrafundraising.com
Source: global traffic	DNS traffic detected: DNS query: cdn.ravenjs.com
Source: global traffic	DNS traffic detected: DNS query: doublethedonation.com
Source: global traffic	DNS traffic detected: DNS query: ucarecdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.plaid.com
Source: global traffic	DNS traffic detected: DNS query: js.stripe.com
Source: global traffic	DNS traffic detected: DNS query: s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api.stripe.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: r.stripe.com
Source: global traffic	DNS traffic detected: DNS query: m.stripe.network
Source: global traffic	DNS traffic detected: DNS query: m.stripe.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: stripe.com
Source: global traffic	DNS traffic detected: DNS query: scontent.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: video.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: static.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: scontent-msp1-1.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: x.com
Source: global traffic	DNS traffic detected: DNS query: abs.twimg.com
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: pbs.twimg.com
Source: global traffic	DNS traffic detected: DNS query: api.x.com
Source: global traffic	DNS traffic detected: DNS query: api.twitter.com
Source: global traffic	DNS traffic detected: DNS query: video.twimg.com
Source: global traffic	DNS traffic detected: DNS query: abs-0.twimg.com
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 05 Oct 2024 22:20:01 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 05 Oct 2024 22:20:01 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 05 Oct 2024 22:20:02 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 05 Oct 2024 22:20:03 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 05 Oct 2024 22:20:04 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 05 Oct 2024 22:20:05 GMTContent-Type: application/octet-streamContent-Length: 75Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Sat, 05 Oct 2024 22:20:44 UTCperf: 7402827104server: tsa_bcache-control: no-cache, no-store, max-age=0content-length: 0x-transaction-id: 4ad7a80580b288e6x-rate-limit-limit: 500x-rate-limit-reset: 1728167744x-rate-limit-remaining: 499strict-transport-security: max-age=631138519access-control-allow-origin: https://x.comaccess-control-allow-credentials: trueaccess-control-expose-headers: X-Twitter-Spotify-Access-Token,X-Twitter-Client-Version,X-Twitter-Diffy-Request-Key,X-Rate-Limit-Limit,X-TD-Mtime,X-Twitter-Client,Backoff-Policy,X-Rate-Limit-Remaining,Content-Length,X-Rate-Limit-Reset,X-Transaction-Id,X-Acted-As-User-Id,X-Twitter-Polling,X-Twitter-UTCOffset,X-Response-Timex-response-time: 5x-connection-hash: 354a4c029d7b1d18305e106482cd063ac687cb151f88474e9d8feb59542e9ef1connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenperf: 7402827104cache-control: no-cache, no-store, max-age=0content-length: 0x-transaction-id: 4435fd665e8d0e31access-control-allow-origin: https://x.comaccess-control-allow-credentials: trueaccess-control-expose-headers: X-Twitter-Spotify-Access-Token,X-Twitter-Client-Version,X-Twitter-Diffy-Request-Key,X-Rate-Limit-Limit,X-TD-Mtime,X-Twitter-Client,Backoff-Policy,X-Rate-Limit-Remaining,Content-Length,X-Rate-Limit-Reset,X-Transaction-Id,X-Acted-As-User-Id,X-Twitter-Polling,X-Twitter-UTCOffset,X-Response-Timex-response-time: 1x-connection-hash: 1de494d14948d4ce7ba6e49769b71965650f90f3b0f824d733c122e183f7ebacdate: Sat, 05 Oct 2024 22:20:46 GMTserver: tsa_bconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Sat, 05 Oct 2024 22:20:47 UTCperf: 7402827104server: tsa_bcache-control: no-cache, no-store, max-age=0content-length: 0x-transaction-id: 9a221257951853acx-rate-limit-limit: 500x-rate-limit-reset: 1728167747x-rate-limit-remaining: 499strict-transport-security: max-age=631138519access-control-allow-origin: https://x.comaccess-control-allow-credentials: trueaccess-control-expose-headers: X-Twitter-Spotify-Access-Token,X-Twitter-Client-Version,X-Twitter-Diffy-Request-Key,X-Rate-Limit-Limit,X-TD-Mtime,X-Twitter-Client,Backoff-Policy,X-Rate-Limit-Remaining,Content-Length,X-Rate-Limit-Reset,X-Transaction-Id,X-Acted-As-User-Id,X-Twitter-Polling,X-Twitter-UTCOffset,X-Response-Timex-response-time: 5x-connection-hash: 94756df7fac229e56c562e9360acaf543c71e80fe2abee16f358f319ec1987b2connection: close

Source: 0.67..script.csv, type: HTML	Matched rule: Detect EnvyScout downloader Author: Arkbird_SOLG
Source: sslproxydump.pcap, type: PCAP	Matched rule: Detect EnvyScout downloader Author: Arkbird_SOLG
Source: dropped/chromecache_950, type: DROPPED	Matched rule: Detect EnvyScout downloader Author: Arkbird_SOLG
Source: dropped/chromecache_797, type: DROPPED	Matched rule: Detect EnvyScout downloader Author: Arkbird_SOLG

Source: 0.67..script.csv, type: HTML	Matched rule: MAL_EnvyScout_May_2021_1 date = 2021-05-28, hash2 = 9059c5b46dce8595fcc46e63e4ffbceeed883b7b1c9a2313f7208a7f26a0c186, hash1 = 279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11, author = Arkbird_SOLG, description = Detect EnvyScout downloader, adversary = NOBELIUM, reference = Internal Research, tlp = White
Source: sslproxydump.pcap, type: PCAP	Matched rule: MAL_EnvyScout_May_2021_1 date = 2021-05-28, hash2 = 9059c5b46dce8595fcc46e63e4ffbceeed883b7b1c9a2313f7208a7f26a0c186, hash1 = 279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11, author = Arkbird_SOLG, description = Detect EnvyScout downloader, adversary = NOBELIUM, reference = Internal Research, tlp = White
Source: dropped/chromecache_950, type: DROPPED	Matched rule: MAL_EnvyScout_May_2021_1 date = 2021-05-28, hash2 = 9059c5b46dce8595fcc46e63e4ffbceeed883b7b1c9a2313f7208a7f26a0c186, hash1 = 279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11, author = Arkbird_SOLG, description = Detect EnvyScout downloader, adversary = NOBELIUM, reference = Internal Research, tlp = White
Source: dropped/chromecache_797, type: DROPPED	Matched rule: MAL_EnvyScout_May_2021_1 date = 2021-05-28, hash2 = 9059c5b46dce8595fcc46e63e4ffbceeed883b7b1c9a2313f7208a7f26a0c186, hash1 = 279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11, author = Arkbird_SOLG, description = Detect EnvyScout downloader, adversary = NOBELIUM, reference = Internal Research, tlp = White

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2028,i,8472074873096495441,8610245428700690833,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://blmphilly.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2028,i,8472074873096495441,8610245428700690833,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Link
stats.g.doubleclick.net	0%	Virustotal	Browse
scontent.xx.fbcdn.net	0%	Virustotal	Browse
dualstack.video.twitter.map.fastly.net	0%	Virustotal	Browse
s3.amazonaws.com	0%	Virustotal	Browse
www.blmphilly.com	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
t.co	0%	Virustotal	Browse
star-mini.c10r.facebook.com	0%	Virustotal	Browse
cdn.ravenjs.com	0%	Virustotal	Browse
twimg.twitter.map.fastly.net	0%	Virustotal	Browse
twitter.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
scontent-msp1-1.xx.fbcdn.net	0%	Virustotal	Browse
a.nel.cloudflare.com	0%	Virustotal	Browse
google.com	0%	Virustotal	Browse
cdn.plaid.com	0%	Virustotal	Browse
video.xx.fbcdn.net	0%	Virustotal	Browse
ucarecdn.com	0%	Virustotal	Browse
tpop-api.twitter.com	0%	Virustotal	Browse
blmphilly.com	0%	Virustotal	Browse
s-part-0017.t-0009.t-msedge.net	0%	Virustotal	Browse
stripecdn.map.fastly.net	0%	Virustotal	Browse
doublethedonation.com	0%	Virustotal	Browse
r.stripe.com	0%	Virustotal	Browse
tpop-api.x.com	0%	Virustotal	Browse
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
analytics-alv.google.com	0%	Virustotal	Browse
dualstack.twimg.twitter.map.fastly.net	0%	Virustotal	Browse
abs-zero.twimg.com	0%	Virustotal	Browse
td.doubleclick.net	0%	Virustotal	Browse
x.com	1%	Virustotal	Browse
stripe.com	0%	Virustotal	Browse

Source	Detection	Scanner	Label
https://abs.twimg.com/responsive-web/client-web/shared~loader.Typeahead~loader.DMDrawer~bundle.Grok~bundle.MultiAccount~bundle.ReaderMode~bundle.Articles~bun.f39400ca.js	0%	URL Reputation	safe
http://underscorejs.org	0%	URL Reputation	safe
https://swiperjs.com	0%	URL Reputation	safe
https://www.internalfb.com/intern/invariant/	0%	URL Reputation	safe
https://youradchoices.ca/	0%	URL Reputation	safe
https://support.google.com/recaptcha/#6175971	0%	URL Reputation	safe
https://support.google.com/recaptcha	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe
https://fburl.com/wiki/xrzohrqb	0%	URL Reputation	safe
https://jqueryui.com	0%	URL Reputation	safe
https://abs.twimg.com/responsive-web/client-web/shared~bundle.SettingsProfile~bundle.UserProfile.6ba4be2a.js	0%	URL Reputation	safe
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~loader.AppModules	0%	URL Reputation	safe
https://cloud.google.com/contact	0%	URL Reputation	safe
https://fontawesome.com/license/free	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
doublethedonation.com	20.172.164.4	true	false	0%, Virustotal, Browse	unknown
dualstack.video.twitter.map.fastly.net	146.75.52.158	true	false	0%, Virustotal, Browse	unknown
www.blmphilly.com	208.113.142.161	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
stats.g.doubleclick.net	66.102.1.156	true	false	0%, Virustotal, Browse	unknown
tpop-api.twitter.com	104.244.42.130	true	false	0%, Virustotal, Browse	unknown
scontent.xx.fbcdn.net	157.240.0.6	true	false	0%, Virustotal, Browse	unknown
blmphilly.allyrafundraising.com	104.26.2.230	true	false		unknown
s3.amazonaws.com	52.216.133.157	true	false	0%, Virustotal, Browse	unknown
t.co	172.66.0.227	true	false	0%, Virustotal, Browse	unknown
twimg.twitter.map.fastly.net	146.75.52.159	true	false	0%, Virustotal, Browse	unknown
cdn.ravenjs.com	151.101.66.217	true	false	0%, Virustotal, Browse	unknown
stripe.com	18.202.131.124	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.181.228	true	false	0%, Virustotal, Browse	unknown
scontent-msp1-1.xx.fbcdn.net	157.240.26.27	true	false	0%, Virustotal, Browse	unknown
star-mini.c10r.facebook.com	157.240.251.35	true	false	0%, Virustotal, Browse	unknown
twitter.com	104.244.42.1	true	false	0%, Virustotal, Browse	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	0%, Virustotal, Browse	unknown
google.com	142.250.186.46	true	false	0%, Virustotal, Browse	unknown
cdn.plaid.com	13.33.187.92	true	false	0%, Virustotal, Browse	unknown
video.xx.fbcdn.net	157.240.253.2	true	false	0%, Virustotal, Browse	unknown
tpop-api.x.com	104.244.42.130	true	false	0%, Virustotal, Browse	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	0%, Virustotal, Browse	unknown
ucarecdn.com	2.19.126.150	true	false	0%, Virustotal, Browse	unknown
blmphilly.com	208.113.142.161	true	false	0%, Virustotal, Browse	unknown
stripecdn.map.fastly.net	151.101.64.176	true	false	0%, Virustotal, Browse	unknown
r.stripe.com	54.186.23.98	true	false	0%, Virustotal, Browse	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
analytics-alv.google.com	216.239.38.181	true	false	0%, Virustotal, Browse	unknown
blmphilly.wedid.it	188.114.97.3	true	false		unknown
m.stripe.com	44.229.209.246	true	false		unknown
dualstack.twimg.twitter.map.fastly.net	146.75.52.159	true	false	0%, Virustotal, Browse	unknown
abs-zero.twimg.com	104.244.43.131	true	false	0%, Virustotal, Browse	unknown
td.doubleclick.net	216.58.206.34	true	false	0%, Virustotal, Browse	unknown
x.com	104.244.42.1	true	false	1%, Virustotal, Browse	unknown
s.w.org	192.0.77.48	true	false		unknown
api.stripe.com	34.241.59.225	true	false		unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false		unknown
m.stripe.network	unknown	unknown	false		unknown
abs.twimg.com	unknown	unknown	false		unknown
abs-0.twimg.com	unknown	unknown	false		unknown
api.twitter.com	unknown	unknown	false		unknown
video.twimg.com	unknown	unknown	false		unknown
www.facebook.com	unknown	unknown	false		unknown
pbs.twimg.com	unknown	unknown	false		unknown
api.x.com	unknown	unknown	false		unknown
static.xx.fbcdn.net	unknown	unknown	false		unknown
analytics.google.com	unknown	unknown	false		unknown
js.stripe.com	unknown	unknown	false		unknown

Name	Malicious	Antivirus Detection	Reputation
https://blmphilly.com/wp-content/plugins/rightcause-core/inc/icons/linea-icons/assets/css/linea-icons.min.css?ver=6.6.2	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.Typeahead~loader.DMDrawer~bundle.Grok~bundle.MultiAccount~bundle.ReaderMode~bundle.Articles~bun.f39400ca.js	false	URL Reputation: safe	unknown
https://pbs.twimg.com/profile_images/1103023737987846146/_IVchC3A_normal.png	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.AudioSpacePeek~bundle.Compose~bundle.Conversation~bundle.DMRichTextCompose~bund.2433e2ba.js	false		unknown
https://cdn.plaid.com/link/v2/stable/link-initialize.js?_=1728166786818	false		unknown
https://abs.twimg.com/responsive-web/client-web/loader.NewTweetsPill.1180970a.js	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3ia_G4/yh/l/en_GB/OYJP0GLVdn8he8tBESRxOF8RjHNvxRH-76G_0LeVZpiD.js	false		unknown
https://blmphilly.com/wp-content/plugins/rightcause-core/assets/plugins/tweenmax/tweenmax.min.js?ver=6.6.2	false		unknown
https://api.x.com/graphql/dexO_2tohK86JDudXXG3Yw/UserMedia?variables=%7B%22userId%22%3A%223197896624%22%2C%22count%22%3A20%2C%22includePromotedContent%22%3Afalse%2C%22withClientEventToken%22%3Afalse%2C%22withBirdwatchNotes%22%3Afalse%2C%22withVoice%22%3Atrue%2C%22withV2Timeline%22%3Atrue%7D&features=%7B%22rweb_tipjar_consumption_enabled%22%3Atrue%2C%22responsive_web_graphql_exclude_directive_enabled%22%3Atrue%2C%22verified_phone_label_enabled%22%3Afalse%2C%22creator_subscriptions_tweet_preview_api_enabled%22%3Atrue%2C%22responsive_web_graphql_timeline_navigation_enabled%22%3Atrue%2C%22responsive_web_graphql_skip_user_profile_image_extensions_enabled%22%3Afalse%2C%22communities_web_enable_tweet_community_results_fetch%22%3Atrue%2C%22c9s_tweet_anatomy_moderator_badge_enabled%22%3Atrue%2C%22articles_preview_enabled%22%3Atrue%2C%22responsive_web_edit_tweet_api_enabled%22%3Atrue%2C%22graphql_is_translatable_rweb_tweet_is_translatable_enabled%22%3Atrue%2C%22view_counts_everywhere_api_enabled%22%3Atrue%2C%22longform_notetweets_consumption_enabled%22%3Atrue%2C%22responsive_web_twitter_article_tweet_consumption_enabled%22%3Atrue%2C%22tweet_awards_web_tipping_enabled%22%3Afalse%2C%22creator_subscriptions_quote_tweet_preview_enabled%22%3Afalse%2C%22freedom_of_speech_not_reach_fetch_enabled%22%3Atrue%2C%22standardized_nudges_misinfo%22%3Atrue%2C%22tweet_with_visibility_results_prefer_gql_limited_actions_policy_enabled%22%3Atrue%2C%22rweb_video_timestamps_enabled%22%3Atrue%2C%22longform_notetweets_rich_text_read_enabled%22%3Atrue%2C%22longform_notetweets_inline_media_enabled%22%3Atrue%2C%22responsive_web_enhance_cards_enabled%22%3Afalse%7D&fieldToggles=%7B%22withArticlePlainText%22%3Afalse%7D	false		unknown
https://blmphilly.com/wp-content/plugins/instagram-feed/img/placeholder.png	false		unknown
https://blmphilly.com/wp-content/themes/rightcause/assets/plugins/magnific-popup/jquery.magnific-popup.min.js?ver=6.6.2	false		unknown
https://scontent-msp1-1.xx.fbcdn.net/v/t1.6435-9/121248736_4006670256016799_7365345603446288383_n.png?stp=c76.0.788.788a_dst-png_s160x160&_nc_cat=105&ccb=1-7&_nc_sid=612081&_nc_ohc=O7mqM8cA4ZIQ7kNvgHqUcdw&_nc_ht=scontent-msp1-1.xx&_nc_gid=AqdpSSQieolQ7ZUS0zAVIfQ&oh=00_AYCSAgnViLKk2MIyk3ybG3WPxi1RyesKgWUVfTL1gZympA&oe=67293954	false		unknown
https://abs.twimg.com/responsive-web/client-web/ondemand.ProfileSidebar.2b5e5e2a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.Compose~bundle.Ocf~bundle.RichTextCompose.e5c7ed2a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.LiveEvent~bundle.Compose~bundle.DirectMessages~bundle.DMRichTextCompose~bundle..5b89ca6a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.WideLayout~loader.ProfileClusterFollow.d0bbc1ea.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.Bookmarks~bundle.Communities~bundle.TwitterArticles~bundle.DirectMessages~bundl.5455e27a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.ExtendedUserProfile~bundle.UserProfile.7c0c4f4a.js	false		unknown
https://blmphilly.com/wp-content/uploads/sb-instagram-feed-images/422088101_354354677530982_6573155456794811105_n.heiclow.jpg	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.Typeahead~ondemand.SettingsInternals~bundle.UserLists~loader.EventSummaryHandler~loader.topicHa.bbc1529a.js	false		unknown
https://scontent-msp1-1.xx.fbcdn.net/v/t39.30808-6/452890144_975487261043997_1893045910278925180_n.jpg?stp=dst-jpg_s600x600&_nc_cat=108&ccb=1-7&_nc_sid=127cfc&_nc_ohc=-UB7NpV0QQkQ7kNvgH-7zwg&_nc_ht=scontent-msp1-1.xx&_nc_gid=AmA2YPwnYIVCm-3UAZtFjxD&oh=00_AYCsCXAWQQhvOFW3HVC_hRqJQQlbRgMhDgP8yVCgwsyyxw&oe=67079295	false		unknown
https://x.com/x/migrate	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.AudioDock~loader.DashMenu~bundle.Account~bundle.ReaderMode~bundle.Articles~bundle.AudioSpacePee.8a7edc7a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.Typeahead~loader.DMDrawer~bundle.ReaderMode~bundle.AudioSpacePeek~bundle.Birdwatch~bundle.LiveE.d4c05fca.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.Articles~bundle.AudioSpaceDetail~bundle.AudioSpaceDiscovery~bundle.AudioSpacebarScreen~bundle.B.8d67843a.js	false		unknown
https://x.com/@BLMPhilly?mx=2	false		unknown
https://blmphilly.com/wp-content/plugins/rightcause-core/inc/icons/dripicons/assets/css/dripicons.min.css?ver=6.6.2	false		unknown
https://doublethedonation.com/api/js/ddplugin.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.Communities~bundle.SettingsProfessionalProfileProfileSpotlight~bundle.SettingsProfessionalProfi.20a474da.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.DirectMessages~bundle.LiveEvent~bundle.UserProfile~loader.TimelineRenderer.8137c55a.js	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3idBq4/yk/l/en_GB/UD1PwnXkH_D.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/bundle.NetworkInstrument.1004095a.js	false		unknown
https://blmphilly.com/wp-content/plugins/rightcause-core/inc/core-dashboard/assets/css/core-dashboard.min.css?ver=6.6.2	false		unknown
https://api.x.com/1.1/users/recommendations.json?include_profile_interstitial_type=1&include_blocking=1&include_blocked_by=1&include_followed_by=1&include_want_retweets=1&include_mute_edge=1&include_can_dm=1&include_can_media_tag=1&include_ext_is_blue_verified=1&include_ext_verified_type=1&include_ext_profile_image_shape=1&skip_status=1&&pc=true&display_location=profile_accounts_sidebar&limit=3&user_id=3197896624	false		unknown
https://blmphilly.com/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=6.4.3	false		unknown
https://blmphilly.com/wp-content/plugins/rightcause-core/inc/plugins/elementor/assets/css/elementor.min.css?ver=6.6.2	false		unknown
https://blmphilly.allyrafundraising.com/assets/premiums_paginator-d2750bff2087b851de40ca36b9e7055cf53861f11bf1aae7b62b9c8002714012.js	false		unknown
https://twitter.com/@BLMPhilly	false		unknown
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdvqkMpAAAAAE6ijiE3hz6E6QrDmFTb9YBjHVbi&co=aHR0cHM6Ly9ibG1waGlsbHkuYWxseXJhZnVuZHJhaXNpbmcuY29tOjQ0Mw..&hl=en&v=xds0rzGrktR88uEZ2JUvdgOY&size=normal&cb=xcobanp8gx9j	false		unknown
https://www.blmphilly.com/wp-content/uploads/2020/11/Cover6.png	false		unknown
https://blmphilly.allyrafundraising.com/assets/campaigns_common-b14f04488eac5402cee97f88cc815a1b6c3e05d11518eb671a408fa313ddd3c8.js	false		unknown
https://blmphilly.com/wp-content/uploads/sb-instagram-feed-images/436619165_2155840191431959_9149695789663656792_n.heiclow.jpg	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.SettingsProfile~bundle.UserProfile.6ba4be2a.js	false	URL Reputation: safe	unknown
https://blmphilly.com/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.2.12	false		unknown
https://cdn.plaid.com/link/v2/stable/link-initialize.js	false		unknown
https://blmphilly.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.9.7	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3iBAG4/yw/l/en_GB/fbI1vKnc9QM.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/loader.AudioOnlyVideoPlayer.f013ad8a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/loader.TimelineCardHandler.4010b5aa.js	false		unknown
https://blmphilly.allyrafundraising.com/assets/GothamHTF-BookItalic-95911915a73d8f08631c61dcfbb786398d4942c9bfc13e553f6bc1812f2b3b9e.otf	false		unknown
https://blmphilly.allyrafundraising.com/assets/application-b8793c3809526e7aba33166171df64c63393365975f38d11061d25320e9aac18.css	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.ReaderMode~bundle.Articles~bundle.AudioSpacePeek~bundle.AudioSpaceDetail~bundle.3b27748a.js	false		unknown
https://blmphilly.com/wp-content/uploads/2020/08/pencil-in-fist-hi-res-413x275.jpg	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.SettingsProfile~bundle.Ocf.d7cc349a.js	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/_at8rCNG77_.js	false		unknown
https://blmphilly.com/wp-content/uploads/2020/12/3-2-400x324.png	false		unknown
https://abs.twimg.com/responsive-web/client-web/ondemand.s.4243d62a.js	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://underscorejs.org	chromecache_448.2.dr, chromecache_685.2.dr	false	URL Reputation: safe	unknown
https://blmphilly.com/who-we-are/	chromecache_596.2.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.TimelineRenderer.	chromecache_765.2.dr, chromecache_761.2.dr	false		unknown
https://swiperjs.com	chromecache_436.2.dr	false	URL Reputation: safe	unknown
https://www.internalfb.com/intern/invariant/	chromecache_966.2.dr, chromecache_634.2.dr	false	URL Reputation: safe	unknown
https://blmphilly.com/wp-content/plugins/rightcause-core/inc/icons/linear-icons/assets/css/linear-ic	chromecache_596.2.dr	false		unknown
https://doublethedonation.com/matching-grant-resources/list-matching-gifts-companies/	chromecache_920.2.dr, chromecache_890.2.dr	false		unknown
https://www.instagram.com/p/C7xxwGAtiec/	chromecache_596.2.dr	false		unknown
https://youradchoices.ca/	chromecache_495.2.dr, chromecache_431.2.dr	false	URL Reputation: safe	unknown
https://support.google.com/recaptcha/#6175971	chromecache_480.2.dr, chromecache_734.2.dr, chromecache_408.2.dr	false	URL Reputation: safe	unknown
https://doublethedonation.com/api/360matchpro/v1/embed-script-heartbeat	chromecache_920.2.dr, chromecache_890.2.dr	false		unknown
https://stripe.com/ie	chromecache_588.2.dr	false		unknown
https://www.themepunch.com/support-center	chromecache_909.2.dr, chromecache_946.2.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.SignupModule.b618	chromecache_827.2.dr, chromecache_921.2.dr	false		unknown
http://www.datatables.net	chromecache_950.2.dr, chromecache_797.2.dr	false		unknown
https://support.google.com/recaptcha	chromecache_480.2.dr, chromecache_734.2.dr, chromecache_408.2.dr	false	URL Reputation: safe	unknown
https://scontent-lga3-1.cdninstagram.com/v/t51.29350-15/424529819_917451269967323_588211072150033930	chromecache_596.2.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/ondemand.ProfileSidebar.	chromecache_721.2.dr, chromecache_503.2.dr	false		unknown
https://doublethedonation.com/	chromecache_920.2.dr, chromecache_890.2.dr	false		unknown
https://stripe.com/in	chromecache_588.2.dr	false		unknown
https://qodeinteractive.com	chromecache_508.2.dr	false		unknown
https://b.stripecdn.com/mkt-statics-srv/assets/f965fdf4.woff2	chromecache_588.2.dr	false		unknown
https://stripe.com/it	chromecache_588.2.dr	false		unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_838.2.dr, chromecache_667.2.dr	false	URL Reputation: safe	unknown
https://support.doublethedonation.com/knowledge/plugin-error-messaging-issue-preventing-tool-from-di	chromecache_920.2.dr, chromecache_890.2.dr	false		unknown
https://fburl.com/wiki/xrzohrqb	chromecache_926.2.dr	false	URL Reputation: safe	unknown
https://blmphilly.com/wp-content/plugins/rightcause-core/assets/plugins/modernizr/modernizr.js?ver=6	chromecache_596.2.dr	false		unknown
https://stripe.com/jp	chromecache_588.2.dr	false		unknown
https://jqueryui.com	chromecache_640.2.dr, chromecache_570.2.dr	false	URL Reputation: safe	unknown
https://github.com/bas2k/jquery.appear/	chromecache_838.2.dr, chromecache_667.2.dr	false		unknown
http://tt.epicplay.com	chromecache_399.2.dr, chromecache_489.2.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.DividerHandler.f6	chromecache_848.2.dr, chromecache_729.2.dr	false		unknown
https://stripe.com/sv-fi	chromecache_588.2.dr	false		unknown
https://allyrafundraising.com	chromecache_399.2.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~loader.AppModules	chromecache_544.2.dr, chromecache_464.2.dr, chromecache_959.2.dr, chromecache_795.2.dr, chromecache_783.2.dr, chromecache_866.2.dr, chromecache_916.2.dr, chromecache_652.2.dr, chromecache_840.2.dr	false	URL Reputation: safe	unknown
https://x.com/i/broadcasts/$	chromecache_412.2.dr, chromecache_533.2.dr	false		unknown
https://blmphilly.com/galleries/	chromecache_596.2.dr	false		unknown
http://datatables.net/license	chromecache_950.2.dr, chromecache_797.2.dr	false		unknown
https://cloud.google.com/contact	chromecache_480.2.dr, chromecache_734.2.dr, chromecache_408.2.dr	false	URL Reputation: safe	unknown
http://davidstutz.de/bootstrap-multiselect/)	chromecache_950.2.dr, chromecache_797.2.dr	false		unknown
https://blmphilly.com/wp-content/plugins/rightcause-core/assets/plugins/perfect-scrollbar/perfect-sc	chromecache_596.2.dr	false		unknown
https://fontawesome.com/license/free	chromecache_507.2.dr	false	URL Reputation: safe	unknown
http://loading.retry.widdit.com/	chromecache_399.2.dr, chromecache_489.2.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	unknown	United States	15169	GOOGLEUS	false
52.216.142.46	unknown	United States	16509	AMAZON-02US	false
151.101.0.176	unknown	United States	54113	FASTLYUS	false
52.216.133.157	s3.amazonaws.com	United States	16509	AMAZON-02US	false
208.113.142.161	www.blmphilly.com	United States	26347	DREAMHOST-ASUS	false
146.75.52.159	twimg.twitter.map.fastly.net	Sweden	30051	SCCGOVUS	false
146.75.52.158	dualstack.video.twitter.map.fastly.net	Sweden	30051	SCCGOVUS	false
192.0.77.48	s.w.org	United States	2635	AUTOMATTICUS	false
66.102.1.156	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.244.43.131	abs-zero.twimg.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
157.240.26.27	scontent-msp1-1.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
151.101.66.217	cdn.ravenjs.com	United States	54113	FASTLYUS	false
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
104.244.42.130	tpop-api.twitter.com	United States	13414	TWITTERUS	false
54.186.23.98	r.stripe.com	United States	16509	AMAZON-02US	false
151.101.128.176	unknown	United States	54113	FASTLYUS	false
13.33.187.92	cdn.plaid.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	blmphilly.wedid.it	European Union	13335	CLOUDFLARENETUS	false
2.19.126.150	ucarecdn.com	European Union	16625	AKAMAI-ASUS	false
151.101.64.176	stripecdn.map.fastly.net	United States	54113	FASTLYUS	false
18.202.131.124	stripe.com	United States	16509	AMAZON-02US	false
151.101.192.176	unknown	United States	54113	FASTLYUS	false
172.217.18.100	unknown	United States	15169	GOOGLEUS	false
142.250.186.46	google.com	United States	15169	GOOGLEUS	false
216.58.206.34	td.doubleclick.net	United States	15169	GOOGLEUS	false
216.239.38.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
157.240.0.6	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
54.187.119.242	unknown	United States	16509	AMAZON-02US	false
13.33.187.40	unknown	United States	16509	AMAZON-02US	false
34.241.59.225	api.stripe.com	United States	16509	AMAZON-02US	false
20.172.164.4	doublethedonation.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.244.42.1	twitter.com	United States	13414	TWITTERUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
104.244.42.194	unknown	United States	13414	TWITTERUS	false
157.240.251.9	unknown	United States	32934	FACEBOOKUS	false
151.101.2.217	unknown	United States	54113	FASTLYUS	false
44.240.220.247	unknown	United States	16509	AMAZON-02US	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
157.240.253.1	unknown	United States	32934	FACEBOOKUS	false
172.67.70.81	unknown	United States	13335	CLOUDFLARENETUS	false
44.229.209.246	m.stripe.com	United States	16509	AMAZON-02US	false
104.26.2.230	blmphilly.allyrafundraising.com	United States	13335	CLOUDFLARENETUS	false
157.240.251.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
172.66.0.227	t.co	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526486
Start date and time:	2024-10-06 00:18:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://blmphilly.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@30/884@124/49
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://blmphilly.wedid.it/ Browse: https://www.facebook.com/blacklivesmatterphilly/ Browse: https://twitter.com/@BLMPhilly

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	9642
Entropy (8bit):	7.912106723285465
Encrypted:	false
SSDEEP:	192:73YNzJcU4Rzh1s7ibH0USNpok1M0n4dCrhUR0qWnf9YYpP6vZ/7Re5DIPRhGG:7oN2Uazns7+SNpEdMUqlVdpPAZ/IKRt
MD5:	63ADD1DBC22B27168EF398443022F444
SHA1:	C4C2822941AEC025F451FC201E426AB46AD64EEE
SHA-256:	5FB5BF695F326F59A7D28C97B21663E287E418E463100595D613AF8F8AC43E68
SHA-512:	E094D6F02DD2F3538587A0EC8238B736A345DBD26F20B3AF09F9D2FBE63379031C4C293062B337E6031B31BCCC899AD197E87371A6EB6FB91F2BC3A0D1557612
Malicious:	false
Reputation:	low
URL:	https://scontent-msp1-1.xx.fbcdn.net/v/t39.30808-6/315291061_505078951661766_549859257640458307_n.jpg?stp=dst-jpg_s160x160&_nc_cat=103&ccb=1-7&_nc_sid=09d16d&_nc_ohc=Cp9GY-0_UTMQ7kNvgEYGhST&_nc_ht=scontent-msp1-1.xx&_nc_gid=AqdpSSQieolQ7ZUS0zAVIfQ&oh=00_AYAk2FM1NuXuHmfbwPb2PtPpRLKqlNzjcKOw90rIVyeRAw&oe=67077D2E
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000480300007c0700005a080000110900004c100000a4170000271800004e1900000b1a0000aa250000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...............................................................................N...h..i.....'..=.....3!..D.oh..Y.c...[..10..^..w.t...A....L....^....{os@.m..{.K..a....N......N.....X.<....D..n.<...&..;%N.JU....:;>...euX.>....l.........Y<Z..Mz..1.) .uJ.J!&...t...x4....cO=a^....\..........x...PE.T.b\|bI,$m...T-.1t...g.4..0_...>.t...nAl...,\H..D...7b....# .$.!...])..o/..8N..#.$.><.5-#e.. .=]..F.Z.W.B...\|O..>.7....;Wn/.1........wN....F.x.....+..Y.pi=c....e.]hZR..0>..WgB.O.a.O...).............................!.."1#$A20..................z.%g...{.B..S.E.R..z..7.........h..HU.Yj.jZ.u2..E.i.V....zZ....};v.j..R...d.v........u..o.i.Z......uH..<.../E.f./xjU.uu.^.....q.I.....g

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 00:19:22.375096083 CEST	192.168.2.4	1.1.1.1	0xa4c7	Standard query (0)	blmphilly.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:22.375402927 CEST	192.168.2.4	1.1.1.1	0x526a	Standard query (0)	blmphilly.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:23.486543894 CEST	192.168.2.4	1.1.1.1	0xf234	Standard query (0)	www.blmphilly.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:23.486746073 CEST	192.168.2.4	1.1.1.1	0xac89	Standard query (0)	www.blmphilly.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:24.645071983 CEST	192.168.2.4	1.1.1.1	0x9c28	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:24.645240068 CEST	192.168.2.4	1.1.1.1	0x94fa	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:25.817008018 CEST	192.168.2.4	1.1.1.1	0x82b7	Standard query (0)	www.blmphilly.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:25.817497015 CEST	192.168.2.4	1.1.1.1	0xf8cf	Standard query (0)	www.blmphilly.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:28.037728071 CEST	192.168.2.4	1.1.1.1	0x2191	Standard query (0)	blmphilly.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:28.038167000 CEST	192.168.2.4	1.1.1.1	0x5827	Standard query (0)	blmphilly.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:38.452327967 CEST	192.168.2.4	1.1.1.1	0xc5e1	Standard query (0)	s.w.org	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:38.452964067 CEST	192.168.2.4	1.1.1.1	0x7452	Standard query (0)	s.w.org	65	IN (0x0001)	false
Oct 6, 2024 00:19:39.595716000 CEST	192.168.2.4	1.1.1.1	0x5cbe	Standard query (0)	s.w.org	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:39.596389055 CEST	192.168.2.4	1.1.1.1	0xcfbc	Standard query (0)	s.w.org	65	IN (0x0001)	false
Oct 6, 2024 00:19:42.856853008 CEST	192.168.2.4	1.1.1.1	0xef4	Standard query (0)	blmphilly.wedid.it	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:42.857157946 CEST	192.168.2.4	1.1.1.1	0xc792	Standard query (0)	blmphilly.wedid.it	65	IN (0x0001)	false
Oct 6, 2024 00:19:44.658920050 CEST	192.168.2.4	1.1.1.1	0xe73a	Standard query (0)	blmphilly.allyrafundraising.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:44.659142017 CEST	192.168.2.4	1.1.1.1	0x3f94	Standard query (0)	blmphilly.allyrafundraising.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:45.513029099 CEST	192.168.2.4	1.1.1.1	0x6f7c	Standard query (0)	cdn.ravenjs.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:45.513186932 CEST	192.168.2.4	1.1.1.1	0xd000	Standard query (0)	cdn.ravenjs.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:45.562634945 CEST	192.168.2.4	1.1.1.1	0xcd48	Standard query (0)	doublethedonation.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:45.563471079 CEST	192.168.2.4	1.1.1.1	0xc986	Standard query (0)	doublethedonation.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:45.567349911 CEST	192.168.2.4	1.1.1.1	0xdc10	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:45.567563057 CEST	192.168.2.4	1.1.1.1	0x4afe	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:45.645251036 CEST	192.168.2.4	1.1.1.1	0x595e	Standard query (0)	ucarecdn.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:45.645448923 CEST	192.168.2.4	1.1.1.1	0x8377	Standard query (0)	ucarecdn.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:46.355962038 CEST	192.168.2.4	1.1.1.1	0x8fa2	Standard query (0)	cdn.ravenjs.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:46.356120110 CEST	192.168.2.4	1.1.1.1	0x57ba	Standard query (0)	cdn.ravenjs.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:46.500708103 CEST	192.168.2.4	1.1.1.1	0x4d54	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:46.501039982 CEST	192.168.2.4	1.1.1.1	0x16fe	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:47.163639069 CEST	192.168.2.4	1.1.1.1	0xee29	Standard query (0)	doublethedonation.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:47.163896084 CEST	192.168.2.4	1.1.1.1	0xc456	Standard query (0)	doublethedonation.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:47.165183067 CEST	192.168.2.4	1.1.1.1	0xbb19	Standard query (0)	blmphilly.allyrafundraising.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:47.165349960 CEST	192.168.2.4	1.1.1.1	0x83f6	Standard query (0)	blmphilly.allyrafundraising.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:47.259742975 CEST	192.168.2.4	1.1.1.1	0x135c	Standard query (0)	cdn.plaid.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:47.261981964 CEST	192.168.2.4	1.1.1.1	0x539a	Standard query (0)	cdn.plaid.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:47.263853073 CEST	192.168.2.4	1.1.1.1	0x3625	Standard query (0)	ucarecdn.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:47.264010906 CEST	192.168.2.4	1.1.1.1	0xb3b1	Standard query (0)	ucarecdn.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:47.934427023 CEST	192.168.2.4	1.1.1.1	0x93d1	Standard query (0)	js.stripe.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:47.935026884 CEST	192.168.2.4	1.1.1.1	0x8b9f	Standard query (0)	js.stripe.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:50.921379089 CEST	192.168.2.4	1.1.1.1	0xcde8	Standard query (0)	js.stripe.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:50.921519995 CEST	192.168.2.4	1.1.1.1	0x24d0	Standard query (0)	js.stripe.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:50.923295975 CEST	192.168.2.4	1.1.1.1	0x55d9	Standard query (0)	s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:50.923425913 CEST	192.168.2.4	1.1.1.1	0x62f5	Standard query (0)	s3.amazonaws.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:51.608360052 CEST	192.168.2.4	1.1.1.1	0x9cb2	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:51.608689070 CEST	192.168.2.4	1.1.1.1	0xcf6f	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:51.609925985 CEST	192.168.2.4	1.1.1.1	0xe8dc	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:51.610305071 CEST	192.168.2.4	1.1.1.1	0x2772	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Oct 6, 2024 00:19:52.407016993 CEST	192.168.2.4	1.1.1.1	0xc53e	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:52.407532930 CEST	192.168.2.4	1.1.1.1	0xf635	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Oct 6, 2024 00:19:52.505263090 CEST	192.168.2.4	1.1.1.1	0x7da7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:52.506257057 CEST	192.168.2.4	1.1.1.1	0x1bf9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:53.886342049 CEST	192.168.2.4	1.1.1.1	0x424b	Standard query (0)	cdn.plaid.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:53.886710882 CEST	192.168.2.4	1.1.1.1	0x2b3d	Standard query (0)	cdn.plaid.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:53.966989994 CEST	192.168.2.4	1.1.1.1	0x1747	Standard query (0)	api.stripe.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:53.968099117 CEST	192.168.2.4	1.1.1.1	0xdebb	Standard query (0)	api.stripe.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:55.078571081 CEST	192.168.2.4	1.1.1.1	0xf987	Standard query (0)	js.stripe.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:55.078774929 CEST	192.168.2.4	1.1.1.1	0x4273	Standard query (0)	js.stripe.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:55.237303019 CEST	192.168.2.4	1.1.1.1	0x2ae8	Standard query (0)	s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:55.237658024 CEST	192.168.2.4	1.1.1.1	0x8e05	Standard query (0)	s3.amazonaws.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:56.752281904 CEST	192.168.2.4	1.1.1.1	0xca58	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:56.752281904 CEST	192.168.2.4	1.1.1.1	0x634c	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:57.708307981 CEST	192.168.2.4	1.1.1.1	0x6c15	Standard query (0)	r.stripe.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:57.708517075 CEST	192.168.2.4	1.1.1.1	0x9ce4	Standard query (0)	r.stripe.com	65	IN (0x0001)	false
Oct 6, 2024 00:19:59.887645006 CEST	192.168.2.4	1.1.1.1	0x9fdd	Standard query (0)	m.stripe.network	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:19:59.888396025 CEST	192.168.2.4	1.1.1.1	0x4136	Standard query (0)	m.stripe.network	65	IN (0x0001)	false
Oct 6, 2024 00:20:00.097294092 CEST	192.168.2.4	1.1.1.1	0x3133	Standard query (0)	r.stripe.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:00.097682953 CEST	192.168.2.4	1.1.1.1	0x9d53	Standard query (0)	r.stripe.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:02.246102095 CEST	192.168.2.4	1.1.1.1	0x8ca3	Standard query (0)	m.stripe.network	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:02.246464968 CEST	192.168.2.4	1.1.1.1	0x39f5	Standard query (0)	m.stripe.network	65	IN (0x0001)	false
Oct 6, 2024 00:20:04.048525095 CEST	192.168.2.4	1.1.1.1	0xea02	Standard query (0)	m.stripe.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:04.048959970 CEST	192.168.2.4	1.1.1.1	0x4ee7	Standard query (0)	m.stripe.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:05.124865055 CEST	192.168.2.4	1.1.1.1	0x685e	Standard query (0)	m.stripe.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:05.125044107 CEST	192.168.2.4	1.1.1.1	0x300c	Standard query (0)	m.stripe.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:05.261208057 CEST	192.168.2.4	1.1.1.1	0x7bd9	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:05.261430025 CEST	192.168.2.4	1.1.1.1	0x8cfb	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:06.081188917 CEST	192.168.2.4	1.1.1.1	0xb452	Standard query (0)	stripe.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:06.081382036 CEST	192.168.2.4	1.1.1.1	0x88fd	Standard query (0)	stripe.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:06.666855097 CEST	192.168.2.4	1.1.1.1	0xff60	Standard query (0)	scontent.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:06.667047024 CEST	192.168.2.4	1.1.1.1	0xf78e	Standard query (0)	scontent.xx.fbcdn.net	65	IN (0x0001)	false
Oct 6, 2024 00:20:06.667439938 CEST	192.168.2.4	1.1.1.1	0xd886	Standard query (0)	video.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:06.668248892 CEST	192.168.2.4	1.1.1.1	0x7ed0	Standard query (0)	video.xx.fbcdn.net	65	IN (0x0001)	false
Oct 6, 2024 00:20:06.682599068 CEST	192.168.2.4	1.1.1.1	0x8a85	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:06.683002949 CEST	192.168.2.4	1.1.1.1	0x22d2	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Oct 6, 2024 00:20:06.928339958 CEST	192.168.2.4	1.1.1.1	0x6dcb	Standard query (0)	scontent-msp1-1.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:06.928500891 CEST	192.168.2.4	1.1.1.1	0xfdcb	Standard query (0)	scontent-msp1-1.xx.fbcdn.net	65	IN (0x0001)	false
Oct 6, 2024 00:20:08.988805056 CEST	192.168.2.4	1.1.1.1	0xd3e0	Standard query (0)	scontent-msp1-1.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:08.988940954 CEST	192.168.2.4	1.1.1.1	0x69a9	Standard query (0)	scontent-msp1-1.xx.fbcdn.net	65	IN (0x0001)	false
Oct 6, 2024 00:20:08.999275923 CEST	192.168.2.4	1.1.1.1	0x6212	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:08.999794960 CEST	192.168.2.4	1.1.1.1	0x1261	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Oct 6, 2024 00:20:17.587150097 CEST	192.168.2.4	1.1.1.1	0xa26	Standard query (0)	twitter.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:17.587150097 CEST	192.168.2.4	1.1.1.1	0xa9fd	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:18.789397955 CEST	192.168.2.4	1.1.1.1	0xc7f1	Standard query (0)	x.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:18.789968014 CEST	192.168.2.4	1.1.1.1	0x55b7	Standard query (0)	x.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:20.001827002 CEST	192.168.2.4	1.1.1.1	0xe707	Standard query (0)	abs.twimg.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:20.002361059 CEST	192.168.2.4	1.1.1.1	0x467f	Standard query (0)	abs.twimg.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:20.006417990 CEST	192.168.2.4	1.1.1.1	0xd495	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:20.006897926 CEST	192.168.2.4	1.1.1.1	0x5786	Standard query (0)	t.co	65	IN (0x0001)	false
Oct 6, 2024 00:20:20.017119884 CEST	192.168.2.4	1.1.1.1	0xe5a2	Standard query (0)	pbs.twimg.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:20.017535925 CEST	192.168.2.4	1.1.1.1	0x3917	Standard query (0)	pbs.twimg.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:20.021095991 CEST	192.168.2.4	1.1.1.1	0x75b5	Standard query (0)	api.x.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:20.021630049 CEST	192.168.2.4	1.1.1.1	0x1a2e	Standard query (0)	api.x.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:20.078723907 CEST	192.168.2.4	1.1.1.1	0x763e	Standard query (0)	api.twitter.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:20.082535028 CEST	192.168.2.4	1.1.1.1	0xe0be	Standard query (0)	api.twitter.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:21.890579939 CEST	192.168.2.4	1.1.1.1	0x4374	Standard query (0)	video.twimg.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:21.891093969 CEST	192.168.2.4	1.1.1.1	0xf365	Standard query (0)	video.twimg.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:21.904402018 CEST	192.168.2.4	1.1.1.1	0xf274	Standard query (0)	abs-0.twimg.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:21.904612064 CEST	192.168.2.4	1.1.1.1	0x8e93	Standard query (0)	abs-0.twimg.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:22.853019953 CEST	192.168.2.4	1.1.1.1	0xafda	Standard query (0)	abs-0.twimg.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:22.853976011 CEST	192.168.2.4	1.1.1.1	0xc6e3	Standard query (0)	abs-0.twimg.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:24.015362024 CEST	192.168.2.4	1.1.1.1	0x5eb7	Standard query (0)	abs.twimg.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:24.015686035 CEST	192.168.2.4	1.1.1.1	0xbe63	Standard query (0)	abs.twimg.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:27.701524973 CEST	192.168.2.4	1.1.1.1	0x4a7d	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:27.701817989 CEST	192.168.2.4	1.1.1.1	0x87cd	Standard query (0)	google.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:28.519776106 CEST	192.168.2.4	1.1.1.1	0xe8c9	Standard query (0)	api.x.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:28.520023108 CEST	192.168.2.4	1.1.1.1	0xbc6e	Standard query (0)	api.x.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:28.653876066 CEST	192.168.2.4	1.1.1.1	0x2b53	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:28.654042959 CEST	192.168.2.4	1.1.1.1	0xe2b6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:44.487416029 CEST	192.168.2.4	1.1.1.1	0x70d5	Standard query (0)	pbs.twimg.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:44.487715006 CEST	192.168.2.4	1.1.1.1	0x9024	Standard query (0)	pbs.twimg.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:57.265049934 CEST	192.168.2.4	1.1.1.1	0x9ddd	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:57.265173912 CEST	192.168.2.4	1.1.1.1	0x9055	Standard query (0)	twitter.com	65	IN (0x0001)	false
Oct 6, 2024 00:20:58.061912060 CEST	192.168.2.4	1.1.1.1	0x4b01	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 00:20:58.062084913 CEST	192.168.2.4	1.1.1.1	0x507a	Standard query (0)	twitter.com	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:23 UTC	656	OUT	GET / HTTP/1.1 Host: blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:23 UTC	730	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Link: <https://blmphilly.com/wp-json/>; rel="https://api.w.org/" Link: <https://blmphilly.com/wp-json/wp/v2/pages/9>; rel="alternate"; title="JSON"; type="application/json" Link: <https://blmphilly.com/>; rel=shortlink X-Cache-Status: HIT X-Rocket-Nginx-Serving-Static: MISS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;
2024-10-05 22:19:23 UTC	15654	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 79 65 73 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 0a 09 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes"><link rel="profile" href="https://gmpg.org/xfn/11"><link rel="apple-touch-icon" sizes=
2024-10-05 22:19:23 UTC	16384	IN	Data Raw: 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 63 79 61 6e 2d 62 6c 75 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 63 79 61 6e 2d 62 6c 75 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 63 79 61 6e 2d 62 6c 75 65 2d 62 Data Ascii: !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-b
2024-10-05 22:19:23 UTC	16384	IN	Data Raw: 6f 64 75 63 74 2d 69 6e 6e 65 72 3a 68 6f 76 65 72 20 2e 71 6f 64 65 66 2d 77 6f 6f 2d 70 72 6f 64 75 63 74 2d 74 69 74 6c 65 2c 20 2e 77 69 64 67 65 74 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 62 75 74 74 6f 6e 2c 20 2e 77 69 64 67 65 74 2e 77 69 64 67 65 74 5f 6c 61 79 65 72 65 64 5f 6e 61 76 20 75 6c 20 6c 69 2e 63 68 6f 73 65 6e 20 61 2c 20 2e 77 69 64 67 65 74 2e 77 69 64 67 65 74 5f 70 72 6f 64 75 63 74 5f 74 61 67 5f 63 6c 6f 75 64 20 2e 74 61 67 63 6c 6f 75 64 20 61 3a 68 6f 76 65 72 2c 20 2e 77 69 64 67 65 74 2e 77 69 64 67 65 74 5f 70 72 6f 64 75 63 74 73 20 2e 71 6f 64 65 66 2d 77 6f 6f 2d 70 72 6f 64 75 63 74 2d 74 69 74 6c 65 20 61 3a 68 6f 76 65 72 2c 20 2e 77 69 64 67 65 74 2e 77 69 64 67 65 74 5f 72 65 63 65 6e 74 6c 79 5f 76 69 65 77 65 Data Ascii: oduct-inner:hover .qodef-woo-product-title, .widget.woocommerce .button, .widget.widget_layered_nav ul li.chosen a, .widget.widget_product_tag_cloud .tagcloud a:hover, .widget.widget_products .qodef-woo-product-title a:hover, .widget.widget_recently_viewe
2024-10-05 22:19:23 UTC	16384	IN	Data Raw: 64 65 66 69 6e 65 64 20 3f 20 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 48 65 69 67 68 74 20 3a 20 77 69 6e 64 6f 77 2e 52 53 49 48 3b 09 0a 09 09 09 09 74 72 79 20 7b 09 09 09 09 09 09 09 09 0a 09 09 09 09 09 76 61 72 20 70 77 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 2e 63 29 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 0a 09 09 09 09 09 09 6e 65 77 68 3b 0a 09 09 09 09 09 70 77 20 3d 20 70 77 3d 3d 3d 30 20 7c 7c 20 69 73 4e 61 4e 28 70 77 29 20 3f 20 77 69 6e 64 6f 77 2e 52 53 49 57 20 3a 20 70 77 3b 0a 09 09 09 09 09 65 2e 74 61 62 77 20 3d 20 65 2e 74 61 62 77 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 20 3f 20 30 20 3a 20 70 61 72 73 65 49 6e 74 28 65 2e 74 61 62 77 29 3b 0a 09 09 09 09 09 65 Data Ascii: defined ? window.innerHeight : window.RSIH;try {var pw = document.getElementById(e.c).parentNode.offsetWidth,newh;pw = pw===0 \|\| isNaN(pw) ? window.RSIW : pw;e.tabw = e.tabw===undefined ? 0 : parseInt(e.tabw);e
2024-10-05 22:19:23 UTC	16384	IN	Data Raw: 6e 22 20 64 61 74 61 2d 73 65 74 74 69 6e 67 73 3d 22 7b 26 71 75 6f 74 3b 62 61 63 6b 67 72 6f 75 6e 64 5f 62 61 63 6b 67 72 6f 75 6e 64 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 63 6c 61 73 73 69 63 26 71 75 6f 74 3b 7d 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 6c 65 6d 65 6e 74 6f 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6e 74 61 69 6e 65 72 20 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6c 75 6d 6e 2d 67 61 70 2d 64 65 66 61 75 6c 74 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6c 75 6d 6e 20 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6c 2d 33 33 20 65 6c Data Ascii: n" data-settings="{"background_background":"classic"}"><div class="elementor-background-overlay"></div><div class="elementor-container elementor-column-gap-default"><div class="elementor-column elementor-col-33 el
2024-10-05 22:19:23 UTC	16384	IN	Data Raw: 75 6f 74 3b 3a 26 71 75 6f 74 3b 66 61 64 65 49 6e 55 70 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 5f 61 6e 69 6d 61 74 69 6f 6e 5f 64 65 6c 61 79 26 71 75 6f 74 3b 3a 33 30 30 7d 22 20 64 61 74 61 2d 77 69 64 67 65 74 5f 74 79 70 65 3d 22 72 69 67 68 74 63 61 75 73 65 5f 63 6f 72 65 5f 69 6d 61 67 65 5f 77 69 74 68 5f 74 65 78 74 2e 64 65 66 61 75 6c 74 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 6c 65 6d 65 6e 74 6f 72 2d 77 69 64 67 65 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 71 6f 64 65 66 2d 73 68 6f 72 74 63 6f 64 65 20 71 6f 64 65 66 2d 6d 20 20 71 6f 64 65 66 2d 69 6d 61 67 65 2d 77 69 74 68 2d 74 65 78 74 20 71 6f 64 65 66 2d 6c 61 79 6f 75 74 2d 2d 74 65 78 74 2d 62 65 6c 6f 77 20 22 3e Data Ascii: uot;:"fadeInUp","_animation_delay":300}" data-widget_type="rightcause_core_image_with_text.default"><div class="elementor-widget-container"><div class="qodef-shortcode qodef-m qodef-image-with-text qodef-layout--text-below ">
2024-10-05 22:19:23 UTC	16384	IN	Data Raw: 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 66 6f 6c 6c 6f 77 22 20 64 61 74 61 2d 66 75 6c 6c 2d 72 65 73 3d 22 68 74 74 70 73 3a 2f 2f 73 63 6f 6e 74 65 6e 74 2d 6c 67 61 33 2d 31 2e 63 64 6e 69 6e 73 74 61 67 72 61 6d 2e 63 6f 6d 2f 76 2f 74 35 31 2e 32 39 33 35 30 2d 31 35 2f 34 32 32 30 38 38 31 30 31 5f 33 35 34 33 35 34 36 37 37 35 33 30 39 38 32 5f 36 35 37 33 31 35 35 34 35 36 37 39 34 38 31 31 31 30 35 5f 6e 2e 68 65 69 63 3f 73 74 70 3d 64 73 74 2d 6a 70 67 26 23 30 33 38 3b 5f 6e 63 5f 63 61 74 3d 31 30 36 26 23 30 33 38 3b 63 63 62 3d 31 2d 37 26 23 30 33 38 3b 5f 6e 63 5f 73 69 64 3d 31 38 64 65 37 34 26 23 30 33 38 3b 5f 6e 63 5f 6f 68 63 3d 6d 34 62 65 6e 51 6e 77 31 67 51 51 37 6b Data Ascii: " target="_blank" rel="noopener nofollow" data-full-res="https://scontent-lga3-1.cdninstagram.com/v/t51.29350-15/422088101_354354677530982_6573155456794811105_n.heic?stp=dst-jpg&_nc_cat=106&ccb=1-7&_nc_sid=18de74&_nc_ohc=m4benQnw1gQQ7k
2024-10-05 22:19:23 UTC	10197	IN	Data Raw: 3a 2f 2f 62 6c 6d 70 68 69 6c 6c 79 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 61 64 6d 69 6e 2d 61 6a 61 78 2e 70 68 70 22 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 0a 09 09 09 09 63 6f 6e 73 74 20 6c 61 7a 79 6c 6f 61 64 52 75 6e 4f 62 73 65 72 76 65 72 20 3d 20 28 29 20 3d 3e 20 7b 0a 09 09 09 09 09 63 6f 6e 73 74 20 6c 61 7a 79 6c 6f 61 64 42 61 63 6b 67 72 6f 75 6e 64 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 20 60 2e 65 2d 63 6f 6e 2e 65 2d 70 61 72 65 6e 74 3a 6e 6f 74 28 2e 65 2d 6c 61 7a 79 6c 6f 61 64 65 64 29 60 20 29 3b 0a 09 09 09 09 09 63 6f 6e 73 74 20 6c 61 7a 79 6c 6f 61 64 42 61 63 6b 67 72 Data Ascii: ://blmphilly.com/wp-admin/admin-ajax.php";</script><script type='text/javascript'>const lazyloadRunObserver = () => {const lazyloadBackgrounds = document.querySelectorAll( `.e-con.e-parent:not(.e-lazyloaded)` );const lazyloadBackgr

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://blmphilly.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 397

Chrome Cache Entry: 398

Chrome Cache Entry: 399

Chrome Cache Entry: 400

Chrome Cache Entry: 401

Chrome Cache Entry: 402

Chrome Cache Entry: 403

Chrome Cache Entry: 404

Chrome Cache Entry: 405

Chrome Cache Entry: 406

Chrome Cache Entry: 407

Chrome Cache Entry: 408

Chrome Cache Entry: 409

Chrome Cache Entry: 410

Chrome Cache Entry: 412

Chrome Cache Entry: 413

Chrome Cache Entry: 414

Chrome Cache Entry: 415

Chrome Cache Entry: 416

Chrome Cache Entry: 417

Chrome Cache Entry: 418

Chrome Cache Entry: 419

Chrome Cache Entry: 420

Chrome Cache Entry: 421

Chrome Cache Entry: 422

Windows Analysis Report
https://blmphilly.com/

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:23 UTC	618	OUT	GET /wp-content/plugins/rightcause-core/inc/icons/dripicons/assets/css/dripicons.min.css?ver=6.6.2 HTTP/1.1 Host: blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://blmphilly.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:23 UTC	630	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:23 GMT Content-Type: text/css Content-Length: 9130 Last-Modified: Sat, 29 Aug 2020 19:04:11 GMT Connection: close Vary: Accept-Encoding ETag: "5f4aa6ab-23aa" Expires: Mon, 04 Nov 2024 22:19:23 GMT Cache-Control: max-age=2592000 X-Rocket-Nginx-Serving-Static: BYPASS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; Accept-Ranges: bytes
2024-10-05 22:19:23 UTC	9130	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 5b 63 6c 61 73 73 2a 3d 22 20 64 72 69 70 69 63 6f 6e 73 2d 22 5d 3a 62 65 66 6f 72 65 2c 5b 63 6c 61 73 73 5e 3d 64 72 69 70 69 63 6f 6e 73 2d 5d 3a 62 65 66 6f 72 65 2c 5b 64 61 74 61 2d 69 63 6f 6e 5d 3a 62 65 66 6f 72 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 64 72 69 70 69 63 6f 6e 73 2d 76 32 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 3a 6e 6f 72 6d 61 6c 21 69 6d 70 6f 72 74 61 6e 74 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 3b 73 70 65 61 6b 3a 6e 6f 6e 65 3b 6c 69 Data Ascii: @charset "UTF-8";[class*=" dripicons-"]:before,[class^=dripicons-]:before,[data-icon]:before{font-family:dripicons-v2!important;font-style:normal!important;font-weight:400!important;font-variant:normal!important;text-transform:none!important;speak:none;li

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:23 UTC	626	OUT	GET /wp-content/plugins/rightcause-core/inc/icons/elegant-icons/assets/css/elegant-icons.min.css?ver=6.6.2 HTTP/1.1 Host: blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://blmphilly.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:24 UTC	631	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:24 GMT Content-Type: text/css Content-Length: 22518 Last-Modified: Sat, 29 Aug 2020 19:04:12 GMT Connection: close Vary: Accept-Encoding ETag: "5f4aa6ac-57f6" Expires: Mon, 04 Nov 2024 22:19:24 GMT Cache-Control: max-age=2592000 X-Rocket-Nginx-Serving-Static: BYPASS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; Accept-Ranges: bytes
2024-10-05 22:19:24 UTC	15753	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 45 6c 65 67 61 6e 74 49 63 6f 6e 73 27 3b 73 72 63 3a 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 45 6c 65 67 61 6e 74 49 63 6f 6e 73 2e 65 6f 74 27 29 3b 73 72 63 3a 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 45 6c 65 67 61 6e 74 49 63 6f 6e 73 2e 65 6f 74 3f 23 69 65 66 69 78 27 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 45 6c 65 67 61 6e 74 49 63 6f 6e 73 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 45 6c 65 67 61 6e 74 49 63 6f 6e 73 2e 74 74 66 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 75 72 6c 28 27 2e 2e Data Ascii: @font-face{font-family:'ElegantIcons';src:url('../fonts/ElegantIcons.eot');src:url('../fonts/ElegantIcons.eot?#iefix') format('embedded-opentype'),url('../fonts/ElegantIcons.woff') format('woff'),url('../fonts/ElegantIcons.ttf') format('truetype'),url('..
2024-10-05 22:19:24 UTC	6765	IN	Data Raw: 74 65 6e 74 3a 22 5c 65 30 37 35 22 7d 20 20 2e 69 63 6f 6e 5f 6d 61 69 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 36 22 7d 20 20 2e 69 63 6f 6e 5f 63 6f 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 37 22 7d 20 20 2e 69 63 6f 6e 5f 72 69 62 62 6f 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 38 22 7d 20 20 2e 69 63 6f 6e 5f 62 61 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 39 22 7d 20 20 2e 69 63 6f 6e 5f 63 61 72 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 61 22 7d 20 20 2e 69 63 6f 6e 5f 74 61 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 62 22 7d 20 20 2e 69 63 6f 6e 5f 74 61 67 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e Data Ascii: tent:"\e075"} .icon_mail:before{content:"\e076"} .icon_cone:before{content:"\e077"} .icon_ribbon:before{content:"\e078"} .icon_bag:before{content:"\e079"} .icon_cart:before{content:"\e07a"} .icon_tag:before{content:"\e07b"} .icon_tags:before{conten

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:24 UTC	610	OUT	GET /wp-content/uploads/2020/11/Cover6.png HTTP/1.1 Host: www.blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://blmphilly.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:24 UTC	609	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:24 GMT Content-Type: image/png Content-Length: 855708 Last-Modified: Mon, 30 Nov 2020 10:05:05 GMT Connection: close ETag: "5fc4c3d1-d0e9c" Expires: Mon, 04 Nov 2024 22:19:24 GMT Cache-Control: max-age=2592000 X-Rocket-Nginx-Serving-Static: MISS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; Accept-Ranges: bytes
2024-10-05 22:19:24 UTC	15775	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 31 00 00 03 27 08 06 00 00 00 cf 97 03 c6 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 40 00 49 44 41 54 78 01 ec bd d9 96 24 c9 91 a6 67 b1 2f b9 d4 0e a0 1b dd 3d 43 0e cf f0 0c e7 b0 79 c5 0b f2 96 97 bc e2 8b 72 f8 28 cd a5 37 a0 81 02 1a 55 a8 2d b3 72 8d 7d e3 f7 fd 62 ea ae ee e1 1e 11 1e 99 51 55 c0 b4 46 98 9b 9a aa a8 a8 88 a8 98 8a 98 2e 66 6b ff e5 ff 79 79 35 74 e1 ea 92 cb ab 99 a4 2e 77 71 f4 6a 01 fc da da da 35 e0 99 b4 f5 eb f9 d7 0a bc 6b 82 bc bc 43 98 a1 b7 c3 33 9f 3e cf ff 7c 7e 57 74 30 6f 1e 7e 3e bf bf 6e f1 8d 8e 95 65 f8 fb 74 eb e8 eb e9 f3 1a 4e cf 7d fa e5 d5 c5 40 a9 3e fb bd c7 6d f5 35 fe 56 09 d2 d8 d3 Data Ascii: PNGIHDR1'sRGBpHYs@IDATx$g/=Cyr(7U-r}bQUF.fkyy5t.wqj5kC3>\|~Wt0o~>netN}@>m5V
2024-10-05 22:19:24 UTC	16384	IN	Data Raw: 5f 15 37 2f a1 03 e8 f3 2b b3 fd da a8 f3 81 82 f9 9f 22 a8 58 83 b5 6d 0d d3 6b 0b 5c d7 db 79 bc f3 d7 94 e7 be 0f 6d de 23 c1 47 4d c4 6b 21 ae b5 72 c8 8f a0 1c 6e 24 a4 59 d9 0c c0 74 4e ee 07 5a da 7b 8f 90 69 3c 46 4a 2e 68 d3 23 16 e5 a2 69 39 9a 3c 74 6c f3 65 70 d1 a1 87 22 45 0d aa 29 ac 23 ff f2 51 8e b5 ef 3f f2 5e dd e5 ad d4 4e 2b e9 f0 d4 c6 05 8a a6 1d ed 83 16 39 31 52 7a ed 66 95 c4 f7 14 20 54 21 b5 20 83 0a b1 31 da d2 db 79 59 7a cb bf f9 ec 4d a0 32 de 0c f5 5f 53 ee 42 79 46 49 ab 43 48 f3 ac 28 90 d9 db 99 c2 ca 7b 54 c8 6b a8 ee d1 16 d2 74 9f 30 92 51 77 89 3a 06 92 76 dc 07 df c2 32 93 4a cc 1d 3b 12 2b 99 49 27 67 e4 7b 9e 97 6b b2 9b 54 d2 70 15 c5 35 27 5e 99 23 2a 6b cb 7d b3 b8 83 1c 8d 98 4f aa dc cf 76 28 09 de 0c 1c fd Data Ascii: _7/+"Xmk\ym#GMk!rn$YtNZ{i<FJ.h#i9<tlep"E)#Q?^N+91Rzf T! 1yYzM2_SByFICH({Tkt0Qw:v2J;+I'g{kTp5'^#*k}Ov(
2024-10-05 22:19:24 UTC	16384	IN	Data Raw: bd 77 0b 1d 17 fd c3 e8 9c ce 45 88 ca c3 72 3d c7 cd 71 00 a8 fa 12 1a 2c dc f7 70 ae 77 82 c2 b2 de 77 67 88 0e 35 23 d7 79 9f 6c 47 2d d9 1a 35 ac c5 74 6a 08 28 96 e3 f3 fc 19 c0 05 d1 e3 e1 3e bb 62 77 b6 a3 9d 6b 99 b8 01 a7 ac 4d df c5 8a 4c c8 92 0f 9b 4d ba cb dd 30 bf 79 ec 3c ef a4 04 b2 83 07 a5 e3 83 eb 98 bd 8d 57 f1 dc 3f e9 5d fe d6 ca 4e df a6 00 f9 b9 77 31 68 18 e0 c6 91 3a 4d 7e 54 8d 5b 16 5d c4 47 c5 a5 72 e4 50 bf ee 5c cd d7 a7 62 78 28 6c ca 5f 2e b3 13 1b 14 28 cb e4 39 7d e7 7b 87 be c4 d6 77 36 8e 30 96 23 0a f2 70 69 1e 4a 37 e7 f7 a1 f7 d7 cf 73 cd df a4 f3 f5 fb 1c d3 5f f9 19 12 49 25 48 c6 b9 bc f9 0b 65 d9 74 22 b5 7b 92 a9 d2 2d 5f 7b ce 75 fe 79 59 4a ed 22 52 b3 21 78 9b 12 8f 76 93 e3 4f 8d 2a 95 3b 3d 33 63 29 e0 9c Data Ascii: wEr=q,pwwg5#ylG-5tj(>bwkMLM0y<W?]Nw1h:M~T[]GrP\bx(l_.(9}{w60#piJ7s_I%Het"{-_{uyYJ"R!xvO*;=3c)
2024-10-05 22:19:24 UTC	16384	IN	Data Raw: 69 d1 14 c4 c0 31 03 d7 c1 8d 58 c1 d5 ff 46 e8 85 d4 89 fb cd 5b c2 42 67 cb b5 bb ff 81 b4 a1 2c 13 f0 0a 62 27 4d 89 35 c9 d6 62 67 61 49 3f 30 f8 8a 41 5f 68 08 6d 55 64 9d 91 c6 22 60 b2 01 17 66 00 87 e1 c7 9f de e3 57 67 50 3c 67 37 6a b9 1c 96 27 c4 a7 4c e0 d2 52 53 f7 70 28 88 68 8e 26 43 5a 56 19 f5 4b 1d 50 e5 88 dd e4 c8 c8 f5 65 9f 22 aa 42 7d 9d 3e a2 26 c1 82 8a b1 72 61 e4 50 aa bc 3b 43 b7 e8 18 ce 4e 7b 11 3f 40 70 34 ce 51 d8 3d c4 69 9c 22 b3 d8 0e 02 ee d1 08 f0 ab 47 5c b9 43 76 09 b9 1a ea e7 18 af 3b 55 2b 36 83 7c 80 3c ac db b8 92 c3 97 da aa 7d cb 76 6a 03 b4 bd 60 3d 15 60 ca ba 60 c7 6e 1c dc 2d 22 3e 13 7c 1a d7 05 0a c7 b6 23 81 6b a3 86 28 10 09 8f 3e 8e be ff f1 1d 7b 3c 21 ea a2 5e 48 3d 7e 0d ea 50 85 e3 95 ee 06 dc 39 Data Ascii: i1XF[Bg,b'M5bgaI?0A_hmUd"`fWgP<g7j'LRSp(h&CZVKPe"B}>&raP;CN{?@p4Q=i"G\Cv;U+6\|<}vj`=``n-">\|#k(>{<!^H=~P9
2024-10-05 22:19:24 UTC	16384	IN	Data Raw: 77 9b 5f 70 b4 79 a6 7a 43 97 7a 1e 18 4b 79 d6 c7 37 05 6a b3 44 2d 6a 68 ad ad b5 4c 98 01 6f 49 00 d6 1b 78 be b1 4d b6 2b bb 0c e9 66 31 fa ee 3b 5b 01 29 9e 97 61 a1 f8 1a 96 1b f4 7b 52 aa 83 21 41 46 db 5b 05 74 eb 5f 66 dc 85 ac 71 d7 13 60 7e f9 cb cf 82 59 15 92 0b 6a 7e f0 00 8d 4c a6 a8 6f fa cb 2a c4 35 b5 da 12 e7 22 6e a6 f5 df cb 2c 8f 30 16 be f9 9d 3b 90 45 73 70 6c f8 a3 b1 44 ff ae df 10 54 16 e2 ed 15 74 f4 e2 db 52 a5 da cd 3a e1 85 7b 07 e3 ba 1c d0 30 d8 6c 30 d3 90 d8 00 85 73 34 64 b0 56 28 64 20 c9 eb f8 bb 18 13 5f e9 6e 66 39 26 d9 67 05 f4 4a 8d 1e a9 ac d5 a0 20 90 05 6b 07 ca ab 57 af 8f 19 4f e0 d0 47 9f 7c 52 3f 0a 5a ca 3c a9 02 30 c1 05 f2 93 c0 3f fd ec 8b fc ac a5 bc 66 2a 1d 81 28 c6 60 03 a8 97 45 c9 93 49 7e 28 30 Data Ascii: w_pyzCzKy7jD-jhLoIxM+f1;[)a{R!AF[t_fq`~Yj~Lo5"n,0;EsplDTtR:{0l0s4dV(d _nf9&gJ kWOG\|R?Z<0?f(`EI~(0
2024-10-05 22:19:24 UTC	16384	IN	Data Raw: 63 de 37 97 a3 45 85 4f ad 50 5a 8c dd 4f 11 2d 3c 78 34 c7 1e 4a 00 5e 52 7c 70 c2 fc 02 0c e2 60 f1 c0 87 d1 16 63 b8 25 80 cc 42 9a 8e 1a c2 5c 33 1f 56 07 48 25 f5 7f eb d5 76 89 21 c1 8f 79 d5 b6 cc 36 0b 78 a6 a6 85 2d 8e 0a 73 65 3e 3e 8a 29 60 92 d6 1e 4d 89 db f3 0f e1 c2 67 9f 7f 56 7f 69 95 9f 24 a0 64 56 bf fc e9 54 34 15 88 f9 f5 37 7f 1e b3 3d 12 a9 a2 eb 47 77 6e ef fc 3a 81 e7 17 bf f9 fb b4 e1 eb 15 61 4c 20 bd bf df 8e bf 09 3e a5 8f db 21 17 23 37 be 29 6d 5e 9f cc 0f 11 0d 90 11 84 91 6d 41 a1 f3 60 c7 d4 3f 6b 63 fa b5 ce 23 12 aa b1 72 25 b1 be 9c 8f 58 ed 85 37 a7 5a 47 84 15 84 4c 5b b4 9a b5 e7 4f 64 16 81 e9 3e 05 bf c4 e0 a8 3e 3a 16 88 70 cf bc 10 92 98 f3 df 55 35 76 76 53 d7 87 e0 c7 72 82 a0 ea a3 71 fa ec 58 9f f5 1a 41 5b Data Ascii: c7EOPZO-<x4J^R\|p`c%B\3VH%v!y6x-se>>)`MgVi$dVT47=Gwn:aL >!#7)m^mA`?kc#r%X7ZGL[Od>>:pU5vvSrqXA[
2024-10-05 22:19:24 UTC	16384	IN	Data Raw: 16 fd f8 7d 25 f9 b8 db e6 9c 8e c9 a3 9b f1 fd aa 5c 78 5e df c0 76 1b 2f c5 7e 29 31 4b ae 1b eb f4 a5 7e 3b 36 e5 05 1d d6 ea fc 87 5e 84 09 b3 f5 a1 8c d3 eb e8 59 b8 30 c6 19 fe 94 00 23 f7 1d da 81 1f ee 45 ff f6 21 b3 17 de 24 94 a3 a7 a9 e7 16 5e 75 fd b2 a4 af 93 98 08 2f 0a 42 b4 29 19 d7 36 6b 46 0b 06 62 e7 df 2e ee 5c 8f e1 01 42 af 9b 06 ef 84 f4 5e 46 b3 9b 0d ca 62 18 f5 6b ce 41 18 00 d8 b4 36 13 e4 53 83 11 5f 8d c5 34 0f 8f 73 d5 9e 94 dc 77 fb ab 89 af c6 33 52 18 5a aa fc 5c 18 09 23 6d 99 64 da fc c1 6b 5e 15 61 22 1a 1d b7 68 82 a9 e4 58 71 f4 83 37 df cd a4 d2 b6 e5 a3 dc ce cd cd 8d 8d e8 24 b2 81 17 25 cc 4a 06 cc e4 5d 7b a2 9c b6 fc 53 2e c5 58 a8 01 ce 04 5e cd 4d 4c 29 b3 fa e8 bc 44 b7 e6 bd fb da aa fc b9 ea 92 67 11 7b e1 Data Ascii: }%\x^v/~)1K~;6^Y0#E!$^u/B)6kFb.\B^FbkA6S_4sw3RZ\#mdk^a"hXq7$%J]{S.X^ML)Dg{
2024-10-05 22:19:24 UTC	16384	IN	Data Raw: c2 a7 94 e6 57 25 0e 23 d4 9b 2c b9 04 87 c2 61 c7 01 ce b3 12 ce 85 28 c1 95 c2 5c cc 2a fc 0d 36 cd f5 6e 4c 73 3c 5b 11 fb ec 73 16 c3 11 92 3a 2f af cc 12 db a3 04 57 e8 3d 09 f3 3f 7c 5f 22 7a 02 fc c3 c7 8a 93 b5 ca 0e 6e 29 65 f0 b6 62 8c 07 e1 34 38 61 58 96 9f 4b 34 56 77 e9 ca 6d 65 16 d4 87 69 4e ae 08 2b a1 f7 15 f2 42 73 c7 b9 8b 4f ca 97 40 ef cb fa c4 c0 1a 7f f4 77 98 d0 97 e4 6c 45 20 21 8e 69 61 8a 1f f2 72 18 0b 03 64 94 cc dc ec f0 f3 6a 8a 06 43 44 28 9a 87 80 e0 11 02 e0 91 f1 4e f4 45 78 61 9c 3c 63 3c 07 fb d1 9f d5 49 4a 09 2c 23 e6 20 81 fb eb ca 05 4a af 04 e3 2f 9e dc 19 7a e6 fd 3a 2c b1 9c 15 5f cb b5 29 71 d1 56 02 25 01 f7 09 08 f8 71 15 b7 85 ab cd 60 73 08 79 42 d8 a3 0b 0f eb 78 f0 ea 17 0e a7 30 1b 8f 29 de 22 4c 70 d2 Data Ascii: W%#,a(\*6nLs<[s:/W=?\|_"zn)eb48aXK4VwmeiN+BsO@wlE !iardjCD(NExa<c<IJ,# J/z:,_)qV%q`syBx0)"Lp
2024-10-05 22:19:24 UTC	16384	IN	Data Raw: b9 69 ba eb 6d 68 ca e0 be 9d 67 8d a7 e1 55 01 9e ef 82 95 b6 f1 38 a0 71 f8 c4 70 ca 64 a4 09 44 3d 0c d7 e0 6c 04 84 af f0 1e 66 c6 37 04 d0 51 9f 37 ef 65 a0 4f 0c 57 b8 4b 09 5b 75 75 dc 4b 17 82 8b a4 77 bc 60 f6 c3 12 c0 fb 36 2f 18 cf ce 95 8c 71 de 29 74 c6 c3 b0 93 37 c3 34 a9 58 9b 3d 23 71 3c 5c ff 28 fe 6a 0d 6f 80 be 8e a5 80 8c 98 12 76 c1 08 3d 8c a1 31 0a 0b ee c4 9d 05 2b 42 a7 57 8c d2 7a 6c 68 e7 20 9c 33 76 66 9b 89 da 40 c9 e1 1d 23 37 3c 88 5e 8c d6 c7 23 65 d4 37 72 66 c9 16 7c 76 9a a1 b1 09 f4 d3 ca d7 36 82 d9 c1 a8 a3 f4 c8 07 87 39 7c b0 63 50 33 04 4d 99 8c ec 88 5e 0f 6b df 59 85 cf f4 54 06 02 da b1 52 30 72 eb 19 46 0c 1c f7 72 05 30 c2 43 51 f0 e8 66 97 46 a0 d7 76 b0 31 58 d3 e6 b3 e2 d0 82 48 d2 11 5f d5 e8 14 4f 52 2e Data Ascii: imhgU8qpdD=lf7Q7eOWK[uuKw`6/q)t74X=#q<\(jov=1+BWzlh 3vf@#7<^#e7rf\|v69\|cP3M^kYTR0rFr0CQfFv1XH_OR.
2024-10-05 22:19:24 UTC	16384	IN	Data Raw: 5e 5e bc c6 26 73 c1 8b c1 c4 e0 b8 d6 51 58 e8 3e fc 5f fa cd a7 3e df ca 54 7f 43 23 f1 6e 33 40 a8 9f 30 1a a4 f7 71 0d 5f a2 59 97 6c 60 dd 57 da 3e 8f e7 0e de 85 b9 54 53 fe 6b 3a c1 91 72 70 c8 d4 39 ed da cc fa c5 0e 7c c0 cd 80 c5 3b 62 12 1d 9d b2 46 2e 58 f0 a8 fe b7 f8 5e b9 a8 bd ca 85 f3 c3 88 0a a3 b5 fb 80 0b fe 4e 81 dc 47 af 7e 1f cf d1 03 6d 0e 1c 2d cf 6d 40 f3 b4 fd 14 6f b2 4b 83 ae e0 45 37 7d 4c e9 47 3a 79 df fc c8 e3 9d f2 8f fa 8e bb 74 ae 37 ef c7 bb 79 b1 6f fb 7b f0 7a 7c 3d 4d 59 bc ca 77 a4 1f 59 37 38 4d 1e 4d ac 5d bb 3b 27 cf e8 28 3c a8 3f c1 c9 a5 c7 0b 3b f8 d7 f3 5f a0 6d fd 8d ce 04 23 1e 58 4f 5b d3 97 c9 a4 a7 0e 05 8d 98 06 a5 14 3e dd 35 b2 22 f9 88 97 d1 8e e7 5d 1d 16 78 58 dd 08 26 78 52 07 5c 81 99 ee 7b ff Data Ascii: ^^&sQX>_>TC#n3@0q_Yl`W>TSk:rp9\|;bF.X^NG~m-m@oKE7}LG:yt7yo{z\|=MYwY78MM];'(<?;_m#XO[>5"]xX&xR\{

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:25 UTC	634	OUT	GET /wp-content/plugins/rightcause-core/inc/icons/simple-line-icons/assets/css/simple-line-icons.min.css?ver=6.6.2 HTTP/1.1 Host: blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://blmphilly.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:25 UTC	631	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:25 GMT Content-Type: text/css Content-Length: 10996 Last-Modified: Sat, 29 Aug 2020 19:04:22 GMT Connection: close Vary: Accept-Encoding ETag: "5f4aa6b6-2af4" Expires: Mon, 04 Nov 2024 22:19:25 GMT Cache-Control: max-age=2592000 X-Rocket-Nginx-Serving-Static: BYPASS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; Accept-Ranges: bytes
2024-10-05 22:19:25 UTC	10996	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 69 6d 70 6c 65 2d 6c 69 6e 65 2d 69 63 6f 6e 73 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 53 69 6d 70 6c 65 2d 4c 69 6e 65 2d 49 63 6f 6e 73 2e 65 6f 74 3f 76 3d 32 2e 34 2e 30 29 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 53 69 6d 70 6c 65 2d 4c 69 6e 65 2d 49 63 6f 6e 73 2e 65 6f 74 3f 76 3d 32 2e 34 2e 30 23 69 65 66 69 78 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 53 69 6d 70 6c 65 2d 4c 69 6e 65 2d 49 63 6f 6e 73 2e 77 6f 66 66 32 3f 76 3d 32 2e 34 2e 30 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 53 69 6d 70 6c 65 2d 4c 69 Data Ascii: @font-face{font-family:simple-line-icons;src:url(../fonts/Simple-Line-Icons.eot?v=2.4.0);src:url(../fonts/Simple-Line-Icons.eot?v=2.4.0#iefix) format('embedded-opentype'),url(../fonts/Simple-Line-Icons.woff2?v=2.4.0) format('woff2'),url(../fonts/Simple-Li

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:25 UTC	591	OUT	GET /wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=6.4.3 HTTP/1.1 Host: blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://blmphilly.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:25 UTC	631	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:25 GMT Content-Type: text/css Content-Length: 46555 Last-Modified: Tue, 23 Jul 2024 16:57:54 GMT Connection: close Vary: Accept-Encoding ETag: "669fe112-b5db" Expires: Mon, 04 Nov 2024 22:19:25 GMT Cache-Control: max-age=2592000 X-Rocket-Nginx-Serving-Static: BYPASS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; Accept-Ranges: bytes
2024-10-05 22:19:25 UTC	15753	IN	Data Raw: 23 73 62 5f 69 6e 73 74 61 67 72 61 6d 20 7b 77 69 64 74 68 3a 20 31 30 30 25 3b 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 20 30 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 7d 23 73 62 5f 69 6e 73 74 61 67 72 61 6d 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 3b 63 6c 65 61 72 3a 20 62 6f 74 68 3b 7d 23 73 62 5f 69 6e 73 74 61 67 72 61 6d 2e 73 62 69 5f 66 69 78 65 64 5f 68 65 69 67 68 74 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a Data Ascii: #sb_instagram {width: 100%;margin: 0 auto;padding: 0;-webkit-box-sizing: border-box;-moz-box-sizing: border-box;box-sizing: border-box;}#sb_instagram:after{content: "";display: table;clear: both;}#sb_instagram.sbi_fixed_height{overflow: hidden;overflow-y:
2024-10-05 22:19:25 UTC	16384	IN	Data Raw: 73 62 69 5f 6d 65 64 69 75 6d 20 2e 73 62 69 5f 74 79 70 65 5f 63 61 72 6f 75 73 65 6c 20 2e 73 62 69 5f 70 68 6f 74 6f 5f 77 72 61 70 20 2e 66 61 2d 63 6c 6f 6e 65 7b 72 69 67 68 74 3a 20 38 70 78 3b 74 6f 70 3a 20 38 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 7d 23 73 62 5f 69 6e 73 74 61 67 72 61 6d 2e 73 62 69 5f 73 6d 61 6c 6c 20 2e 73 62 69 5f 70 6c 61 79 62 74 6e 2c 20 23 73 62 5f 69 6e 73 74 61 67 72 61 6d 2e 73 62 69 5f 73 6d 61 6c 6c 20 2e 73 62 69 5f 70 68 6f 74 6f 5f 77 72 61 70 20 2e 73 76 67 2d 69 6e 6c 69 6e 65 2d 2d 66 61 2e 66 61 2d 70 6c 61 79 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 39 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 37 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 7d 23 73 62 5f 69 6e 73 74 Data Ascii: sbi_medium .sbi_type_carousel .sbi_photo_wrap .fa-clone{right: 8px;top: 8px;font-size: 18px;}#sb_instagram.sbi_small .sbi_playbtn, #sb_instagram.sbi_small .sbi_photo_wrap .svg-inline--fa.fa-play{margin-top: -9px;margin-left: -7px;font-size: 18px;}#sb_inst
2024-10-05 22:19:25 UTC	14418	IN	Data Raw: 6c 70 68 61 28 4f 70 61 63 69 74 79 3d 31 30 30 29 3b 6f 70 61 63 69 74 79 3a 20 31 3b 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 7d 2e 73 62 69 5f 6c 62 2d 6e 61 76 20 7b 68 65 69 67 68 74 3a 20 61 75 74 6f 3b 7d 2e 73 62 69 5f 6c 69 67 68 74 62 6f 78 20 2e 73 62 69 5f 6f 77 6c 2d 69 74 65 6d 3a 6e 74 68 2d 63 68 69 6c 64 28 6e 2b 32 29 20 2e 73 62 69 5f 76 69 64 65 6f 20 7b 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 73 62 69 5f 6c 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 3a 20 30 3b 7d 2e 73 62 2d 65 6c 65 6d 65 6e 74 6f 72 2d 63 74 61 20 7b 77 69 64 74 68 3a 20 31 30 30 25 20 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 45 38 45 38 45 42 20 21 69 Data Ascii: lpha(Opacity=100);opacity: 1;color: #fff;}.sbi_lb-nav {height: auto;}.sbi_lightbox .sbi_owl-item:nth-child(n+2) .sbi_video {position: relative !important;}.sbi_lb-container{padding: 0;}.sb-elementor-cta {width: 100% !important;border: 1px solid #E8E8EB !i

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:25 UTC	592	OUT	GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.9.7 HTTP/1.1 Host: blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://blmphilly.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:25 UTC	629	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:25 GMT Content-Type: text/css Content-Length: 2894 Last-Modified: Tue, 23 Jul 2024 16:57:25 GMT Connection: close Vary: Accept-Encoding ETag: "669fe0f5-b4e" Expires: Mon, 04 Nov 2024 22:19:25 GMT Cache-Control: max-age=2592000 X-Rocket-Nginx-Serving-Static: BYPASS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; Accept-Ranges: bytes
2024-10-05 22:19:25 UTC	2894	IN	Data Raw: 2e 77 70 63 66 37 20 2e 73 63 72 65 65 6e 2d 72 65 61 64 65 72 2d 72 65 73 70 6f 6e 73 65 20 7b 0a 09 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 09 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 09 63 6c 69 70 3a 20 72 65 63 74 28 31 70 78 2c 20 31 70 78 2c 20 31 70 78 2c 20 31 70 78 29 3b 0a 09 63 6c 69 70 2d 70 61 74 68 3a 20 69 6e 73 65 74 28 35 30 25 29 3b 0a 09 68 65 69 67 68 74 3a 20 31 70 78 3b 0a 09 77 69 64 74 68 3a 20 31 70 78 3b 0a 09 6d 61 72 67 69 6e 3a 20 2d 31 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 6f 72 64 65 72 3a 20 30 3b 0a 09 77 6f 72 64 2d 77 72 61 70 3a 20 6e 6f 72 6d 61 6c 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 0a 2e 77 70 63 66 37 20 66 6f 72 6d 20 2e 77 70 63 66 37 2d 72 65 73 70 6f Data Ascii: .wpcf7 .screen-reader-response {position: absolute;overflow: hidden;clip: rect(1px, 1px, 1px, 1px);clip-path: inset(50%);height: 1px;width: 1px;margin: -1px;padding: 0;border: 0;word-wrap: normal !important;}.wpcf7 form .wpcf7-respo

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:25 UTC	597	OUT	GET /wp-content/plugins/custom-twitter-feeds/css/ctf-styles.min.css?ver=2.2.2 HTTP/1.1 Host: blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://blmphilly.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:25 UTC	631	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:25 GMT Content-Type: text/css Content-Length: 16245 Last-Modified: Wed, 10 Apr 2024 18:38:15 GMT Connection: close Vary: Accept-Encoding ETag: "6616dc97-3f75" Expires: Mon, 04 Nov 2024 22:19:25 GMT Cache-Control: max-age=2592000 X-Rocket-Nginx-Serving-Static: BYPASS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; Accept-Ranges: bytes
2024-10-05 22:19:25 UTC	15753	IN	Data Raw: 2e 63 74 66 2d 66 69 78 65 64 2d 68 65 69 67 68 74 7b 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 7d 23 63 74 66 20 2e 63 74 66 2d 69 74 65 6d 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 20 35 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 23 63 74 66 2e 63 74 66 2d 62 6f 78 65 64 2d 73 74 79 6c 65 20 2e 63 74 66 2d 69 74 65 6d 7b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 23 63 74 66 20 2e 63 74 66 2d 69 74 65 6d 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 6e 6f 6e 65 7d 23 63 74 66 20 2e 63 74 66 2d 69 74 65 6d 3a 6c 61 73 74 2d 6f 66 2d 74 79 70 65 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 23 63 74 66 20 23 63 74 66 20 2e 63 74 66 2d 70 68 6f 74 6f 2d 68 6f 76 65 72 20 73 70 61 6e Data Ascii: .ctf-fixed-height{overflow:auto}#ctf .ctf-item{padding:15px 5px;overflow:hidden}#ctf.ctf-boxed-style .ctf-item{padding:15px}#ctf .ctf-item:first-child{border-top:none}#ctf .ctf-item:last-of-type{border-bottom:none!important}#ctf #ctf .ctf-photo-hover span
2024-10-05 22:19:25 UTC	492	IN	Data Raw: 2c 23 63 74 66 2e 63 74 66 5f 70 61 6c 65 74 74 65 5f 64 61 72 6b 20 2e 63 74 66 2d 61 75 74 68 6f 72 2d 73 63 72 65 65 6e 6e 61 6d 65 2c 23 63 74 66 2e 63 74 66 5f 70 61 6c 65 74 74 65 5f 64 61 72 6b 20 2e 63 74 66 2d 68 65 61 64 65 72 2d 62 69 6f 2c 23 63 74 66 2e 63 74 66 5f 70 61 6c 65 74 74 65 5f 64 61 72 6b 20 2e 63 74 66 2d 68 65 61 64 65 72 2d 63 6f 75 6e 74 73 2c 23 63 74 66 2e 63 74 66 5f 70 61 6c 65 74 74 65 5f 64 61 72 6b 20 2e 63 74 66 2d 68 65 61 64 65 72 2d 6e 61 6d 65 2c 23 63 74 66 2e 63 74 66 5f 70 61 6c 65 74 74 65 5f 64 61 72 6b 20 2e 63 74 66 2d 68 65 61 64 65 72 2d 74 79 70 65 2d 74 65 78 74 2c 23 63 74 66 2e 63 74 66 5f 70 61 6c 65 74 74 65 5f 64 61 72 6b 20 2e 63 74 66 2d 74 77 65 65 74 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 66 66 Data Ascii: ,#ctf.ctf_palette_dark .ctf-author-screenname,#ctf.ctf_palette_dark .ctf-header-bio,#ctf.ctf_palette_dark .ctf-header-counts,#ctf.ctf_palette_dark .ctf-header-name,#ctf.ctf_palette_dark .ctf-header-type-text,#ctf.ctf_palette_dark .ctf-tweet-text{color:#ff

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:25 UTC	590	OUT	GET /wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.2.12 HTTP/1.1 Host: blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://blmphilly.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:25 UTC	631	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:25 GMT Content-Type: text/css Content-Length: 58485 Last-Modified: Sat, 29 Aug 2020 18:59:06 GMT Connection: close Vary: Accept-Encoding ETag: "5f4aa57a-e475" Expires: Mon, 04 Nov 2024 22:19:25 GMT Cache-Control: max-age=2592000 X-Rocket-Nginx-Serving-Static: BYPASS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; Accept-Ranges: bytes
2024-10-05 22:19:25 UTC	15753	IN	Data Raw: 2f 2a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 2d 09 52 65 76 6f 6c 75 74 69 6f 6e 20 53 6c 69 64 65 72 20 36 2e 30 20 44 65 66 61 75 6c 74 20 53 74 79 6c 65 20 53 65 74 74 69 6e 67 73 20 2d 0a 0a 53 63 72 65 65 6e 20 53 74 79 6c 65 73 68 65 65 74 0a 0a 76 65 72 73 69 6f 6e 3a 20 20 20 09 36 2e 32 2e 38 0a 64 61 74 65 3a 20 20 20 20 20 20 09 32 34 2f 30 36 2f 31 39 0a 61 75 74 68 6f 72 3a 09 09 74 68 65 6d 65 70 75 6e 63 68 0a 65 6d 61 69 6c 3a 20 20 20 20 20 09 69 6e 66 6f 40 74 68 65 6d 65 70 75 6e 63 68 2e 63 6f 6d 0a 77 65 62 73 69 74 65 3a 20 20 20 09 68 74 Data Ascii: /*------------------------------------------------------------------------------Revolution Slider 6.0 Default Style Settings -Screen Stylesheetversion: 6.2.8date: 24/06/19author:themepunchemail: info@themepunch.comwebsite: ht
2024-10-05 22:19:25 UTC	16384	IN	Data Raw: 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 72 6d 61 6c 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 0a 72 73 2d 63 62 67 2d 6d 61 73 6b 2d 77 72 61 70 20 7b 0a 09 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 20 20 20 20 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 30 3b 0a 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 20 20 20 20 20 0a 7d 20 0a 0a 72 73 2d 63 6f 6c 75 6d 6e 2d 77 72 61 70 20 72 73 2d 63 62 67 2d 6d 61 73 6b 2d 77 72 61 70 20 7b 20 74 6f 70 3a 20 30 70 78 3b 20 6c 65 66 74 3a 20 30 70 78 3b 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 20 72 69 67 68 74 3a 20 30 70 78 3b 20 7d 0a 72 73 2d 63 6f 6c 75 6d 6e 2d 62 67 20 7b 09 0a 20 20 20 20 70 6f 73 69 74 Data Ascii: to !important;white-space: normal !important;}rs-cbg-mask-wrap {position: absolute; z-index: 0; box-sizing: border-box; } rs-column-wrap rs-cbg-mask-wrap { top: 0px; left: 0px; bottom: 0px; right: 0px; }rs-column-bg { posit
2024-10-05 22:19:25 UTC	16384	IN	Data Raw: 30 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 09 0a 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 30 70 78 3b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 32 30 70 78 3b 09 0a 09 61 6e 69 6d 61 74 69 6f 6e 3a 20 74 70 2d 72 6f 74 61 74 65 70 6c 61 6e 65 20 31 2e 32 73 20 69 6e 66 69 6e 69 74 65 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 0a 09 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 33 70 78 3b 09 0a 7d 0a 0a 0a 72 73 2d 6c 6f 61 64 65 72 2e 73 70 69 6e 6e 65 72 31 20 7b 0a 09 77 69 64 74 68 3a 20 34 30 70 78 3b 0a 09 68 65 69 67 68 74 3a 20 34 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 30 70 78 20 32 30 70 78 20 30 70 78 20 72 67 62 61 28 30 2c Data Ascii: 0px rgba(0,0,0,0.15);margin-top:-20px;margin-left:-20px;animation: tp-rotateplane 1.2s infinite ease-in-out;border-radius: 3px;}rs-loader.spinner1 {width: 40px;height: 40px;background-color: #fff;box-shadow: 0px 0px 20px 0px rgba(0,
2024-10-05 22:19:25 UTC	9964	IN	Data Raw: 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 7d 72 73 2d 6c 6f 61 64 65 72 2e 73 70 69 6e 6e 65 72 38 20 2e 72 73 2d 73 70 69 6e 6e 65 72 2d 69 6e 6e 65 72 20 73 70 61 6e 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2d 2e 38 73 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2d 2e 38 73 7d 40 6b 65 79 66 72 61 6d 65 73 20 72 73 2d 72 65 76 65 61 6c 65 72 2d 38 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 30 2c 30 29 3b 6f 70 61 63 69 74 79 3a 2e 35 7d 31 30 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 2c 31 29 3b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 72 73 2d 72 65 76 65 61 6c 65 72 2d 38 7b 30 25 7b 2d 77 65 62 Data Ascii: inear infinite}rs-loader.spinner8 .rs-spinner-inner span:last-child{animation-delay:-.8s;-webkit-animation-delay:-.8s}@keyframes rs-revealer-8{0%{transform:scale(0,0);opacity:.5}100%{transform:scale(1,1);opacity:0}}@-webkit-keyframes rs-revealer-8{0%{-web

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:25 UTC	614	OUT	GET /wp-content/plugins/qode-framework/inc/common/assets/css/plugins/select2.min.css?ver=6.6.2 HTTP/1.1 Host: blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://blmphilly.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:25 UTC	631	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:25 GMT Content-Type: text/css Content-Length: 15180 Last-Modified: Sat, 29 Aug 2020 19:02:32 GMT Connection: close Vary: Accept-Encoding ETag: "5f4aa648-3b4c" Expires: Mon, 04 Nov 2024 22:19:25 GMT Cache-Control: max-age=2592000 X-Rocket-Nginx-Serving-Static: BYPASS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; Accept-Ranges: bytes
2024-10-05 22:19:25 UTC	15180	IN	Data Raw: 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 32 38 70 78 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 Data Ascii: .select2-container{box-sizing:border-box;display:inline-block;margin:0;position:relative;vertical-align:middle}.select2-container .select2-selection--single{box-sizing:border-box;cursor:pointer;display:block;height:28px;user-select:none;-webkit-user-selec

Timestamp	Bytes transferred	Direction	Data
2024-10-05 22:19:26 UTC	622	OUT	GET /wp-content/plugins/rightcause-core/inc/core-dashboard/assets/css/core-dashboard.min.css?ver=6.6.2 HTTP/1.1 Host: blmphilly.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://blmphilly.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-05 22:19:26 UTC	631	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 05 Oct 2024 22:19:26 GMT Content-Type: text/css Content-Length: 11693 Last-Modified: Sat, 29 Aug 2020 19:01:17 GMT Connection: close Vary: Accept-Encoding ETag: "5f4aa5fd-2dad" Expires: Mon, 04 Nov 2024 22:19:26 GMT Cache-Control: max-age=2592000 X-Rocket-Nginx-Serving-Static: BYPASS Strict-Transport-Security: max-age=31536000; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; Accept-Ranges: bytes
2024-10-05 22:19:26 UTC	11693	IN	Data Raw: 2e 71 6f 64 65 66 2d 63 6f 72 65 2d 64 61 73 68 62 6f 61 72 64 7b 6d 61 78 2d 77 69 64 74 68 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 71 6f 64 65 66 2d 63 6f 72 65 2d 64 61 73 68 62 6f 61 72 64 20 2e 71 6f 64 65 66 2d 63 6f 72 65 2d 64 61 73 68 62 6f 61 72 64 2d 69 6e 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 2d 31 35 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 71 6f 64 65 66 2d 63 6f 72 65 2d 64 61 73 68 62 6f 61 72 64 20 2e 71 6f 64 65 66 2d 63 64 2d 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 35 70 78 3b 77 69 64 74 68 3a 36 32 70 Data Ascii: .qodef-core-dashboard{max-width:initial!important}.qodef-core-dashboard .qodef-core-dashboard-inner{margin:0 -15px;display:inline-block;width:100%}.qodef-core-dashboard .qodef-cd-logo{display:inline-block;vertical-align:middle;padding-right:15px;width:62p