Edit tour

Windows Analysis Report
http://www.activeselfie.com/

Overview

General Information

Sample URL:	http://www.activeselfie.com/
Analysis ID:	1589325
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2500,i,9200259552935339684,2536430183486973830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3200 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.activeselfie.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /wdzmr.php HTTP/1.1Host: vkg.hpdbfezgrqwn.vipConnection: keep-aliveContent-Length: 225sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8;Accept: */*Origin: https://www.activeselfie.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.activeselfie.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found

Source: chromecache_263.2.dr	String found in binary or memory: http://12aff.best5689.com/92043302/signup/cs/index.html
Source: chromecache_263.2.dr	String found in binary or memory: http://5887ky.com
Source: chromecache_205.2.dr	String found in binary or memory: http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html
Source: chromecache_156.2.dr, chromecache_215.2.dr	String found in binary or memory: http://james.padolsey.com)
Source: chromecache_223.2.dr	String found in binary or memory: http://jqueryvalidation.org/
Source: chromecache_264.2.dr, chromecache_204.2.dr, chromecache_263.2.dr	String found in binary or memory: http://kaiyunty583.net
Source: chromecache_177.2.dr, chromecache_201.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_295.2.dr	String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: chromecache_205.2.dr	String found in binary or memory: http://stackoverflow.com/questions/181348/instantiating-a-javascript-object-by-calling-prototype-con
Source: chromecache_205.2.dr	String found in binary or memory: http://stackoverflow.com/questions/3561493/is-there-a-regexp-escape-function-in-javascript
Source: chromecache_293.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_263.2.dr	String found in binary or memory: https://0326018.cc
Source: chromecache_263.2.dr	String found in binary or memory: https://11073377.app
Source: chromecache_346.2.dr	String found in binary or memory: https://1k4ej4j1lxvjwz.com/
Source: chromecache_263.2.dr	String found in binary or memory: https://551000l.cc
Source: chromecache_264.2.dr, chromecache_204.2.dr, chromecache_263.2.dr	String found in binary or memory: https://665339c.com
Source: chromecache_263.2.dr	String found in binary or memory: https://665339c.com/wap/downloadApp?promoCode=e9VJBL
Source: chromecache_264.2.dr, chromecache_204.2.dr, chromecache_263.2.dr	String found in binary or memory: https://789400.cc/
Source: chromecache_263.2.dr	String found in binary or memory: https://99505n.cc
Source: chromecache_263.2.dr	String found in binary or memory: https://a43389.cc/
Source: chromecache_263.2.dr	String found in binary or memory: https://aff.kkcg8.com/sign-up/593325
Source: chromecache_225.2.dr	String found in binary or memory: https://analytics.tiktok.com/i18n/pixel/events.js
Source: chromecache_263.2.dr	String found in binary or memory: https://app.geqianf225.top/s/bet365
Source: chromecache_263.2.dr	String found in binary or memory: https://app.geqianf225.top/s/bwyz
Source: chromecache_263.2.dr	String found in binary or memory: https://app.geqianf225.top/s/tyc
Source: chromecache_293.2.dr	String found in binary or memory: https://appelsiini.net/projects/lazyload
Source: chromecache_263.2.dr	String found in binary or memory: https://appiso-ali.ghgdfdf.com/?cGkxMl90NDA3MQ==&c=101105706293#/
Source: chromecache_263.2.dr	String found in binary or memory: https://cdn.livechatinc.com/tracking.js
Source: chromecache_225.2.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: chromecache_264.2.dr, chromecache_204.2.dr, chromecache_263.2.dr	String found in binary or memory: https://e977110.com
Source: chromecache_263.2.dr	String found in binary or memory: https://e977110.com/wap/downloadApp?promoCode=pK8XQc
Source: chromecache_347.2.dr, chromecache_227.2.dr, chromecache_326.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_205.2.dr	String found in binary or memory: https://github.com/dordille/moment-isoduration/blob/master/moment.isoduration.js
Source: chromecache_205.2.dr	String found in binary or memory: https://github.com/moment/moment/issues/1407
Source: chromecache_205.2.dr	String found in binary or memory: https://github.com/moment/moment/issues/1423
Source: chromecache_205.2.dr	String found in binary or memory: https://github.com/moment/moment/issues/1548
Source: chromecache_205.2.dr	String found in binary or memory: https://github.com/moment/moment/issues/1779
Source: chromecache_205.2.dr	String found in binary or memory: https://github.com/moment/moment/pull/1871
Source: chromecache_347.2.dr, chromecache_227.2.dr, chromecache_326.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_347.2.dr, chromecache_227.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_263.2.dr	String found in binary or memory: https://guwu.fun/download
Source: chromecache_204.2.dr, chromecache_263.2.dr	String found in binary or memory: https://j21716.com
Source: chromecache_263.2.dr	String found in binary or memory: https://j21716.com/wap/downloadApp?promoCode=XPMJTR
Source: chromecache_264.2.dr, chromecache_204.2.dr, chromecache_263.2.dr	String found in binary or memory: https://k933005.com
Source: chromecache_263.2.dr	String found in binary or memory: https://lucky298.com/vsgl
Source: chromecache_264.2.dr, chromecache_204.2.dr	String found in binary or memory: https://lucky298.com/vsglat
Source: chromecache_204.2.dr, chromecache_263.2.dr	String found in binary or memory: https://m399227.com
Source: chromecache_295.2.dr	String found in binary or memory: https://p.ssl.qhimg.com/t010e288a56a0b005e9.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com
Source: chromecache_179.2.dr, chromecache_300.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common
Source: chromecache_179.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common/images/errors/ico-605.png
Source: chromecache_179.2.dr, chromecache_300.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common/js/curl/curl.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.j
Source: chromecache_179.2.dr, chromecache_300.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/main.js
Source: chromecache_179.2.dr, chromecache_300.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/urlencode.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common/static/css/gb.validation.min.css
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common/static/js/gb.validation.min.js?v=1736150851437
Source: chromecache_179.2.dr, chromecache_300.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common/themes/default/bootstrap/bootstrap.min.css
Source: chromecache_179.2.dr, chromecache_300.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/common/themes/error.css
Source: chromecache_179.2.dr, chromecache_300.2.dr, chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/msites
Source: chromecache_179.2.dr, chromecache_300.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/msites/images/touchicon.png
Source: chromecache_179.2.dr, chromecache_300.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/msites/themes/default/common.css?v=1736150851437
Source: chromecache_179.2.dr, chromecache_300.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/061410/rcenter/msites/themes/default/lang/zh_CN.css?v=1736150851437
Source: chromecache_179.2.dr, chromecache_300.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/fserver
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/fserver/files/gb/1761/Logo/405/1696591118080.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10004/1719343950451.jpg)
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10006/1719344244164.jpg)
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10008/1719344412734.jpg)
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10010/1719344363451.jpg)
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10047/1719344188380.jpg)
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10048/1719344459903.jpg)
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10049/1719344515771.jpg)
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10050/1719344563012.jpg)
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/all_bg.jpg
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/header/header_bg.jpg
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/header/top_bg.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/icon_marquee.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/1_9.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/3_108.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/code_bg.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_0.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_1.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_2.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_3.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_4.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_5.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_6.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_7.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/download_apple.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/download_bg.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_1.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_3.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_4.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_5.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_fish_42_5.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/hot_game_title.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/hotgame_title_bg.jpg
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/icon_game_1.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/icon_game_3.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/icon_game_4.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/icon_game_5.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/service_inner_bg.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/service_out_bg.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/services_title.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/services_title_bg.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/themes/style/bootstrap-dialog.min.css
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/bet365-1761/themes/style/common.css
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/images/default-banner.jpg
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/images/favicon/favicon_1761.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/bootstrap-dialog.min.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/float.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/gui-base.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/idangerous.swiper.min.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/jquery/jquery-1.11.3.min.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/jquery/jquery.nicescroll.min.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/jquery/jquery.super-marquee.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/layer.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/lazyload.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/moment.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/websocket/Comet.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/websocket/CometMarathon.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/js/websocket/PopUp.js
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/themes/gui-base.css
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/themes/gui-skin-default.css
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/themes/hb/css/pc.css
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/zh_CN/mobileTopic/images/special_3.jpg
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/zh_CN/pubads/images/ads1.png
Source: chromecache_225.2.dr	String found in binary or memory: https://p3yw7u.innittapp.com/ftl/commonPage/zh_CN/pubads/images/ads2.png
Source: chromecache_263.2.dr	String found in binary or memory: https://parimatchasia.onelink.me/nec7/949ac8d5?
Source: chromecache_225.2.dr	String found in binary or memory: https://s1.kwai.net/kos/s101/nlav11187/pixel/events.js
Source: chromecache_225.2.dr	String found in binary or memory: https://s1.kwai.net/kos/s101/nlav11187/pixel/events.js?sdkid=
Source: chromecache_263.2.dr	String found in binary or memory: https://service.sdqhwtvbtwdf.com/C.ashx?btag=a_18017b_1722c_&affid=2017190&siteid=18017&adid=1722&c=
Source: chromecache_264.2.dr, chromecache_204.2.dr, chromecache_263.2.dr	String found in binary or memory: https://service.sdqhwtvbtwdf.com/C.ashx?btag=a_18017b_2464c_&affid=2017190&siteid=18017&adid=2464&c=
Source: chromecache_263.2.dr	String found in binary or memory: https://service.sdqhwtvbtwdf.com/C.ashx?btag=a_18017b_2484c_&affid=2017190&siteid=18017&adid=2484&c=
Source: chromecache_263.2.dr	String found in binary or memory: https://wros8.top/vjS2
Source: chromecache_263.2.dr	String found in binary or memory: https://www.4a0kzf.com/Yvj3
Source: chromecache_295.2.dr	String found in binary or memory: https://www.baidu.com/
Source: chromecache_295.2.dr	String found in binary or memory: https://www.baidu.com/baidu
Source: chromecache_295.2.dr	String found in binary or memory: https://www.baidu.com/img/baidu_jgylogo3.gif
Source: chromecache_263.2.dr	String found in binary or memory: https://www.bvty894.com:30122/entry/register?i_code=2270535
Source: chromecache_263.2.dr	String found in binary or memory: https://www.livechat.com/?welcome
Source: chromecache_263.2.dr	String found in binary or memory: https://www.livechat.com/chat-with/15900159/
Source: chromecache_263.2.dr	String found in binary or memory: https://www.ljjapp2.com/?601158
Source: chromecache_264.2.dr, chromecache_204.2.dr, chromecache_263.2.dr	String found in binary or memory: https://www.ray060.com/?601158
Source: chromecache_295.2.dr	String found in binary or memory: https://www.so.com/
Source: chromecache_295.2.dr	String found in binary or memory: https://www.sogou.com/
Source: chromecache_295.2.dr	String found in binary or memory: https://www.sogou.com/web
Source: chromecache_295.2.dr	String found in binary or memory: https://www.sogou.com/web/index/images/logo_440x140.v.4.png
Source: chromecache_263.2.dr	String found in binary or memory: https://www.ss52611.com/vip.html?c=88003698540
Source: chromecache_263.2.dr	String found in binary or memory: https://www.xivev6.com:9056/entry/register37012/?i_code=30114312
Source: chromecache_263.2.dr	String found in binary or memory: https://wy-ali.meriksenrusso.com/wx/app/proxy-qrcode.html?url=aHR0cHM6Ly9hcHBpc28tdHkuc291emhhbnp4Lm
Source: chromecache_263.2.dr	String found in binary or memory: https://wy-ali.meriksenrusso.com/wx/app/proxy-qrcode.html?url=aHR0cHM6Ly9hcHBpc28tdHkuenZiempzYi5jb2
Source: chromecache_263.2.dr	String found in binary or memory: https://xj206.cc/
Source: chromecache_295.2.dr	String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

Source: classification engine

Classification label: mal56.win@19/323@42/14

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2500,i,9200259552935339684,2536430183486973830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.activeselfie.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2500,i,9200259552935339684,2536430183486973830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://www.activeselfie.com/	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/ClassTool.js?v=1736150851437	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/js/bootstrap/bootstrap.js?v=1736150851437	0%	Avira URL Cloud	safe
https://551000l.cc/message_zh_CN.js?v=1736150851437	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/commonPage/zh_CN/pubads/images/ads2.png	0%	Avira URL Cloud	safe
https://www.activeselfie.com/images/tt_bg.png	100%	Avira URL Cloud	phishing
https://p3yw7u.innittapp.com/061410/rcenter/common/js/jquery/plugins/jquery.poshytip/jquery.poshytip.js?v=1736150851437	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/urlencode.js	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/commonPage/themes/hongbao.css	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/msites/themes/base.css	0%	Avira URL Cloud	safe
https://www.4a0kzf.com/Yvj3	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_1.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/themes/default/jquery/plugins/jquery.poshytip/poshytip.css	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_6.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/commonPage/themes/gui-skin-default.css	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/commonPage/images/default-banner.jpg	0%	Avira URL Cloud	safe
https://appiso-ali.ghgdfdf.com/?cGkxMl90NDA3MQ==&c=101105706293#/	0%	Avira URL Cloud	safe
https://www.activeselfie.com/images/banner_02.jpg	100%	Avira URL Cloud	phishing
https://xj206.cc/	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.j	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/main.js	0%	Avira URL Cloud	safe
https://789400.cc/	0%	Avira URL Cloud	safe
https://www.activeselfie.com/js/jquery.SuperSlide.js	100%	Avira URL Cloud	phishing
https://1k4ej4j1lxvjwz.com/popper.min.js	0%	Avira URL Cloud	safe
https://1k4ej4j1lxvjwz.com/imgs/sansanqiqi.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/commonPage/js/float.js	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/commonPage/js/websocket/Comet.js	0%	Avira URL Cloud	safe
https://1k4ej4j1lxvjwz.com/imgs/188jinbaobo.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/msites/themes/default/login.css	0%	Avira URL Cloud	safe
https://www.activeselfie.com/sitegray/sitegray.js	100%	Avira URL Cloud	phishing
https://1k4ej4j1lxvjwz.com/quicklink.umd.js	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/commonPage/js/idangerous.swiper.min.js	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/js/curl/curl/loader/legacy.js?v=1736150851437	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_5.png	0%	Avira URL Cloud	safe
http://12aff.best5689.com/92043302/signup/cs/index.html	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/services_title_bg.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10048/1719344459903.jpg)	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/icon_game_5.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/header/header_bg.jpg	0%	Avira URL Cloud	safe
https://vkg.hpdbfezgrqwn.vip/wdzmr.php	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/commonPage/js/jquery/jquery.super-marquee.js	0%	Avira URL Cloud	safe
https://551000l.cc/?__CBK=388267276e284239fb05201c095bbfcb01736640552_6738556	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/fserver	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/static/js/gb.validation.min.js?v=1736150851437	0%	Avira URL Cloud	safe
https://1k4ej4j1lxvjwz.com/css/modalStyles.css	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_2.png	0%	Avira URL Cloud	safe
https://www.ss52611.com/vip.html?c=88003698540	0%	Avira URL Cloud	safe
https://service.sdqhwtvbtwdf.com/C.ashx?btag=a_18017b_2484c_&affid=2017190&siteid=18017&adid=2484&c=	0%	Avira URL Cloud	safe
https://1k4ej4j1lxvjwz.com/imgs/kaiyun.png	0%	Avira URL Cloud	safe
http://kaiyunty583.net	0%	Avira URL Cloud	safe
https://m399227.com	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/themes/style/common.css	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/icon_marquee.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js	0%	Avira URL Cloud	safe
http://james.padolsey.com)	0%	Avira URL Cloud	safe
https://www.activeselfie.com/images/ico_search.png	100%	Avira URL Cloud	phishing
https://p3yw7u.innittapp.com/ftl/commonPage/js/websocket/CometMarathon.js	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_5.png	0%	Avira URL Cloud	safe
https://1k4ej4j1lxvjwz.com/imgs/2025shiyunhui.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/components/selectPure.js?v=1736150851437	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10050/1719344563012.jpg)	0%	Avira URL Cloud	safe
https://wy-ali.meriksenrusso.com/wx/app/proxy-qrcode.html?url=aHR0cHM6Ly9hcHBpc28tdHkuenZiempzYi5jb2	0%	Avira URL Cloud	safe
https://1k4ej4j1lxvjwz.com/imgs/tychongse.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/commonPage/js/layer.js	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/hot_game_title.png	0%	Avira URL Cloud	safe
https://lucky298.com/vsglat	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/themes/base.css	0%	Avira URL Cloud	safe
https://www.activeselfie.com/index.vsb.css	100%	Avira URL Cloud	phishing
https://1k4ej4j1lxvjwz.com/imgs/2025fajia.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/home/TopPage.js?v=1736150851437	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_fish_42_5.png	0%	Avira URL Cloud	safe
https://e977110.com/wap/downloadApp?promoCode=pK8XQc	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/msites/themes/default/common.css?v=1736150851437	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10008/1719344412734.jpg)	0%	Avira URL Cloud	safe
https://www.ljjapp2.com/?601158	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/download_bg.png	0%	Avira URL Cloud	safe
https://551000l.cc/favicon.ico	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/images/errors/blue-bg.jpg	0%	Avira URL Cloud	safe
https://11073377.app	0%	Avira URL Cloud	safe
https://j21716.com	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/ftl/commonPage/themes/gui-layer.css	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/common/themes/default/font-awesome/font-awesome.css	0%	Avira URL Cloud	safe
https://wros8.top/vjS2	0%	Avira URL Cloud	safe
https://www.activeselfie.com/images/slider-arrow.png	100%	Avira URL Cloud	phishing
https://a43389.cc/	0%	Avira URL Cloud	safe
https://www.activeselfie.com/style/style.css	100%	Avira URL Cloud	phishing
https://1k4ej4j1lxvjwz.com/imgs/gf.fc8d6758.png	0%	Avira URL Cloud	safe
https://p3yw7u.innittapp.com/061410/rcenter/msites/themes/default/style.css	0%	Avira URL Cloud	safe
https://www.activeselfie.com/@public/base.js	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
1k4ej4j1lxvjwz.com	122.10.50.210	true	false	unknown
551000l.cc	154.193.113.233	true	false	unknown
l5-global.gslb.ksyuncdn.com	103.155.16.134	true	false	high
www.wshifen.com	103.235.46.96	true	false	high
d3h3opd4qa0dfk.cloudfront.net	13.32.121.43	true	false	unknown
www.google.com	142.250.185.132	true	false	high
vkg.hpdbfezgrqwn.vip	122.10.26.202	true	false	unknown
www.sogou.com	43.153.236.147	true	false	high
k1.gslb.ksyuncdn.com	42.56.77.129	true	false	high
www.activeselfie.com	154.216.143.8	true	false	high
p.ssl.qhimg.com	unknown	unknown	false	high
p3yw7u.innittapp.com	unknown	unknown	false	unknown
www.baidu.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://p3yw7u.innittapp.com/061410/rcenter/common/js/jquery/plugins/jquery.poshytip/jquery.poshytip.js?v=1736150851437	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/ClassTool.js?v=1736150851437	false	Avira URL Cloud: safe	unknown
https://www.activeselfie.com/images/tt_bg.png	true	Avira URL Cloud: phishing	unknown
https://p3yw7u.innittapp.com/061410/rcenter/msites/themes/base.css	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/js/bootstrap/bootstrap.js?v=1736150851437	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/commonPage/themes/hongbao.css	false	Avira URL Cloud: safe	unknown
https://551000l.cc/message_zh_CN.js?v=1736150851437	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/urlencode.js	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/themes/default/jquery/plugins/jquery.poshytip/poshytip.css	false	Avira URL Cloud: safe	unknown
https://www.activeselfie.com/images/banner_02.jpg	false	Avira URL Cloud: phishing	unknown
https://www.sogou.com/web/index/images/logo_440x140.v.4.png	false		high
http://www.activeselfie.com/	true		unknown
https://p3yw7u.innittapp.com/ftl/commonPage/themes/gui-skin-default.css	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/main.js	false	Avira URL Cloud: safe	unknown
https://www.activeselfie.com/js/jquery.SuperSlide.js	false	Avira URL Cloud: phishing	unknown
https://www.activeselfie.com/	false		unknown
https://p3yw7u.innittapp.com/ftl/commonPage/js/websocket/Comet.js	false	Avira URL Cloud: safe	unknown
https://1k4ej4j1lxvjwz.com/imgs/sansanqiqi.png	false	Avira URL Cloud: safe	unknown
https://1k4ej4j1lxvjwz.com/popper.min.js	false	Avira URL Cloud: safe	unknown
https://www.activeselfie.com/sitegray/sitegray.js	false	Avira URL Cloud: phishing	unknown
https://p3yw7u.innittapp.com/ftl/commonPage/js/float.js	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/msites/themes/default/login.css	false	Avira URL Cloud: safe	unknown
https://1k4ej4j1lxvjwz.com/imgs/188jinbaobo.png	false	Avira URL Cloud: safe	unknown
https://1k4ej4j1lxvjwz.com/quicklink.umd.js	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/js/curl/curl/loader/legacy.js?v=1736150851437	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/commonPage/js/idangerous.swiper.min.js	false	Avira URL Cloud: safe	unknown
https://vkg.hpdbfezgrqwn.vip/wdzmr.php	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/commonPage/js/jquery/jquery.super-marquee.js	false	Avira URL Cloud: safe	unknown
https://551000l.cc/?__CBK=388267276e284239fb05201c095bbfcb01736640552_6738556	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/static/js/gb.validation.min.js?v=1736150851437	false	Avira URL Cloud: safe	unknown
https://1k4ej4j1lxvjwz.com/css/modalStyles.css	false	Avira URL Cloud: safe	unknown
https://1k4ej4j1lxvjwz.com/imgs/kaiyun.png	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/themes/style/common.css	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js	false	Avira URL Cloud: safe	unknown
https://www.activeselfie.com/images/ico_search.png	false	Avira URL Cloud: phishing	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/components/selectPure.js?v=1736150851437	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/commonPage/js/websocket/CometMarathon.js	false	Avira URL Cloud: safe	unknown
https://1k4ej4j1lxvjwz.com/imgs/2025shiyunhui.png	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/commonPage/js/layer.js	false	Avira URL Cloud: safe	unknown
https://1k4ej4j1lxvjwz.com/imgs/tychongse.png	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/themes/base.css	false	Avira URL Cloud: safe	unknown
https://1k4ej4j1lxvjwz.com/imgs/2025fajia.png	false	Avira URL Cloud: safe	unknown
https://www.activeselfie.com/index.vsb.css	false	Avira URL Cloud: phishing	unknown
https://p3yw7u.innittapp.com/061410/rcenter/msites/themes/default/common.css?v=1736150851437	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/home/TopPage.js?v=1736150851437	false	Avira URL Cloud: safe	unknown
https://551000l.cc/favicon.ico	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/images/errors/blue-bg.jpg	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/commonPage/themes/gui-layer.css	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/themes/default/font-awesome/font-awesome.css	false	Avira URL Cloud: safe	unknown
https://www.activeselfie.com/images/slider-arrow.png	false	Avira URL Cloud: phishing	unknown
https://www.activeselfie.com/style/style.css	false	Avira URL Cloud: phishing	unknown
https://1k4ej4j1lxvjwz.com/imgs/gf.fc8d6758.png	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/msites/themes/default/style.css	false	Avira URL Cloud: safe	unknown
https://www.activeselfie.com/@public/base.js	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.4a0kzf.com/Yvj3	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/moment/moment/issues/1423	chromecache_205.2.dr	false		high
https://p3yw7u.innittapp.com/ftl/commonPage/zh_CN/pubads/images/ads2.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_1.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
http://stackoverflow.com/questions/181348/instantiating-a-javascript-object-by-calling-prototype-con	chromecache_205.2.dr	false		high
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_6.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://appiso-ali.ghgdfdf.com/?cGkxMl90NDA3MQ==&c=101105706293#/	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/commonPage/images/default-banner.jpg	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/moment/moment/issues/1548	chromecache_205.2.dr	false		high
https://xj206.cc/	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.j	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_293.2.dr	false		high
https://789400.cc/	chromecache_264.2.dr, chromecache_204.2.dr, chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_347.2.dr, chromecache_227.2.dr	false		high
https://github.com/moment/moment/issues/1779	chromecache_205.2.dr	false		high
https://cdn.livechatinc.com/tracking.js	chromecache_263.2.dr	false		high
http://12aff.best5689.com/92043302/signup/cs/index.html	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html	chromecache_205.2.dr	false		high
https://www.so.com/	chromecache_295.2.dr	false		high
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_5.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/services_title_bg.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10048/1719344459903.jpg)	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/icon_game_5.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/header/header_bg.jpg	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/fserver	chromecache_179.2.dr, chromecache_300.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_2.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://www.ss52611.com/vip.html?c=88003698540	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://service.sdqhwtvbtwdf.com/C.ashx?btag=a_18017b_2484c_&affid=2017190&siteid=18017&adid=2484&c=	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://m399227.com	chromecache_204.2.dr, chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
http://kaiyunty583.net	chromecache_264.2.dr, chromecache_204.2.dr, chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/icon_marquee.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
http://james.padolsey.com)	chromecache_156.2.dr, chromecache_215.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10050/1719344563012.jpg)	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/collabor_5.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://wy-ali.meriksenrusso.com/wx/app/proxy-qrcode.html?url=aHR0cHM6Ly9hcHBpc28tdHkuenZiempzYi5jb2	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/hot_game_title.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://lucky298.com/vsglat	chromecache_264.2.dr, chromecache_204.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/game_fish_42_5.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://e977110.com/wap/downloadApp?promoCode=pK8XQc	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/fserver/files/gb/1761/carousel/10008/1719344412734.jpg)	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://p3yw7u.innittapp.com/ftl/bet365-1761/images/index/download_bg.png	chromecache_225.2.dr	false	Avira URL Cloud: safe	unknown
https://www.ljjapp2.com/?601158	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://j21716.com	chromecache_204.2.dr, chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://11073377.app	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://a43389.cc/	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown
https://wros8.top/vjS2	chromecache_263.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.155.16.134	l5-global.gslb.ksyuncdn.com	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	false
154.193.113.233	551000l.cc	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	false
122.10.26.202	vkg.hpdbfezgrqwn.vip	Hong Kong	139817	GIGALINK-AS-APHONGKONGGIGALINKNETWORKLIMITEDHK	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
103.235.46.96	www.wshifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
122.10.50.210	1k4ej4j1lxvjwz.com	Hong Kong	134548	DXTL-HKDXTLTseungKwanOServiceHK	false
13.32.121.43	d3h3opd4qa0dfk.cloudfront.net	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
42.56.77.129	k1.gslb.ksyuncdn.com	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
154.216.143.8	www.activeselfie.com	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
103.198.200.7	unknown	China	55720	GIGABIT-MYGigabitHostingSdnBhdMY	false
43.153.236.147	www.sogou.com	Japan	4249	LILLY-ASUS	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589325
Start date and time:	2025-01-12 01:07:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.activeselfie.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@19/323@42/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.250.186.174, 108.177.15.84, 142.250.184.206, 216.58.206.46, 142.250.185.206, 2.22.50.131, 192.229.221.95, 199.232.214.172, 142.250.186.46, 142.250.185.110, 216.58.206.78, 172.217.16.206, 142.250.186.99, 142.250.181.238, 184.28.90.27, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://www.activeselfie.com/

Input	Output
URL: http://www.activeselfie.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://www.activeselfie.com
URL: https://www.activeselfie.com/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script has a few moderate-risk indicators, such as encoding the search query using Base64 and disabling auto-enable on a form field. However, it does not appear to have any high-risk behaviors like dynamic code execution or data exfiltration. The script seems to be focused on handling a simple search functionality, so the overall risk is assessed as medium." }
function _nl_ys_check(){ var keyword = document.getElementById('showkeycode258243').value; if(keyword==null\|\|keyword==""){ alert(""); return false; } if(window.toFF==1) { document.getElementById("lucenenewssearchkey258243").value = Simplized(keyword ); }else { document.getElementById("lucenenewssearchkey258243").value = keyword; } var base64 = new Base64(); document.getElementById("lucenenewssearchkey258243").value = base64.encode(document.getElementById("lucenenewssearchkey258243").value); new VsbFormFunc().disableAutoEnable(document.getElementById("showkeycode258243")); return true; }
URL: https://551000l.cc/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a configuration or setup code for a web application. It sets up various root paths and variables, handles iframe language settings, and defines a common set of parameters for API requests. There are no clear indicators of high-risk behaviors, such as dynamic code execution, data exfiltration, or suspicious redirects. The code seems to be focused on setting up the application's infrastructure and does not exhibit any malicious intent." }
var resRoot = 'https://p3yw7u.innittapp.com/061410/rcenter/msites'; var wsRoot = '/mdcenter/websocket/msite'; var mdRoot = '/mdcenter/msite.comet'; var fltRootPath = 'https://p3yw7u.innittapp.com/ftl/'; var useBase64 = base64List.includes(1761); //iframe try{window.top.language='zh-CN';}catch(ex){window.language='zh-CN';} // try{window.top.timeLanguage='zh-CN';}catch(ex){window.timeLanguage='zh-CN';} // 202172 const commonParameter = { locale: "zh_CN", terminal: "pc", is_native: false, version: "v3055", resolution: "2x", };
URL: https://1k4ej4j1lxvjwz.com/... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a simple function that delays the loading of a background image for an element with the class 'box[data-v-5371a066]'. This is a common technique used to improve the initial page load performance by deferring the loading of non-critical resources. The code does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or suspicious redirects. The functionality is straightforward and does not raise any major security concerns." }
window.onload = function() { // function loadBackgroundImage() { var boxElement = document.querySelector('.box[data-v-5371a066]'); // 1 setTimeout(function() { boxElement.style.backgroundImage = 'url(../imgs/bg.lanse.jpg)'; // URL }, 1000); // 1000 = 1 } // loadBackgroundImage(); }
URL: https://www.activeselfie.com/... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a simple DOM manipulation operation, which is a common and benign practice. It sets the `innerHTML` property of an element with the ID `c_lunar258240` to the value of the `c_Calendar258240ShowString` variable. This behavior is consistent with typical web development practices and does not exhibit any high-risk indicators." }
document.getElementById("c_lunar258240").innerHTML = c_Calendar258240ShowString;
URL: https://551000l.cc/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be implementing Facebook Pixel functionality, which is a common analytics and tracking tool used by many websites. While the snippet does dynamically generate and insert a Facebook Pixel script and an associated noscript tag, this behavior is typical for integrating the Facebook Pixel and does not exhibit any high-risk indicators. The script is interacting with a known, reputable domain (facebook.com), and the overall intent seems to be for legitimate analytics and tracking purposes. Therefore, the risk score is assessed as low (3)." }
var fpixelid = sessionStorage.getItem('fpixelid') \|\| false if(fpixelid){ var script = document.createElement('script'); script.innerHTML = `!function(f,b,e,v,n,t,s) {if(f.fbq)return;n=f.fbq=function(){n.callMethod? n.callMethod.apply(n,arguments):n.queue.push(arguments)}; if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0'; n.queue=[];t=b.createElement(e);t.async=!0; t.src=v;s=b.getElementsByTagName(e)[0]; s.parentNode.insertBefore(t,s)}(window, document,'script', 'https://connect.facebook.net/en_US/fbevents.js'); fbq('init', '${fpixelid}'); fbq('track', 'PageView');`; var noscript = document.createElement('noscript'); var img = document.createElement('img'); img.setAttribute('height', '1'); img.setAttribute('width', '1'); img.setAttribute('style', 'display:none'); img.src = `https://www.facebook.com/tr?id=${fpixelid}&ev=PageView&noscript=1`; var head = document.head \|\| document.getElementsByTagName('head')[0]; head.appendChild(script); head.insertBefore(noscript, script); noscript.appendChild(img); }
URL: https://551000l.cc/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript code appears to be a legitimate function that checks the login status of a user and adjusts the visibility and behavior of a sign-in button accordingly. It makes an AJAX request to retrieve the activity status and sign-in switch settings, and then updates the button's appearance and functionality based on the response. While the code uses some legacy practices like `sessionStorage` and `XDomainRequest`, it does not exhibit any high-risk behaviors like dynamic code execution or data exfiltration. The overall functionality seems to be related to a typical user sign-in feature, and the code is not obfuscated or suspicious." }
/** * checkSignSwitch (/,) * * & * : _vr_signSwitch * 2021/1/8 Dear / function checkSignSwitch(showTips) { // var isLogin = sessionStorage.is_login; // var buttons = $("._vr_signSwitch"); if (buttons.length > 0) { /; {:, :}/ if (isLogin === "true") { buttons.attr({ href: "/pcenter-client/pcenter/#/pcenter-client/sign", target: "_blank" }) } else { buttons.attr({ href: "javascript:loginPlayer(this)" }) } $.ajax({ url: "/mobile-api/v5/chess/getActivityMsg.html", type: "get", data: { "function": "sign" }, dataType: 'json', success: function (res) { /open {1:, 0:}/ if (res.data.isSign !== null && res.data.signSwitch.open === 1) { / ; {false:, true \| null: }; / var page = location.pathname; if (res.data.isSign === false && (page === "/index.html" \|\| page === "/")) { // showTips && alert("!!"); } else { // buttons.hide(); // buttons.removeClass("text-warning") /-*/ } buttons.addClass('switchOn') $('._vr_loginSuccess ._vr_signSwitch').css({"display":"inline", "visibility": "visible"}); }else { buttons.removeClass('switchOn') $("._vr_loginSuccess .panel_sign").css("display","none"); } } }); } }
URL: https://551000l.cc/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a legitimate script that handles the functionality of a red packet (hongbao) promotion. It makes AJAX requests to retrieve data related to the promotion, such as the activity ID and the red packet theme. The script also handles the display and logic of the red packet feature, including checking the user's login status and remaining draw times. While the script uses some legacy practices like `XDomainRequest`, it does not exhibit any high-risk behaviors like dynamic code execution or data exfiltration. The script's purpose and functionality seem to be aligned with a typical promotional campaign, so the overall risk score is low." }
var activityMessageId = ""; // ID = searchId var redBagTheme = ""; // var readFloat; getFloat(); // function getFloat() { const data = Object.assign({}, commonParameter) $.ajax({ url: "/mobile-api/v5/origin/getFloat.html", type: "POST", dataType: "json", data: data, success: function (res) { if (res.code === "0") { if (res.data.activity) { activityMessageId = res.data.activity.activityId; redBagTheme = res.data.activity.redBagTheme; } sessionStorage["getFloat"] = JSON.stringify(res); if (typeof floatV5Main === "function") floatV5Main(); // } }, error: function (res) { console.log(res); } }).done(function() { readFloat = setInterval(function() { if($('#float-v5').length > 0) { replaceInfo("source-src-float", "src") clearInterval(readFloat) } }, 500) }) } // function canShowLottery() { if (sessionStorage.is_login !== "true") { loginObj.getLoginPopup(); return; } if (!activityMessageId) { $(".hongbao").removeClass('disabled'); $("#tip-msgs").html('!'); $(".hongbao-time-txt").hide(); $(".hongbao-time").hide(); return; } $(".hongbao").addClass('hide_hongbao'); $(".hongbao-msg-tips").hide(); $.ajax({ url: "/activity-api/v5/activityOrigin/countDrawTimes.html", type: "POST", dataType: "JSON", data: Object.assign({}, commonParameter, {activityMessageId: activityMessageId}), success: function (res) { if (res.code === "0") { if (redBagTheme === "redbag02") { $("#hongbao_inner").removeClass(); $("#hongbao_inner").addClass("hongbao_inner02"); $(".redbag02").show(); $("#target01").removeClass("hongbao-time-txt"); $("#target02").removeClass("hongbao-time"); $("#target03").addClass("hongbao-time-txt"); $("#target04").addClass("hongbao-time"); } else { $("#hongbao_inner").removeClass(); $("#hongbao_inner").addClass("hongbao_inner01"); $(".redbag01").show(); $("#target01").addClass("hongbao-time-txt"); $("#target02").addClass("hongbao-time"); $("#target03").removeClass("hongbao-time-txt"); $("#target04").removeClass("hongbao-time"); } $("#hongbao_detail").fadeIn(600); $("#tip-msgs").show(); if (res.data.drawTimes && res.data.drawTimes > 0) { $(".hongbao").removeClass('disabled'); $("#tip-msgs").show(); $("#tip-msgs").html('<span id="ramain-count">' + res.data.drawTimes + '</span>'); $(".hongbao-time-txt").hide(); $(".hongbao-time").hide(); } else if (res.data.drawTimes === 0) { if (res.data.isEnd === "false") { $(".hongbao").addClass('disabled'); $("#tip-msgs").show(); $("#tip-msgs").html('<span id="ramain-count">0</span>'); $("#ramain-count").text(res.data.drawTimes); } else {
URL: https://551000l.cc/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript code appears to be a legitimate implementation of a language switching dialog. It uses the Layui library to create a modal dialog, and the functionality is focused on saving the user's language preference to session storage and cookies. There are no obvious high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to suspicious domains. The code seems to be following common practices for handling user preferences and language switching, which is a common requirement for web applications. While there are some moderate-risk indicators, such as the use of `XDomainRequest` and aggressive DOM manipulation, these are likely due to the specific implementation details and do not appear to be malicious in nature. Overall, the code seems to be a well-intentioned feature implementation with no clear signs of malicious intent." }
/** * PC * title: * skin: * area: * transparent: * updateTime: / function layerLangDialogIndex(title, content, skin, area, btnAlign, transparent, updateTime) { var dialog = layer.open({ type: 1, time: 0, // closeBtn: 0, shadeClose: false, content: content, title: title, move: ".layui-layer-title", btnAlign: 'c', skin: skin, area: area, btn: [' (No)', ' (Yes)'], success: function (layer) { // //$(layer).find('.layui-layer-btn ').html('<a class="layui-layer-btn0 _close"></a>'); // $(layer).addClass("index-modal"); // if(!!transparent){ $(layer).addClass("index-modal-transparent"); } }, btn1:function(){ // // 1.''session 2.cookie 3. window.sessionStorage["selected_language"] = 'zh_CN'; document.cookie = 'switched_language=true'; layer.close(dialog); }, btn2:function(){ // // 1.'en_US' or 'hi_IN'session 2.cookie 3.'en_US' or 'hi_IN'cookie 4. 5. var switchLanguage = '' window.sessionStorage["selected_language"] = switchLanguage; document.cookie = 'switched_language=true'; document.cookie = '_LANGUAGE=' + switchLanguage; layer.close(dialog); window.location.reload(); } }); } /* * * sessionStorage.selected_language: null \|\| language / function langDialog() { var content = '<p class="switch-txt"> </p><p class="switch-txt switch-txt-hi">Do you want to switch language into English</p>' var title = ['', 'background-color: #2D2D2D; color: white']; // 1.switched_languagecookie if (filterSwitchedLanguage('switched_language') == 'false' \|\| filterSwitchedLanguage('switched_language') == null) { var languageLayer = layerLangDialogIndex(title, content, 'switch-language-wrap', ['500px', '230px'], '', false, false); } } /* * switched_languagecookie */ function filterSwitchedLanguage(query) { // cookie const cookies = document.cookie; // cookie cookie var cookiesArray = cookies.split("; "); // 'switched_language' cookie var cookie = cookiesArray.filter(function(el) { return el.toLowerCase().indexOf(query.toLowerCase()) > -1; }) // 'switched_language' cookie var switchedLanguageCookie = cookie.toString().split("="); // switched_languagecookie var cookieValue = switchedLanguageCookie[1]; return cookieValue }
URL: https://551000l.cc/... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript code appears to be a login-related functionality that handles various types of captcha mechanisms, including default captcha, word captcha, and slider captcha. While the code does not exhibit any obvious high-risk behaviors, such as dynamic code execution or data exfiltration, it does have some moderate-risk indicators. The code makes external data transmissions to fetch captcha data, and it uses multiple fallback domains, some of which may be of unknown or dubious reputation. Additionally, the code performs aggressive DOM manipulation by replacing the HTML content of an element. These factors contribute to a medium-risk score, indicating the need for further review and monitoring to ensure the code's legitimacy and security." }
/** * / var initCaptcha = { defaultCaptcha : '2',// wordCaptcha : '1', // sliderCaptcha : '0', // freshCaptcha : 'freshCaptcha', dalogEnd:'end', captchaDialog: null, dealwithHtml: function () { var html = $("#login-initCaptcha").html(); html = html.replace("demo2", "new-captcha-id"); return html; }, captchaStatus : { init : 'init', fresh : 'fresh', }, /* * PC * @param dialogCloseOrCaptchaChangeCallbackFun * @param checkFinshCallbackFun * @param args / initCaptchaPopup: function (dialogCloseOrCaptchaChangeCallbackFun, checkFinshCallbackFun,args) { var init = true; initCaptcha.getInitParam(initCaptcha.captchaStatus.init, dialogCloseOrCaptchaChangeCallbackFun, null, checkFinshCallbackFun,args); }, /* * PC * @param receiveInitParamFun * @param dialogCloseOrCaptchaChangeCallbackFun * @param reloadCaptchaFun // * @param checkFinshCallbackFun //yong * @param args * @param url //forgetPwd.ftl api */ getInitParam: function (captchaStatus, dialogCloseOrCaptchaChangeCallbackFun, reloadCaptchaFun, checkFinshCallbackFun,args) { var init_data ={}; var url = window.location.pathname.indexOf('forgetPwd.html') > -1 ? "/site/captcha/init.html?type=forgetPassword" : importAccount ? "/site/captcha/init.html?type=importPlayer" : "/site/captcha/init.html" if(typeof(args) == "object"){ init_data["type"]=args["op"]; } $.ajax({ url: url, data: init_data, dataType: 'json', async: false, success: function (data) { // if (typeof (reloadCaptchaFun) == "function") { reloadCaptchaFun(data,dialogCloseOrCaptchaChangeCallbackFun, checkFinshCallbackFun,args); } // if (typeof (captchaStatus) != "undefined" && captchaStatus == initCaptcha.captchaStatus.init) { initCaptcha.receiveInitParamFun(data, dialogCloseOrCaptchaChangeCallbackFun, checkFinshCallbackFun,args); } }, error: function (error) { //TODO console.log(error); // var data = {}; data['captchaType']=initCaptcha.defaultCaptcha; data['op']=initCaptcha.dalogEnd; dialogCloseOrCaptchaChangeCallbackFun(data, checkFinshCallbackFun,args); return undefined; } }); }, // receiveInitParamFun: function (data, dialogCloseOrCaptchaChangeCallbackFun, checkFinshCallbackFun,args) { var isOpenCaptcha = data["isOpenCaptcha"]; if (!isOpenCaptcha && !importAccount) { checkFinshCallbackFun(data,args); return; } var captchaType = data['data']['captchaType']; var temp_data = data['data']['captchaData']; // if (captchaType == initCaptcha.defaultCaptcha) { // data['captchaType']=initCaptcha.defaultCaptcha; data['op']=initCaptcha.freshCaptcha; dialogCloseOrCaptchaChangeCallbackFun(data, checkFinshCallbackFun,args); return; } // if (captchaType == '0' \|\| captchaTy
URL: https://551000l.cc/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet appears to be a part of a larger application that handles the display of a floating promotional banner or widget. While the code does not contain any obvious high-risk indicators, it exhibits some moderate-risk behaviors that warrant further review. The script dynamically manipulates the DOM, loads external resources, and interacts with session storage, which could potentially lead to security issues if not implemented properly. Additionally, the use of obfuscated or hardcoded URLs and the handling of user data (e.g., language, location) without clear transparency raises some concerns. Overall, the script requires closer inspection to ensure that it is not engaging in any malicious activities and that it is following best practices for web security." }
$(function(){ loadStyleString("#float-v5 .float-v5-item .list-item.top_close_btn", "/commonPage/themes/images/hongbao/icon-close-1.png",true,true); }) function floatV5Main() { $('#float-v5 > div').remove(); // const getFloat = JSON.parse(sessionStorage.getFloat); const _activity = getFloat.data.activity; const _customerFloats = getFloat.data.customerFloats; // -; <>null; <> ; if (!!_activity && !!_activity.id) { const isShow = displayInPage(_activity.displayInPages); // , zh_CNvi_VN let imgMap = { // '' '_hover' '7': '/ftl/commonPage/themes/images/hongbao/vi_VN/hongbao_type1_hover.png', '8': '/ftl/commonPage/themes/images/hongbao/vi_VN/hongbao_type2_hover.png', '9': '/ftl/commonPage/themes/images/hongbao/vi_VN/hongbao_type3_hover.png', }; let listItem = _activity.cttFloatPicItemList.map(function (item, index) { let imgWidth = (item.imgWidth \|\| 0) + 'px'; let imgHeight = (item.imgHeight \|\| 0) + 'px'; let imgUrl = item.normalEffect \|\| ''; let imgUrlHover = _activity.mouseInEffect ? item.mouseInEffect : ''; if (Object.keys(imgMap).includes(_activity.templateType)) { // , , imgWidth = 'auto'; imgHeight = 'auto'; if (['zh_CN', 'vi_VN'].includes(_activity.language)) { // , // imgUrl = imgMap[_activity.templateType].replace('vi_VN', _activity.language).replace('_hover', ''); imgUrlHover = imgMap[_activity.templateType].replace('vi_VN', _activity.language); // :'zh_CN/' if (imgUrl.indexOf('zh_CN/') !== -1) imgUrl = imgUrl.replace('zh_CN/', ''); if (imgUrlHover.indexOf('zh_CN/') !== -1) imgUrlHover = imgUrlHover.replace('zh_CN/', ''); } } return `<div class="list-item ${item.imgLinkType}" style="width: ${imgWidth}; height: ${imgHeight}"> <a href="javascript:${item.imgLinkType === 'close_btn' ? '' : 'canShowLottery()'}"> <img source-src-float="${cdnUrl + imgUrl}" alt="" class="img_default"> ${_activity.mouseInEffect ? `<img source-src-float="${cdnUrl + imgUrlHover}" alt="" class="img_hover">` : ''} </a> </div>` }) var floatV5Item = $('<div>', { 'data-fp': _activity.id, class: [ 'float-v5-item', 'redPacket', _activity.location, _activity.interactivity, _activity.hideCloseButton ? 'hideCloseButton' : '', _activity.showEffect ? 'show_effect' : '', _activity.mouseInEffect ? 'mouseInEffect' : '', isShow ? '' : 'hide', ].join(' '), 'data-displayinpages': _activity.displayInPages, 'data-templatetype': _activity.templateType \|\| "0", // 0 style: _style(_activity), }).append(listItem); // <> // if (!!_activity.hideCloseButton) floatV5Item.append('<div class="list-item close_btn top_close_btn"></div>'); if (!!_activity.hideCloseButton && Object.keys(imgMap).includes(_activity.templateType)) floatV5Item.append('<div class="list-item close_btn top_close_btn"></div>'); // $('#
URL: https://www.activeselfie.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " 6666 ", "prominent_button_name": "", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": true, "contains_fake_security_alerts": false }

Source: https://www.activeselfie.com/images/tt_bg.png	Avira URL Cloud: Label: phishing
Source: https://www.activeselfie.com/images/banner_02.jpg	Avira URL Cloud: Label: phishing
Source: https://www.activeselfie.com/js/jquery.SuperSlide.js	Avira URL Cloud: Label: phishing
Source: https://www.activeselfie.com/sitegray/sitegray.js	Avira URL Cloud: Label: phishing
Source: https://www.activeselfie.com/images/ico_search.png	Avira URL Cloud: Label: phishing
Source: https://www.activeselfie.com/index.vsb.css	Avira URL Cloud: Label: phishing
Source: https://www.activeselfie.com/images/slider-arrow.png	Avira URL Cloud: Label: phishing
Source: https://www.activeselfie.com/style/style.css	Avira URL Cloud: Label: phishing
Source: https://www.activeselfie.com/@public/base.js	Avira URL Cloud: Label: phishing

Source: https://www.activeselfie.com/	HTTP Parser: No favicon
Source: https://www.activeselfie.com/	HTTP Parser: No favicon
Source: https://www.activeselfie.com/	HTTP Parser: No favicon
Source: https://551000l.cc/	HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.activeselfie.com
Source: global traffic	DNS traffic detected: DNS query: vkg.hpdbfezgrqwn.vip
Source: global traffic	DNS traffic detected: DNS query: www.baidu.com
Source: global traffic	DNS traffic detected: DNS query: www.sogou.com
Source: global traffic	DNS traffic detected: DNS query: 1k4ej4j1lxvjwz.com
Source: global traffic	DNS traffic detected: DNS query: p.ssl.qhimg.com
Source: global traffic	DNS traffic detected: DNS query: 551000l.cc
Source: global traffic	DNS traffic detected: DNS query: p3yw7u.innittapp.com

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.activeselfie.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Windows Analysis Report
http://www.activeselfie.com/