Edit tour

Windows Analysis Report
http://www.nhtfxq.blogspot.ie/

Overview

General Information

Sample URL:	http://www.nhtfxq.blogspot.ie/
Analysis ID:	1596603
Infos:

Detection

Phisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Phisher

AI detected suspicious Javascript

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1912,i,334699762539384921,16501542920062052156,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.nhtfxq.blogspot.ie/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_776	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security
dropped/chromecache_776	JoeSecurity_Phisher_1	Yara detected Phisher	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_776, type: DROPPED

AI detected suspicious Javascript

Source: 0.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://nhtfxq.blogspot.com/... The script redirects the user to an untrusted domain ('https://my02000isreal.space/zxc.php'), which is a high-risk indicator of potential malicious activity such as phishing or malware distribution. This behavior scores 3 points for dynamic code execution. Additionally, the domain name appears suspicious, which adds 1 point for a suspicious domain. Overall, this script demonstrates highly suspicious behavior and poses a high risk to the user.

Source: https://ndrgnjy.shop/

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.umd.min.js

HTTP Parser: (function(global,factory){typeof exports==="object"&&typeof module!=="undefined"?module.exports=factory():typeof define==="function"&&define.amd?define(factory):(global=typeof globalthis!=="undefined"?globalthis:global||self,global.ethers=factory())})(this,function(){"use strict";var commonjsglobal=typeof globalthis!=="undefined"?globalthis:typeof window!=="undefined"?window:typeof global!=="undefined"?global:typeof self!=="undefined"?self:{};function getdefaultexportfromcjs(x){return x&&x.__esmodule&&object.prototype.hasownproperty.call(x,"default")?x["default"]:x}function createcommonjsmodule(fn,basedir,module){return module={path:basedir,exports:{},require:function(path,base){return commonjsrequire(path,base===undefined||base===null?module.path:base)}},fn(module,module.exports),module.exports}function getdefaultexportfromnamespaceifpresent(n){return n&&object.prototype.hasownproperty.call(n,"default")?n["default"]:n}function getdefaultexportfromnamespaceifnotnamed(n){return n&&object.prototype.hasownproper...

Source: https://ndrgnjy.shop/	HTTP Parser: No favicon
Source: https://ndrgnjy.shop/	HTTP Parser: No favicon
Source: https://ndrgnjy.shop/	HTTP Parser: No favicon
Source: https://ndrgnjy.shop/	HTTP Parser: No favicon
Source: https://ndrgnjy.shop/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49835 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.nhtfxq.blogspot.ieConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: nhtfxq.blogspot.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.nhtfxq.blogspot.ie
Source: global traffic	DNS traffic detected: DNS query: nhtfxq.blogspot.com
Source: global traffic	DNS traffic detected: DNS query: my02000isreal.space
Source: global traffic	DNS traffic detected: DNS query: pintopik.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ndrgnjy.shop
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: zora.co
Source: global traffic	DNS traffic detected: DNS query: op.zora.co
Source: global traffic	DNS traffic detected: DNS query: min-api.cryptocompare.com
Source: global traffic	DNS traffic detected: DNS query: esm.sh
Source: global traffic	DNS traffic detected: DNS query: pulse.walletconnect.org
Source: global traffic	DNS traffic detected: DNS query: api.web3modal.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50738
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50730
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50745
Source: unknown	Network traffic detected: HTTP traffic on port 50853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50747
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50740
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50741
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 50738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50754
Source: unknown	Network traffic detected: HTTP traffic on port 51008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50759
Source: unknown	Network traffic detected: HTTP traffic on port 50980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50758
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50752
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50768
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50762
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50761
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50763
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 50931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50705
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50708
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50710
Source: unknown	Network traffic detected: HTTP traffic on port 51033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50717
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50716
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50719
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50718
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 50865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 50771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50727
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown	Network traffic detected: HTTP traffic on port 51021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 50987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50343
Source: unknown	Network traffic detected: HTTP traffic on port 51001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50356
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 50685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 50923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50370
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50779
Source: unknown	Network traffic detected: HTTP traffic on port 50911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50778
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50772
Source: unknown	Network traffic detected: HTTP traffic on port 51025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50780
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50785
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 50791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 50955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50797
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 50828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 50915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 50952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 50639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49835 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@25/342@58/329

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1912,i,334699762539384921,16501542920062052156,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.nhtfxq.blogspot.ie/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1912,i,334699762539384921,16501542920062052156,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://www.nhtfxq.blogspot.ie/	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
http://nhtfxq.blogspot.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.193.229	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
zora.co	66.33.60.34	true	false	unknown
cname.vercel-dns.com	66.33.60.67	true	false	high
ndrgnjy.shop	104.21.70.105	true	false	unknown
esm.sh	172.67.203.138	true	false	unknown
blogspot.l.googleusercontent.com	142.250.184.225	true	false	high
api.web3modal.org	104.18.18.237	true	false	high
my02000isreal.space	91.195.13.29	true	true	unknown
pulse.walletconnect.org	104.18.20.250	true	false	high
min-api.cryptocompare.com	20.4.130.154	true	false	unknown
pintopik.com	91.222.173.30	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	172.217.16.196	true	false	high
www.nhtfxq.blogspot.ie	unknown	unknown	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	high
nhtfxq.blogspot.com	unknown	unknown	true	unknown
op.zora.co	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ndrgnjy.shop/	false		unknown
http://nhtfxq.blogspot.com/	false	Avira URL Cloud: safe	unknown
http://www.nhtfxq.blogspot.ie/	false		unknown
https://pintopik.com/hr.html	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
172.67.203.138	esm.sh	United States	13335	CLOUDFLARENETUS	false
104.21.70.105	ndrgnjy.shop	United States	13335	CLOUDFLARENETUS	false
104.18.20.250	pulse.walletconnect.org	United States	13335	CLOUDFLARENETUS	false
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
151.101.129.229	unknown	United States	54113	FASTLYUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.251.168.84	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
142.250.184.225	blogspot.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
66.33.60.67	cname.vercel-dns.com	Canada	13768	COGECO-PEER1CA	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
66.33.60.66	unknown	Canada	13768	COGECO-PEER1CA	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
91.222.173.30	pintopik.com	Ukraine	39249	KICUA-ASGI	false
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.161	unknown	United States	15169	GOOGLEUS	false
76.76.21.164	unknown	United States	16509	AMAZON-02US	false
104.18.19.237	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.234	unknown	United States	15169	GOOGLEUS	false
91.195.13.29	my02000isreal.space	Poland	61251	HOST4BIZ-ASPL	true
142.250.186.129	unknown	United States	15169	GOOGLEUS	false
104.21.77.20	unknown	United States	13335	CLOUDFLARENETUS	false
20.4.130.154	min-api.cryptocompare.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.18.237	api.web3modal.org	United States	13335	CLOUDFLARENETUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
66.33.60.34	zora.co	Canada	13768	COGECO-PEER1CA	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.222.219	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1596603
Start date and time:	2025-01-22 08:07:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://www.nhtfxq.blogspot.ie/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@25/342@58/329

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 142.250.186.46, 142.251.168.84, 172.217.18.14, 142.250.185.78
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: http://www.nhtfxq.blogspot.ie/

LLM Input / Output

Input	Output
URL: http://www.nhtfxq.blogspot.ie Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 0, "spoofed": 0, "reasoning": "The URL 'http://www.nhtfxq.blogspot.ie' does not appear to mimic any known brand. The domain 'blogspot.ie' is a legitimate blogging platform provided by Google, and the subdomain 'nhtfxq' does not resemble any well-known brand or service. There are no visual character substitutions or structural changes that suggest an attempt to imitate a legitimate brand. The use of the '.ie' domain extension is appropriate for Ireland and does not imply any deceptive intent. Overall, the URL seems to be a personal or unrelated blog, and there is no indication of typosquatting."}
URL: http://www.nhtfxq.blogspot.ie
URL: https://nhtfxq.blogspot.com/... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "The script redirects the user to an untrusted domain ('https://my02000isreal.space/zxc.php'), which is a high-risk indicator of potential malicious activity such as phishing or malware distribution. This behavior scores 3 points for dynamic code execution. Additionally, the domain name appears suspicious, which adds 1 point for a suspicious domain. Overall, this script demonstrates highly suspicious behavior and poses a high risk to the user." }
window.location="https://my02000isreal.space/zxc.php";
URL: https://ndrgnjy.shop/... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script exhibits several high-risk behaviors, including data exfiltration, obfuscated code, and the use of dynamic code execution. While the script may have a legitimate purpose, such as analytics or tracking, the aggressive and opaque nature of its implementation raises significant security concerns. Further investigation is warranted to determine the true intent and potential impact of this script." }
(function(){window._cf_chl_opt={cvId: '3',cZone: "ndrgnjy.shop",cType: 'managed',cRay: '905db5935e700be1',cH: 'zZ1D7xL7c_OOrJ48Mnv0vQSLtRnZpRaZLfgGkWcQySQ-1737529669-1.2.1.1-b.u49_2NjNGcbsgLt96LfE.duYLcL6GPfKJfAzLkarS9EHwwwtwOv5ee7ACzOo07',cUPMDTk: "\/?__cf_chl_tk=Mk__gavLEETUjobLzOYkWSGcuVnuSyM.VMOoiFEsOsE-1737529669-1.0.1.1-6P0KDPIjJJfHXLFP5FcJLJhBRu8V8J4mkXMQgRvzRaY",cFPWv: 'g',cITimeS: '1737529669',cTTimeMs: '1000',cMTimeMs: '390000',cTplC: 0,cTplV: 5,cTplB: 'cf',cK: "",fa: "\/?__cf_chl_f_tk=Mk__gavLEETUjobLzOYkWSGcuVnuSyM.VMOoiFEsOsE-1737529669-1.0.1.1-6P0KDPIjJJfHXLFP5FcJLJhBRu8V8J4mkXMQgRvzRaY",md: "eIaKmkBP3aMo4C.rymQ1Q2q5Y1xv5ErHmPEy5oQtasw-1737529669-1.2.1.1-ApW_BWs4.Zq4pbVWFxJMyy518FVRhm2Lq_KwPHLRVCKrmAlPfzYM9hc0DHciGyOkgAMN.Ok2p1IMtBbA7UBxN8HQswhhLlTTGqIlUoywnllRbC7gJ6dk_3AtPQcf8ept8iL4ZseEfVHCPUeby_17kMcPjTjY1z0177I_50LqkW8wLoEmkg8o3iyxWpznPscCd65dKyYXJr2p4GVVPRyNbVhRO2i22n3G44JDEfXk2f05lzkCM7t8_2jA88bXEV9PejZxcGpsdONu4ZXlYlfnc5VRtDYopCI2dvpJBYrwu4CttfbwbVX7HY4nko1htL_DgcoEbcYUKLto7djwJlxCQqbMCukxhZTFti1g1CJ354urdY6HZzKQ0dNz5.kvED7PIV1Bf4TPNa5cmn9xNZYQEwzftT4oc7A3LIKXVJHfwdbltQ2F_.wbOD0cRXyS8CoUenUKmIxmWAYJAaFnD5VWiKJNZtZtoNL1waibNTs0juDMa7egX.vy8iThCdFWHVqr5twzWyR9chN0GPNR.nG7Mc91IOdsAy55nmvrbE.4lZQd3OnRgoOtsun5M08.DralBLx2iVnltsamZepT0nbDDGaKvnwx7kQQq_oB5ofgm048Keyqc39rK6xRUEVxehdwCb2_Gak41ZMfBu4GrRTQ07dOorNR1F030W_NsLvk6Qe2w8as8WWTcHQ6IqMeBz9T1b7J3NRBeCVy_ct7m..DEN7AL.v_53v082AhhCU1K1apO4wXQ_4K9NXmyD6rtzfkp8xduyiG4XrWtMZg5Dui5xe4stbb.pnbNcnTyneM1pexLvu3pXTDFh88VmejtNsi1jUZYXA0JxGGwqyC2sbqUzG_h0o1JMNXcT2R0fo..cT3qJBupHgGxp2Ft3umF9BtRAkURz.VyAWkRGridXmTNRsOf6yTZWHNwjZdx.37xxcJo43.5qJSzFFCFvJvERIn31nGEty9kaqHrDV6qDelPYUXJfXCJMOkau2U92FfcHjKuZTMq6LFxExfhUNkwbUF.eNL0psBCnu6dThXpc0rcZz_27YZKiZnd.4IU.W2.ESYbW1l_YkgPnF5AGRDPz9N02hnPzRlaL9.mi0gborStf.GXzKg1RDXPCSQMbW51JcpKy7OdNjeRM.VzIz1ejhmZHUBVy.n0V9zPXj7avEd6TImK6Uz4pqL0O1upzE2t.0VF.46cQxVYCzftTvqgo4wOJHGcnJCvsxSC2veUYsBemoUEvbJUk.po6l03r2pjvGWPJ8UoRHSGCSfLlK93OsH7kyfQxhKYwxQMJss4auXT_ZcpIC6g3YUBEG7KeQt5ESU_NwBbNdSTl7DhsQorm7PHAFFrhEcVSKfadAmgJe.PFazHF75D9PllFHFqi2S8uSqt_z1naoeYDF4wASw_L9VDJJ0ECBGYVBKNe5qBgAO32Bj0a4fbG1v5AKIzyYvtwd8M_ImBft984DxpplSxL_ZGUPOUZIRNVpI5OODiLnOrBFipAV5AD5AfuYOz6e9NJHJujTxwRqO5cG304X6q5vnbjCrJvOnVGEUrzSkxghhmY1wXpsAlwgwI63_Zb_ozUux.OcFznAiJvsVHsOEOE4lcwjYu4WHH0VQ.zi3BU3uv6kagv5io_YSeQ_PA7mQnResGQg7b9XJcpaPhlqAPsjGkwhM07KVZu19l4QR8i3FCEmiynxxEu0.36mhhXRbe6aSQRV85irUVcH0tl6EGuwJjK220HQHnzEHUnxNzEX3VinMQSE3Q3HVY3Ug3UE1fkPV5W3CWGXlGtddhggT3Z4M6sMrT6KkL67UbS2kJG4WsiUmOsW6e7fM1EBmk1HPE.tCaj8PLYNFPBwWzGXkspc7ZqoJZV88PceC74Lnec3_7HBbJaI7GZdSWUlZvt_rfhDV.boPYOLRhTeOgz3k7UwaatyKkGdbclviJhbAOLtJ6tVxXsOs5n4.RqSk2A1OLzVV65UwNJfZ1T8t1Fu7YOKJyW33_LzyHtfeNadJt5C49T1n.798LjtNOkGA_5XXUM5taweZYrfKujKwX..i5zZyz7pTv_U5QVewW8Ik9Ke.lJzX1Pibu5LJ4wZ.fYheHqImUt0gB6KeL6PMcdiHlfq090OC2u0Qy_AwfjQeRHhO_CDyzA_SS70wmLoj5J4DbWExm4UGYYbK5gz3_yfJ3mfSQpr9.2B4t03TE.GHdE1qzLtB8R__teFn2ZBoODwCnnz87Iiw226jNIU5mhvxmWaJ3lIzoXGg_GikKg89sVRpta3RKJ1JL5IMqTH_LAWMmZoo3uy3Et6trNFsXWt.7HVCXCQOZIo3f4RGaMR0lff4z8hBVlOP67I2.bHy9uGCoWLgqepw1swqCHJh4PkkE.LF8L0XWGYWTdV155pdHwiuKB3PhfHi1DnPz2a0kh8hYjQ",mdrd: "6ffTs.Az_XUjTIXP0hyvgQscMqUZ2dxuUgmGMCklE3o-1737529669-1.2.1.1-XT9MmsAvuyVu2ZcXCanaT16B7w2SwPMi.7GzkGSw1SCyVg7APlnp26vN1FMlobu9I9wRMSC8LlYfX0aKis_Kkgf5YsJ4KZ7Ns8zvMDd5JB3n3RTuzFFPL.tiiY3xdmqRA5rozio8e_vcYQIOw9FEyL42lkAC_88oRfr2FU413As3OQMgf86IyxB9d.xkGOFftgE0fMXzSVLWFEt5CJg7HnLdVF09EercP5YiOcDgSNNw2B03Gpk2C94o7SVIZjf3UJ8u9Zkcl_EE4HD5fYuRiUZZEN5TEAmNlsHmLJ.37L9IZkqzESZK81AQYhknVAXnEoEJPsosAZJvZ0tsFpJw0ppipswxJ2OOuoVrg85ACYJVrWFSacRP8_cbY9E1dEQBRwP8k48TYGRSqj0fweG.LQIL.T3e24tIByR5.9ssPW4Qza7eKa7RRInerj9aYxJbxiYRl0IBgfJ5VKK2YwJXThrtBp5xWVHe1tS.nbGvhMUK9MOrZJOGDMxfkdwV_sFlRpL3fYkzoIftN.MeYlDL6qfkWhc_xdhAI17WJa4b3OTr8naDM2zTPI.LonRLN_lxWx5FN57MkdYCmd8EDbsuYHFSOHiSD3u3.VPvqA0YzSOYVe6Iu2OwQ8CrE3EcQNnkCKbYkPowr0S183wfTJ3DJUZdaPEWhM8f.MpuvvyUniE4VHXnAPPZ2FpjXcewFYmRrFWN2yZIqZ4BHRSAIIuOwQtrDuLcZS8MkuHMfKzvq08UCU7w1VvhVLKmBygomyW.Yo60_1wUXjHIZHcWwNP5LMDCLWjpZi42eilBOcQvDT6HcmoUnpBh9vZhU1p0K0eA3._gzlHL2Lbg
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other malicious activity. The script does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or obfuscated code. The script is primarily responsible for handling the Cloudflare challenge and providing translations for the challenge UI. While it uses some moderate-risk indicators like external data transmission and aggressive DOM manipulation, these are common practices for Cloudflare challenges and are not inherently malicious. Overall, this script is likely a legitimate security mechanism and poses a low risk." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.KMrWh3={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support"},"translations":{"turnstile_timeout":"Timed%20out","turnstile_overrun_description":"Stuck%20here%3F","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","human_button_text":"Verify%20you%20are%20human","turnstile_verifying":"Verifying...","turnstile_failure":"Error","turnstile_success":"Success%21","turnstile_footer_privacy":"Privacy","testing_only":"Testing%20only.","turnstile_feedback_report":"Having%20trouble%3F","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","turnstile_refresh":"Refresh","turnstile_feedback_description":"Send%20Feedback","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","turnstile_footer_terms":"Terms","turnstile_expired":"Expired","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","testing_only_always_pass":"Testing%20only%2C%20always%20pass.","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists."},"polyfills":{"feedback_report_output_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eO,eP,eT,eU,eV,f1,f2,fs,fz,fF,fI,fK,fL,fM,fY,ga,gg,gh,gi,gs,gD,gH,eZ,f0){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=-parseInt(gI(1533))/1(-parseInt(gI(574))/2)+-parseInt(gI(1158))/3+parseInt(gI(989))/4+-parseInt(gI(1488))/5(parseInt(gI(839))/6)+parseInt(gI(1190))/7(-parseInt(gI(272))/8)+-parseInt(gI(440))/9(parseInt(gI(1328))/10)+parseInt(gI(1365))/11,f===d)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,127394),eM=this\|\|self,eN=eM[gJ(1519)],eO={},eO[gJ(1183)]='o',eO[gJ(392)]='s',eO[gJ(1080)]='u',eO[gJ(1579)]='z',eO[gJ(589)]='n',eO[gJ(494)]='I',eO[gJ(1310)]='b',eP=eO,eM[gJ(297)]=function(g,h,i,j,gN,o,x,B,C,D,E,F){if(gN=gJ,o={'SQfcS':function(G,H){return G+H},'oqNuz':function(G,H){return G===H},'cXERQ':function(G,H){return G(H)},'CVMQm':function(G,H){return G<H},'PqKcg':function(G,H,I,J){return G(H,I,J)},'aLJlz':function(G,H){return G(H)},'rzsLM':gN(1632),'fBwxM':function(G,H){return G+H}},h===null\|\|o[gN(842)](void 0,h))return j;for(x=o[gN(1270)](eS,h),g[gN(383)][gN(1416)]&&(x=x[gN(361)](g[gN(383)][gN(1416)](h))),x=g[gN(1181)][gN(1480)]&&g[gN(1203)]?g[gN(1181)][gN(1480)](new g[(gN(1203))](x)):function(G,gP,H){for(gP=gN,G[gP(767)](),H=0;H<G[gP(1315)];G[H]===G[H+1]?G[gP(683)](o[gP(1363)](H,1),1):H+=1);return G}(x),B='nAsAaAb'.split('A'),B=B[gN(1531)][gN(1399)](B),C=0;o[gN(1138)](C,x[gN(1315)]);D=x[C],E=o[gN(877)](eR,g,h,D),o[gN(1298)](B,E)?(F=E==='s'&&!g[gN(665)](h[D]),o[gN(842)](o[gN(1523)],i+D)?s(o[gN(1363)](i,D),E):F\|\|s(o[gN(1363)](i,D),h[D])):s(o[gN(632)](i,D),E),C++);return j;function s(G,H,gO){gO=gN,Object[gO(416)][gO(424)][gO(1235)](j,H)\|\|(j[H]=[]),j[H][gO(1623)](G)}},eT=gJ(
URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://pintopik.com Model: Joe Sandbox AI	```json{ "brand": "Pinterest", "brand_classification": "wellknown", "legit_url": "https://www.pinterest.com", "similarity": 4, "spoofed": 3, "reasoning": "The URL 'pintopik.com' bears some resemblance to 'Pinterest', a well-known brand, primarily due to the 'pin' prefix which is a significant part of the Pinterest brand name. However, the rest of the URL 'topik' does not closely resemble 'terest', reducing the overall similarity. There are no obvious character substitutions or visual similarities that would strongly suggest typosquatting. The domain 'pintopik.com' could potentially be used for a legitimate purpose unrelated to Pinterest, such as a site focused on topics or discussions ('topik' resembling 'topic'). The lack of a subdomain or misleading domain extension further reduces the likelihood of this being a typosquatting attempt. Overall, while there is some potential for confusion, it is not highly likely that this URL is intended to spoof Pinterest."}
URL: https://pintopik.com
URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://challenges.cloudflare.com/turnstile/v0/g/6... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script does not exhibit any high-risk or moderate-risk behaviors. It primarily consists of utility functions and error handling related to loading an iframe from a trusted domain (challenges.cloudflare.com). There is no indication of dynamic code execution, data exfiltration, or interaction with suspicious domains." }
"use strict";(function(){function Bt(e,t,a,o,c,l,g){try{var h=e[l](g),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function jt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function g(s){Bt(l,o,c,g,h,"next",s)}function h(s){Bt(l,o,c,g,h,"throw",s)}g(void 0)})}}function D(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):D(e,t)}function Ue(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function De(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Ue(e,c,a[c])})}return e}function Sr(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=null?t:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(t)):Sr(Object(t)).forEach(function(a){Object.defineProperty(e,a,Object.getOwnPropertyDescriptor(t,a))}),e}function qt(e){if(Array.isArray(e))return e}function zt(e,t){var a=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(a!=null){var o=[],c=!0,l=!1,g,h;try{for(a=a.call(e);!(c=(g=a.next()).done)&&(o.push(g.value),!(t&&o.length===t));c=!0);}catch(s){l=!0,h=s}finally{try{!c&&a.return!=null&&a.return()}finally{if(l)throw h}}return o}}function Gt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function ot(e,t){(t==null\|\|t>e.length)&&(t=e.length);for(var a=0,o=new Array(t);a<t;a++)o[a]=e[a];return o}function Xt(e,t){if(e){if(typeof e=="string")return ot(e,t);var a=Object.prototype.toString.call(e).slice(8,-1);if(a==="Object"&&e.constructor&&(a=e.constructor.name),a==="Map"\|\|a==="Set")return Array.from(a);if(a==="Arguments"\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(a))return ot(e,t)}}function Se(e,t){return qt(e)\|\|zt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ve(e,t){var a={label:0,sent:function(){if(l[0]&1)throw l[1];return l[1]},trys:[],ops:[]},o,c,l,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(_){return s([p,_])}}function s(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(a=0)),a;)try{if(o=1,c&&(l=p[0]&2?c.return:p[0]?c.throw\|\|((l=c.return)&&l.call(c),0):c.next)&&!(l=l.call(c,p[1])).done)return l;switch(c=0,l&&(p=[p[0]&2,l.value]),p[0]){case 0:case 1:l=p;break;case 4:return a.label++,{value:p[1],done:!1};case 5:a.label++,c=p[1],p=[0];continue;case 7:p=a.ops.pop(),a.trys.pop();continue;default:if(l=a.trys,!(l=l.length>0&&l[l.length-1])&&(p[0]===6\|\|p[0]===2)){a=0;continue}if(p[0]===3&&(!l\|\|p[1]>l[0]&&p[1]<l[3])){a.label=p[1];break}if(p[0]===6&&a.label<l[1]){a.label=l[1],l=p;break}if(l&&a.label<l[2]){a.label=l[2],a.ops.push(p);break}l[2]&&a.ops.pop(),a.trys.pop();continue}p=t.call(e,a)}catch(_){p=[6,_],c=0}finally{o=l=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Yt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var Pe=300030;var We=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j\|\|(j={}));var L;(fun
URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Verify you are human", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://ndrgnjy.shop/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a benign script that generates a random 'Ray ID' and sets it as the content of an HTML element. It also sets the hostname of the current page. The script uses standard DOM manipulation techniques and does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or obfuscation. The script's purpose seems to be related to providing a unique identifier (Ray ID) and displaying the current hostname, which are common practices in web applications. Overall, this script poses a low risk and is likely part of a legitimate web application." }
(function(){ function generateRayId() { const chars = '0123456789abcdef'; let result = ''; for (let i = 0; i < 16; i++) { result += chars[Math.floor(Math.random() * chars.length)]; } return result; } // Set hostname function setHostname() { const hostname = window.location.hostname \|\| 'example.com'; document.getElementById('hostname').textContent = hostname; } // Set Ray ID function setRayId() { const rayId = generateRayId(); document.getElementById('ray-id').textContent = rayId; } var a = function() {try{return !!window.addEventListener} catch(e) {return !1} }, b = function(b, c) {a() ? document.addEventListener("DOMContentLoaded", b, c) : document.attachEvent("onreadystatechange", b)}; b(function(){ var a = document.getElementById('cf-content'); a.style.display = 'block'; setRayId(); }, false); })();
URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://ndrgnjy.shop/... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including the use of obfuscated code and potential data exfiltration. The presence of heavily encoded strings and the use of techniques like `Function` constructor suggest the possibility of dynamic code execution, which poses a significant security risk. Additionally, the script may be transmitting sensitive data to external domains, which could lead to data breaches or other malicious activities. While the exact purpose of the script is unclear, the combination of these factors warrants a high-risk assessment." }
const _0xaffxo2d = "u5dyxpZ26Fs//A==" const _0xfd2a8ce = "wgHYv2OZkGdOrTdjEqVOPrQGkhSM869H18qoLn+KUQmR14zuK5I8rHR7r9BYZwzpR+jLOqwi9PvisnAgdq6rVK8RMhD2fuvnjRciDF8PCSAUOTEZR5YNRBigFHKZ7WrMaTOF0ndVsE17KszUF3UeRwnhCZ9wqZ/mkC2R7QFJH2hHe8RbaPB7VC8lPd9hBFXMsCEMSXauqw2R0rR66S8Y90KQVBDUbKeYCmrlce6j83RfzR607gtztAhRE9JowZ4Mj+wXwRhAhbkOeTPBig0NH8ooV3kTm+yeNJ8ueuXZ6WsmeQPHdTt9oZQV6Lrx62mLn/C5+4YTiHsthwhxNstVdLjt64KWHRwtjpwypS1Yu9hmhn9tBvLe4S3UIlj+c1Bd5/t7HcsYND0dtDpiM1AT6tGQ+li/viRs7V+G8a+X80ebqXVzkWT5rqhaCLTteF/EifbmnSVD5zDe975Z4hLSSEJggGw3BSn4tTJ9Q/Op/u68j3xzMafysagTfIc7LxWTml2zgc9rCiYVxLnpEu/1PPHbPRU5RBW72qJGnu5Zg+5wZcCPA83dfWoFKCpQcyPec8OzNt5si1Vo9p9NGFgib+VA4hK1U7HX6cHTSA6CEKUWWYzkCjqVPaeFr+aVWJgkQrcVoP2gNRvV1NUb0Fd3MEmLp//lyLfR1nW1B61S1f82B6fiEcdNqW1hZumaV3uej11iFlf9XIHonVp/1M1qFNVYoibnSOeXNEXfxKdQs0wtLxqbXLFkjCBd80W7G/69yQLSF0YgN5Jol4k6cV/gC2yxIWIamomyBunyusI6EVx4+KX3XcGiuzljQ8MHuTr2zehIugGNVEMF1baVZLBggtEc4kpcjbnBIzQGbB+A5Yf/IAreIVRLPO7OV1nU27v8wmc6PRh006/OHF+6mOSvu2kgtzUjrp8Pd/SeUUjzt9inZHIXH15lx3bjstUdyR4vo1mhGxiCyGRjg69fGpwjkPvKrXuA0j5N9usmrWR/TX3vf6rbSobHm7Cd1IsIPhvSZYT8mFdvdQ3lbHKuOs0gyhBS1U0ul1Xuyz/k2c0h9alQoum96ksqPA7xh9kyC9ZGcw7wM6lDjFW/isnUOLaR9/TW8MX2XPEtETsc3RljGc7w5ftFZ251fgvCwdIMFoumDZf2tkX1bcI/gkynSAfd9BCPluyjyfApILe5zObI/XMMBahSNp3ltZojcJ8is7LJSx18TU0GOTjz8Uohk4xkXgL1SCbiOZgjd9GJ0AKP10lk+Yvzy/QrK3VDjAeUx6CSAW3V+JezHqtnb+/UOFRnv2cO6L+erVvw6Tee5CHj1Pyo/Mtrw0wgOke2PGNOpDGZa3E9HKfm61PIIwphme3IIlZpUZAZ0NeINAGVn8cegEp5qisgj+g7MuwSKbGl6McN71OTZ0Q8Q2UiUtVbKOUwY23qNt/uZgu+H3F9/vVe+jKfmAlQ6N+ZppcWLp7wXuOav35CQ3EuMF3n4x/jgTGKmmYx3WijcsWqVkToQk3EdbQa5vFOPrGVkRG8/7jHHUA4Dl96f5Gi4AprvyZ9bLp9oZ9FSl2zlbjzjAHtXTs6DqIOqXZf9NJoTvnbProjcxfLTW+jhyal/clscWbG1yZgqvib5Ats5Ljk3BEuSS5PTCDEdwZZpkS7JNtOXzvYrAn00Dy7buvzNb0XgzX+f7dIZ7pJf2kgKXNiB6hoUZrEuz9bRLrh7TmtyITIhPJl9cnpq39vNOQDlMtGLvVJcxZ5GzwJwHAGoZiC3T01+g2wpX+x534HqxQPvJKrefkrT+xLvg9CdCfoSCBXD0WxEQlzXuRiXJrpbH51kDAm0ushgpsUvrMxHxxBAwDTnJ2CIbYZakEcG+pjyABJ8R8eZE6YdlLzM4jYTNaH2I7oDa72Roup/Gc4XjvbJm67oRgG8gwHVrBzCMrl32/sHPDdtJlVgwzIKwVn+u8lMo5u4nslsv/mpvXvyIegyl1KUKACnx1ohPEG3uUcSKIgM17bwOpcjytuEn/YL2Cw9DQCR0nk2s/w8x0OPoGDTKWzjKKsFvXh8Qt690hohyZz/4zfa/W24WoKmraUWsFoiZ9HrafU90/sse6Euv+ASo3aUNS9zwmS7pTplG18QPKeKGdQ7WAvaM9IJ04gte68QllK8cdwLrMrFe/SbKyaVte2on1OrsNku0TXEFme5grZTEbJj3XV3qjHMh/tLozgpp3lqv1+H9P6vdRMcW5ptkU99LBHLtcdojRGKdr1Hm9PaWSh6BcbaKw6DXfdLGj/GJCfK4VDNM/2Pq2FJZ1+PwlYStWkcIqzXne8mU2p3QkPigLKcoPJuuB///a+S4n5h53QN+W5EbSDwbi6rimUigTikfDqvc1a5P6VEBgLJCRB14PQH3wYJ1TvAMOaCDM2YslBeOJqSsCCG5tGBQW9wBbQLuEJLqxohTif6UjAFzUfKCCxn5XsLKJhlRaRCLy3Io9X31YBmAnVIAEDPLaNJ6Z8Qi72O0o2u7FF3q6+BxblE4eM6qVBiy2jX4dlgc2RyaahhuYxsa20COXnLqkVbvetNRPvV/owMtASb5rv+iRUQuQzbkF5If27I65KJ3EShUTuFrsou8b7asBQq7sN3A3b+a518uSYCiz5u5WJGCD2ITnpMaX4wKG25MSm5QGbHppm5ngjvQF1Yz0DaOahI950Cf01UzhiagZD8AgKm/Q0M3xRuvNA/I8rzCd7m7aqq/J8rt3+En4Mjrl1vbLZuuFjNF1pHyqdgR0LrFeNQbgeIpJTWpnBFJ8+8T3IyMd9SllsHYI2AxhOkXLXVd8GQTbRmfQSDelFLxsufdhVr+dPVGnX1yIrqR9NiDfJiNoVkprJLD/69+Pp/N+ucqngHmmEkHvqrjC8BcbKf6FKm9xqCm0caa+RzDaOO787RobZC0g9LQZn2+7rPEPnZoiJsJbJ+wr1DsQb4Mj5qEO4Ci+56Vf1A72NDIKWEsaZEgtCtQXDs4qxeNO3mFnljnCKubFl1y0tITz9JlOppxddOtT3/TRV/Yt0JrhNA2kb9ehlqV6E2dvIcEbC+mMN+chOx8I5y5WTziBYWKXCzJBLHgVao8p88jkyyyXZms2bSnT902omFgd+4M7p8UwchpQjt1AaU0r/Y50E/Qbm3CoGi41MZU6Z5VgGLVqj5UxWy+FnkmNb50L5HxhiwG1D8hb0E6zMjnSP4X2jla7HOwOz94I8luxhW5jN4E8DmTrpFKW4mt5+cRf0POHdDq+6Ut/FacER075hhi46y7C53kdQcMWp";
URL: https://ndrgnjy.shop/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a utility script that manipulates the DOM to restore the state of various HTML elements, such as shadow DOM, canvas, form controls, and text areas. While it performs some dynamic DOM manipulation, the intent seems to be benign and focused on restoring the previous state of the page. The script does not exhibit any high-risk indicators like dynamic code execution, data exfiltration, or obfuscation. The behaviors observed, such as updating element attributes and values, are consistent with the script's apparent purpose of restoring the page's previous state. Therefore, the overall risk score is assessed as low." }
(function () { var k1 = "data-scrapbook-shadowdom", k2 = "data-scrapbook-canvas", k3 = "data-scrapbook-input-indeterminate", k4 = "data-scrapbook-input-checked", k5 = "data-scrapbook-option-selected", k6 = "data-scrapbook-input-value", k7 = "data-scrapbook-textarea-value", fn = function (r) { var E = r.querySelectorAll ? r.querySelectorAll("") : r.getElementsByTagName(""), i = E.length, e, d, s; while (i--) { e = E[i]; if ((d = e.getAttribute(k1)) !== null && !e.shadowRoot && e.attachShadow) { s = e.attachShadow({mode: 'open'}); s.innerHTML = d; e.removeAttribute(k1); } if ((d = e.getAttribute(k2)) !== null) { (function () { var c = e, g = new Image(); g.onload = function () { c.getContext('2d').drawImage(g, 0, 0); }; g.src = d; })(); e.removeAttribute(k2); } if ((d = e.getAttribute(k3)) !== null) { e.indeterminate = true; e.removeAttribute(k3); } if ((d = e.getAttribute(k4)) !== null) { e.checked = d === 'true'; e.removeAttribute(k4); } if ((d = e.getAttribute(k5)) !== null) { e.selected = d === 'true'; e.removeAttribute(k5); } if ((d = e.getAttribute(k6)) !== null) { e.value = d; e.removeAttribute(k6); } if ((d = e.getAttribute(k7)) !== null) { e.value = d; e.removeAttribute(k7); } if (e.shadowRoot) { fn(e.shadowRoot); } } }; fn(document); })()
URL: https://cdn.jsdelivr.net/npm/sweetalert2@11.7.16/d... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be the source code for the popular SweetAlert2 library, which is a widely used and trusted library for creating custom alert dialogs. The code does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or obfuscated code/URLs. The behaviors observed, such as DOM manipulation and external data transmission, are common for a library of this nature and are not inherently malicious. Additionally, the code is well-documented and open-source, which further reduces the risk. Overall, this script is likely legitimate and poses a low risk." }
/! sweetalert2 v11.7.16 * Released under the MIT License. */ !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e\|\|self).Sweetalert2=t()}(this,(function(){"use strict";const e={},t=t=>new Promise((o=>{if(!t)return o();const n=window.scrollX,i=window.scrollY;e.restoreFocusTimeout=setTimeout((()=>{e.previousActiveElement instanceof HTMLElement?(e.previousActiveElement.focus(),e.previousActiveElement=null):document.body&&document.body.focus(),o()}),100),window.scrollTo(n,i)}));var o={promise:new WeakMap,innerParams:new WeakMap,domCache:new WeakMap};const n="swal2-",i=["container","shown","height-auto","iosfix","popup","modal","no-backdrop","no-transition","toast","toast-shown","show","hide","close","title","html-container","actions","confirm","deny","cancel","default-outline","footer","icon","icon-content","image","input","file","range","select","radio","checkbox","label","textarea","inputerror","input-label","validation-message","progress-steps","active-progress-step","progress-step","progress-step-line","loader","loading","styled","top","top-start","top-end","top-left","top-right","center","center-start","center-end","center-left","center-right","bottom","bottom-start","bottom-end","bottom-left","bottom-right","grow-row","grow-column","grow-fullscreen","rtl","timer-progress-bar","timer-progress-bar-container","scrollbar-measure","icon-success","icon-warning","icon-info","icon-question","icon-error"].reduce(((e,t)=>(e[t]=n+t,e)),{}),s=["success","warning","info","question","error"].reduce(((e,t)=>(e[t]=n+t,e)),{}),r="SweetAlert2:",a=e=>e.charAt(0).toUpperCase()+e.slice(1),l=e=>{console.warn(`${r} ${"object"==typeof e?e.join(" "):e}`)},c=e=>{console.error(`${r} ${e}`)},u=[],d=(e,t)=>{var o;o=`"${e}" is deprecated and will be removed in the next major release. Please use "${t}" instead.`,u.includes(o)\|\|(u.push(o),l(o))},p=e=>"function"==typeof e?e():e,m=e=>e&&"function"==typeof e.toPromise,g=e=>m(e)?e.toPromise():Promise.resolve(e),h=e=>e&&Promise.resolve(e)===e,f=()=>document.body.querySelector(`.${i.container}`),b=e=>{const t=f();return t?t.querySelector(e):null},y=e=>b(`.${e}`),w=()=>y(i.popup),v=()=>y(i.icon),C=()=>y(i.title),A=()=>y(i["html-container"]),k=()=>y(i.image),B=()=>y(i["progress-steps"]),E=()=>y(i["validation-message"]),$=()=>b(`.${i.actions} .${i.confirm}`),x=()=>b(`.${i.actions} .${i.cancel}`),P=()=>b(`.${i.actions} .${i.deny}`),T=()=>b(`.${i.loader}`),L=()=>y(i.actions),S=()=>y(i.footer),O=()=>y(i["timer-progress-bar"]),M=()=>y(i.close),j=()=>{const e=w();if(!e)return[];const t=e.querySelectorAll('[tabindex]:not([tabindex="-1"]):not([tabindex="0"])'),o=Array.from(t).sort(((e,t)=>{const o=parseInt(e.getAttribute("tabindex")\|\|"0"),n=parseInt(t.getAttribute("tabindex")\|\|"0");return o>n?1:o<n?-1:0})),n=e.querySelectorAll('\n a[href],\n area[href],\n input:not([disabled]),\n select:not([disabled]),\n textarea:not([disabled]),\n button:not([disabled]),\n iframe,\n object,\n embed,\n [tabindex="0"],\n [contenteditable],\n audio[controls],\n video[controls],\n summary\n'),i=Array.from(n).filter((e=>"-1"!==e.getAttribute("tabindex")));return[...new Set(o.concat(i))].filter((e=>X(e)))},I=()=>q(document.body,i.shown)&&!q(document.body,i["toast-shown"])&&!q(document.body,i["no-backdrop"]),H=()=>{const e=w();return!!e&&q(e,i.toast)},D=(e,t)=>{if(e.textContent="",t){const o=(new DOMParser).parseFromString(t,"text/html");Array.from(o.querySelector("head").childNodes).forEach((t=>{e.appendChild(t)})),Array.from(o.querySelector("body").childNodes).forEach((t=>{t instanceof HTMLVideoElement\|\|t instanceof HTMLAudioElement?e.appendChild(t.cloneNode(!0)):e.appendChild(t)}))}},q=(e,t)=>{if(!t)return!1;const o=t.split(/\s+/);for(let t=0;t<o.length;t++)if(!e.classList.contains(o[t]))return!1;return!0},V=(e,t,o)=>{if(((e,t)=>{Array.from(e.classList).forEach((o=>{Object.values(i).includes(o)\|\|Objec
URL: https://esm.sh/viem@2.21.52... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a collection of imports for the 'viem' library, which is a TypeScript-based Ethereum client library. The imports cover a wide range of Ethereum-related functionality, such as ENS (Ethereum Name Service) operations, contract interactions, and various Ethereum RPC methods. While the snippet itself does not contain any high-risk indicators, the use of the 'viem' library may involve interactions with the Ethereum blockchain, which could potentially be used for malicious purposes if not implemented correctly. However, the 'viem' library is a well-known and widely used library, and the provided snippet does not demonstrate any inherently suspicious behavior. Therefore, the overall risk score is assessed as low." }
/* esm.sh - viem@2.21.52 */ import "/@noble/curves@1.6.0/es2022/secp256k1.mjs"; import "/abitype@1.0.6/es2022/abitype.mjs"; import "/viem@2.21.52/es2022/_esm/actions/ens/getEnsAddress.mjs"; import "/viem@2.21.52/es2022/_esm/actions/ens/getEnsAvatar.mjs"; import "/viem@2.21.52/es2022/_esm/actions/ens/getEnsName.mjs"; import "/viem@2.21.52/es2022/_esm/actions/ens/getEnsResolver.mjs"; import "/viem@2.21.52/es2022/_esm/actions/ens/getEnsText.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/call.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/createBlockFilter.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/createContractEventFilter.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/createEventFilter.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/createPendingTransactionFilter.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/estimateContractGas.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/estimateFeesPerGas.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/estimateGas.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/estimateMaxPriorityFeePerGas.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getBalance.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getBlobBaseFee.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getBlock.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getBlockNumber.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getBlockTransactionCount.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getChainId.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getCode.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getContractEvents.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getEip712Domain.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getFeeHistory.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getFilterChanges.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getFilterLogs.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getGasPrice.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getLogs.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getProof.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getStorageAt.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getTransaction.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getTransactionConfirmations.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getTransactionCount.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/getTransactionReceipt.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/multicall.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/readContract.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/simulateContract.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/uninstallFilter.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/verifyMessage.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/verifyTypedData.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/waitForTransactionReceipt.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/watchBlockNumber.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/watchBlocks.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/watchContractEvent.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/watchEvent.mjs"; import "/viem@2.21.52/es2022/_esm/actions/public/watchPendingTransactions.mjs"; import "/viem@2.21.52/es2022/_esm/actions/siwe/verifySiweMessage.mjs"; import "/viem@2.21.52/es2022/_esm/actions/test/dropTransaction.mjs"; import "/viem@2.21.52/es2022/_esm/actions/test/dumpState.mjs"; import "/viem@2.21.52/es2022/_esm/actions/test/getAutomine.mjs"; import "/viem@2.21.52/es2022/_esm/actions/test/getTxpoolContent.mjs"; import "/viem@2.21.52/es2022/_esm/actions/test/getTxpoolStatus.mjs"; import "/viem@2.21.52/es2022/_esm/actions/test/impersonateAccount.mjs"; import "/viem@2.21.52/es2022/_esm/actions/test/increaseTime.mjs"; import "/viem@2.21.52/es2022/_esm/actions/test/inspectTxpool.mjs"; import "/viem@2
URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Connect your wallet", "prominent_button_name": "Connect wallet", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "file hosting" }

URL: https://esm.sh/react@18.3.1/es2022/react.mjs... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script appears to be a minified version of a React library, which is a common and legitimate use case. There are no high-risk indicators such as dynamic code execution or data exfiltration. The script does not interact with external domains or exhibit suspicious behavior. It primarily involves object manipulation and function definitions typical of a React library." }
/* esm.sh - react@18.3.1 */ var U=Object.create;var k=Object.defineProperty;var q=Object.getOwnPropertyDescriptor;var A=Object.getOwnPropertyNames;var M=Object.getPrototypeOf,z=Object.prototype.hasOwnProperty;var w=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var B=(e,t,n,u)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let o of A(t))!z.call(e,o)&&o!==n&&k(e,o,{get:()=>t[o],enumerable:!(u=q(t,o))\|\|u.enumerable});return e};var H=(e,t,n)=>(n=e!=null?U(M(e)):{},B(t\|\|!e\|\|!e.__esModule?k(n,"default",{value:e,enumerable:!0}):n,e));var L=w(r=>{"use strict";var y=Symbol.for("react.element"),W=Symbol.for("react.portal"),Y=Symbol.for("react.fragment"),G=Symbol.for("react.strict_mode"),J=Symbol.for("react.profiler"),K=Symbol.for("react.provider"),Q=Symbol.for("react.context"),X=Symbol.for("react.forward_ref"),Z=Symbol.for("react.suspense"),ee=Symbol.for("react.memo"),te=Symbol.for("react.lazy"),b=Symbol.iterator;function re(e){return e===null\|\|typeof e!="object"?null:(e=b&&e[b]\|\|e["@@iterator"],typeof e=="function"?e:null)}var x={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},O=Object.assign,I={};function p(e,t,n){this.props=e,this.context=t,this.refs=I,this.updater=n\|\|x}p.prototype.isReactComponent={};p.prototype.setState=function(e,t){if(typeof e!="object"&&typeof e!="function"&&e!=null)throw Error("setState(...): takes an object of state variables to update or a function which returns an object of state variables.");this.updater.enqueueSetState(this,e,t,"setState")};p.prototype.forceUpdate=function(e){this.updater.enqueueForceUpdate(this,e,"forceUpdate")};function g(){}g.prototype=p.prototype;function S(e,t,n){this.props=e,this.context=t,this.refs=I,this.updater=n\|\|x}var E=S.prototype=new g;E.constructor=S;O(E,p.prototype);E.isPureReactComponent=!0;var $=Array.isArray,P=Object.prototype.hasOwnProperty,R={current:null},T={key:!0,ref:!0,__self:!0,__source:!0};function D(e,t,n){var u,o={},s=null,f=null;if(t!=null)for(u in t.ref!==void 0&&(f=t.ref),t.key!==void 0&&(s=""+t.key),t)P.call(t,u)&&!T.hasOwnProperty(u)&&(o[u]=t[u]);var i=arguments.length-2;if(i===1)o.children=n;else if(1<i){for(var c=Array(i),a=0;a<i;a++)c[a]=arguments[a+2];o.children=c}if(e&&e.defaultProps)for(u in i=e.defaultProps,i)o[u]===void 0&&(o[u]=i[u]);return{$$typeof:y,type:e,key:s,ref:f,props:o,_owner:R.current}}function ne(e,t){return{$$typeof:y,type:e.type,key:t,ref:e.ref,props:e.props,_owner:e._owner}}function C(e){return typeof e=="object"&&e!==null&&e.$$typeof===y}function oe(e){var t={"=":"=0",":":"=2"};return"$"+e.replace(/[=:]/g,function(n){return t[n]})}var j=/\/+/g;function v(e,t){return typeof e=="object"&&e!==null&&e.key!=null?oe(""+e.key):t.toString(36)}function _(e,t,n,u,o){var s=typeof e;(s==="undefined"\|\|s==="boolean")&&(e=null);var f=!1;if(e===null)f=!0;else switch(s){case"string":case"number":f=!0;break;case"object":switch(e.$$typeof){case y:case W:f=!0}}if(f)return f=e,o=o(f),e=u===""?"."+v(f,0):u,$(o)?(n="",e!=null&&(n=e.replace(j,"$&/")+"/"),_(o,t,n,"",function(a){return a})):o!=null&&(C(o)&&(o=ne(o,n+(!o.key\|\|f&&f.key===o.key?"":(""+o.key).replace(j,"$&/")+"/")+e)),t.push(o)),1;if(f=0,u=u===""?".":u+":",$(e))for(var i=0;i<e.length;i++){s=e[i];var c=u+v(s,i);f+=_(s,t,n,c,o)}else if(c=re(e),typeof c=="function")for(e=c.call(e),i=0;!(s=e.next()).done;)s=s.value,c=u+v(s,i++),f+=_(s,t,n,c,o);else if(s==="object")throw t=String(e),Error("Objects are not valid as a React child (found: "+(t==="[object Object]"?"object with keys {"+Object.keys(e).join(", ")+"}":t)+"). If you meant to render a collection of children, use an array instead.");return f}function d(e,t,n){if(e==null)return e;var u=[],o=0;return _(e,u,"","",function(s){return t.call(n,s,o++)}),u}function ue(e){if(e._status===-1){var t=e._result;t=t(),t.then(function(n){(e._status===0\|\|e._status===-1)&&(e._status=1,e._result=n)},function(n){(e._status===0\|\|e._status===-1)&&(e._status=2,e._result=n)}),e._s
URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "brands": [ "Zora" ] }
	{ "brands": [ "Zora" ] }
URL: https://ndrgnjy.shop/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Connect Wallet", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "file hosting" }

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.nhtfxq.blogspot.ie/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Windows Analysis Report
http://www.nhtfxq.blogspot.ie/