Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://ntta.org-pay-u5ch.sbs/us/

Overview

General Information

Sample URL:	https://ntta.org-pay-u5ch.sbs/us/
Analysis ID:	1583428

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious Javascript

AI detected suspicious URL

Connects to several IPs in different countries

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

Invalid 'forgot password' link found

Stores files to the Windows start menu directory

Classification

×

Process Tree

System is w10x64_ra

chrome.exe (PID: 3532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1972,i,3733586234214943491,7081473420914989024,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ntta.org-pay-u5ch.sbs/us/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://www.ntta.org/... This script demonstrates high-risk behavior, including dynamic code execution through the use of `eval()` and `unescape()` functions. It also appears to be heavily obfuscated, which is a common tactic used to conceal malicious intent. The script's purpose is unclear, and it poses a significant risk of executing arbitrary code on the user's system, potentially leading to data exfiltration or other malicious activities.

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://ntta.org-pay-u5ch.sbs
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://ntta.org-pay-u5ch.sbs

Source: https://ssptrips.ntta.org/#/

HTTP Parser: Number of links: 0

Source: https://ssptrips.ntta.org/#/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://ssptrips.ntta.org/#/

HTTP Parser: Base64 decoded: o=2&type=1&code=2875&tl=43200

Source: https://ssptrips.ntta.org/#/

HTTP Parser: Invalid link: Forgot Password LinkPassword

Source: https://ssptrips.ntta.org/#/	HTTP Parser: Iframe src: https://9168371.fls.doubleclick.net/activityi;src=9168371;type=tollp0;cat=nttar0;ord=3741769203488;npa=0;auiddc=654022435.1735839585;ps=1;pcor=1006675873;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4cc1v9190509634z8830094893za201zb830094893;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102198178;epver=2;~oref=https%3A%2F%2Fssptrips.ntta.org%2F?
Source: https://ssptrips.ntta.org/#/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=9168371;type=tollp0;cat=nttar0;ord=3741769203488;npa=0;auiddc=654022435.1735839585;ps=1;pcor=1006675873;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;gtm=45fe4cc1v9190509634z8830094893za201zb830094893;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102198178;epver=2;~oref=https%3A%2F%2Fssptrips.ntta.org%2F?
Source: https://ssptrips.ntta.org/#/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/704035789?random=1735839586840&cv=11&fst=1735839586840&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v876609539za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fssptrips.ntta.org%2F&ref=https%3A%2F%2Fwww.ntta.org%2F&hn=www.googleadservices.com&frm=0&tiba=NTTA%20Customer%20Service%20Center&npa=0&pscdl=noapi&auid=654022435.1735839585&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://ssptrips.ntta.org/#/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-PYYQBEMYD3&gacid=1907882407.1735839579&gtm=45je4cc1v9121382884z8830094893za200zb830094893&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=450488056
Source: https://ssptrips.ntta.org/#/	HTTP Parser: Iframe src: https://a2.adform.net/serving/container/?pm=2575034&lid=110202856&ctype=0&media=0&PageName=NTTA+Retargeting&rnd=1208384807&cpref=https%3a%2f%2fwww.ntta.org%2f&loc=https%3a%2f%2fssptrips.ntta.org%2f%23%2f
Source: https://ssptrips.ntta.org/#/	HTTP Parser: Iframe src: https://c1.adform.net/imatch/pixels?bt=0&uid=6016253917803187937&agencyId=6276&advertiserId=2117039&src=tp&rnd=808514
Source: https://ssptrips.ntta.org/#/	HTTP Parser: Iframe src: https://insight.adsrvr.org/track/up?adv=pkz3tli&ref=https%3A%2F%2Fssptrips.ntta.org%2F%23%2F&upid=mw76j7u&upv=1.1.0&paapi=1

Source: https://ssptrips.ntta.org/#/

HTTP Parser: <input type="password" .../> found

Source: https://www.ntta.org/	HTTP Parser: No favicon
Source: https://ssptrips.ntta.org/#/	HTTP Parser: No favicon
Source: https://ssptrips.ntta.org/#/	HTTP Parser: No favicon
Source: https://ssptrips.ntta.org/#/	HTTP Parser: No favicon
Source: https://ssptrips.ntta.org/#/	HTTP Parser: No favicon
Source: https://ssptrips.ntta.org/#/	HTTP Parser: No favicon
Source: https://ssptrips.ntta.org/#/	HTTP Parser: No favicon
Source: https://ssptrips.ntta.org/#/	HTTP Parser: No favicon

Source: https://ssptrips.ntta.org/#/	HTTP Parser: No <meta name="author".. found
Source: https://ssptrips.ntta.org/#/	HTTP Parser: No <meta name="author".. found

Source: https://ssptrips.ntta.org/#/	HTTP Parser: No <meta name="copyright".. found
Source: https://ssptrips.ntta.org/#/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49890 version: TLS 1.2

Source: unknown

Network traffic detected: IP country count 12

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: ntta.org-pay-u5ch.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: lh5.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ntta.org
Source: global traffic	DNS traffic detected: DNS query: www.ntta.org
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: translate.google.com
Source: global traffic	DNS traffic detected: DNS query: ssptrips.ntta.org
Source: global traffic	DNS traffic detected: DNS query: cdn.appdynamics.com
Source: global traffic	DNS traffic detected: DNS query: sptrips.ntta.org
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: s2.adform.net
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: collector-20327.tvsquared.com
Source: global traffic	DNS traffic detected: DNS query: js.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: insight.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: 9168371.fls.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: a2.adform.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: www.amcharts.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: pixel.mediaiqdigital.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: a1.seadform.net
Source: global traffic	DNS traffic detected: DNS query: c1.adform.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: adservice.google.com
Source: global traffic	DNS traffic detected: DNS query: bidagent.xad.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: pixel.mathtag.com
Source: global traffic	DNS traffic detected: DNS query: rtb.adgrx.com
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: ad.360yield.com
Source: global traffic	DNS traffic detected: DNS query: ad.yieldlab.net
Source: global traffic	DNS traffic detected: DNS query: token.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: ih.adscale.de
Source: global traffic	DNS traffic detected: DNS query: rtb-csync.smartadserver.com
Source: global traffic	DNS traffic detected: DNS query: ads.stickyadstv.com
Source: global traffic	DNS traffic detected: DNS query: x.bidswitch.net
Source: global traffic	DNS traffic detected: DNS query: dsum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: uipglob.semasio.net
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: pixel.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: ps.eyeota.net
Source: global traffic	DNS traffic detected: DNS query: uipus.semasio.net
Source: global traffic	DNS traffic detected: DNS query: loadm.exelator.com
Source: global traffic	DNS traffic detected: DNS query: idsync.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: sync.crwdcntrl.net
Source: global traffic	DNS traffic detected: DNS query: eu-u.openx.net
Source: global traffic	DNS traffic detected: DNS query: cm.adsafety.net
Source: global traffic	DNS traffic detected: DNS query: t.visx.net
Source: global traffic	DNS traffic detected: DNS query: 1f2e7.v.fwmrm.net
Source: global traffic	DNS traffic detected: DNS query: pippio.com
Source: global traffic	DNS traffic detected: DNS query: simage2.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: sg.semasio.net
Source: global traffic	DNS traffic detected: DNS query: pdw-adf.userreport.com
Source: global traffic	DNS traffic detected: DNS query: a.audrte.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: aa.agkn.com
Source: global traffic	DNS traffic detected: DNS query: dsp.adfarm1.adition.com
Source: global traffic	DNS traffic detected: DNS query: pm.w55c.net
Source: global traffic	DNS traffic detected: DNS query: id5-sync.com
Source: global traffic	DNS traffic detected: DNS query: redirect.frontend.weborama.fr
Source: global traffic	DNS traffic detected: DNS query: dmp.adform.net
Source: global traffic	DNS traffic detected: DNS query: sync.teads.tv
Source: global traffic	DNS traffic detected: DNS query: s.ad.smaato.net
Source: global traffic	DNS traffic detected: DNS query: match.contentexchange.me
Source: global traffic	DNS traffic detected: DNS query: pixel.onaudience.com
Source: global traffic	DNS traffic detected: DNS query: eb2.3lift.com
Source: global traffic	DNS traffic detected: DNS query: e1.emxdgt.com
Source: global traffic	DNS traffic detected: DNS query: pr-bh.ybp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: ice.360yield.com
Source: global traffic	DNS traffic detected: DNS query: sync.1rx.io
Source: global traffic	DNS traffic detected: DNS query: cms.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: ups.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: tags.bluekai.com
Source: global traffic	DNS traffic detected: DNS query: match.prod.bidr.io
Source: global traffic	DNS traffic detected: DNS query: sync.targeting.unrulymedia.com
Source: global traffic	DNS traffic detected: DNS query: d.turn.com
Source: global traffic	DNS traffic detected: DNS query: sync-tm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: image8.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: image2.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: pdx-col.eum-appdynamics.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49890 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@30/6@298/844

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1972,i,3733586234214943491,7081473420914989024,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ntta.org-pay-u5ch.sbs/us/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1972,i,3733586234214943491,7081473420914989024,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://ntta.org-pay-u5ch.sbs/us/	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.amcharts.com	104.26.6.186	true	false		unknown
eu-u.openx.net	34.98.64.218	true	false		unknown
id5-sync.com	162.19.138.82	true	false		high
col.eum-appdynamics.com	34.210.37.154	true	false		high
bidagent.xad.com	44.213.13.163	true	false		unknown
d-ams1.turn.com	46.228.164.13	true	false		high
eu-eb2.3lift.com	13.248.245.213	true	false		high
stats.g.doubleclick.net	142.251.5.154	true	false		high
cdn.w55c.net	35.210.130.15	true	false		high
ih.adscale.de	3.125.196.33	true	false		high
sync.crwdcntrl.net	54.73.51.224	true	false		high
na-ice.360yield.com	18.233.237.126	true	false		unknown
cdnjs.cloudflare.com	104.17.24.14	true	false		high
cm.g.doubleclick.net	142.250.181.226	true	false		high
ds-pr-bh.ybp.gysm.yahoodns.net	52.51.29.15	true	false		high
sync.1rx.io	46.228.174.117	true	false		high
www.google.com	172.217.16.196	true	false		high
dcs-ups.g03.yahoodns.net	87.248.119.252	true	false		high
imagsync-lhrpairbc.pubmatic.com	185.64.191.214	true	false		unknown
match.adsrvr.org	35.71.131.137	true	false		high
match.contentexchange.me	91.185.218.28	true	false		unknown
star-mini.c10r.facebook.com	157.240.251.35	true	false		high
match.prod.bidr.io	52.48.19.27	true	false		high
sydney-lb.geo.iponweb.net	35.210.60.147	true	false		unknown
plus.l.google.com	172.217.23.110	true	false		high
uip.semasio.net	77.243.51.121	true	false		high
ActivationEdge-activation-1631408035.eu-central-1.elb.amazonaws.com	52.57.229.140	true	false		high
collectorj.tvsquared.com	3.133.236.159	true	false		unknown
pixel.onaudience.com	54.38.113.4	true	false		high
euw-ice.360yield.com	52.208.132.226	true	false		high
dsp.adfarm1.adition.com	85.114.159.93	true	false		unknown
redirect.frontend.weborama.fr	35.190.24.218	true	false		high
wjrhjjv.impervadns.net	45.223.166.11	true	false		unknown
cdn.appdynamics.com	3.160.150.128	true	false		high
www3.l.google.com	142.250.74.206	true	false		high
googleads.g.doubleclick.net	216.58.206.34	true	false		high
td.doubleclick.net	142.250.181.226	true	false		high
rtb.adgrx.com	52.19.224.221	true	false		high
istrp.adform.net	37.157.2.250	true	false		unknown
googlehosted.l.googleusercontent.com	172.217.16.193	true	false		high
ntta.org-pay-u5ch.sbs	43.166.134.219	true	true		unknown
dart.l.doubleclick.net	142.250.185.70	true	false		high
pixel-origin.mathtag.com	216.200.232.253	true	false		high
user-data-eu.bidswitch.net	35.214.136.108	true	false		high
dg2iu7dxxehbo.cloudfront.net	18.172.103.101	true	false		high
adservice.google.com	142.250.185.98	true	false		high
cm.adsafety.net	139.162.185.124	true	false		unknown
insight.adsrvr.org	3.33.220.150	true	false		high
ps.eyeota.net	3.127.178.105	true	false		high
scontent.xx.fbcdn.net	157.240.0.6	true	false		high
idsync.rlcdn.com	35.244.174.68	true	false		high
ntta.org	45.223.174.11	true	true		unknown
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	34.255.164.82	true	false		high
rtb-csync-euw2.smartadserver.com	217.182.178.234	true	false		high
a.nel.cloudflare.com	35.190.80.1	true	false		high
pippio.com	107.178.254.65	true	false		high
ad.doubleclick.net	172.217.18.102	true	false		high
se.semasio.net	77.243.51.122	true	false		unknown
play.google.com	216.58.206.46	true	false		high
dsum-sec.casalemedia.com	104.18.27.193	true	false		high
proxy-euro-2-685782417.eu-central-1.elb.amazonaws.com	18.192.180.216	true	false		high
s.ad.smaato.net	13.32.27.67	true	false		high
s9ugzdc.ng.impervadns.net	45.223.166.11	true	false		unknown
nstrp.adform.net	37.157.6.245	true	false		unknown
pug-ams-bc.pubmnet.com	198.47.127.205	true	false		high
analytics.google.com	216.58.206.78	true	false		high
pug-lhrc.pubmnet.com	185.64.190.80	true	false		high
ib.anycast.adnxs.com	37.252.172.123	true	false		high
load-euw1.exelator.com	54.78.254.47	true	false		high
d3i42lyttuj6qr.cloudfront.net	65.9.66.113	true	false		unknown
pixel.mediaiqdigital.com	18.197.23.131	true	false		high
o89xhb3.ng.impervadns.net	45.223.166.11	true	false		unknown
uipus.semasio.net	50.57.31.206	true	false		high
pm.w55c.net	unknown	unknown	false		high
pdx-col.eum-appdynamics.com	unknown	unknown	false		high
secure.adnxs.com	unknown	unknown	false		high
ads.stickyadstv.com	unknown	unknown	false		high
token.rubiconproject.com	unknown	unknown	false		high
sync.targeting.unrulymedia.com	unknown	unknown	false		high
a2.adform.net	unknown	unknown	false		unknown
ice.360yield.com	unknown	unknown	false		high
js.adsrvr.org	unknown	unknown	false		high
s2.adform.net	unknown	unknown	false		unknown
c1.adform.net	unknown	unknown	false		high
pixel.rubiconproject.com	unknown	unknown	false		high
dmp.adform.net	unknown	unknown	false		high
connect.facebook.net	unknown	unknown	false		high
px.ads.linkedin.com	unknown	unknown	false		high
1f2e7.v.fwmrm.net	unknown	unknown	false		unknown
d.turn.com	unknown	unknown	false		high
simage2.pubmatic.com	unknown	unknown	false		high
uipglob.semasio.net	unknown	unknown	false		high
cms.analytics.yahoo.com	unknown	unknown	false		high
sync-tm.everesttech.net	unknown	unknown	false		high
collector-20327.tvsquared.com	unknown	unknown	false		unknown
pixel.mathtag.com	unknown	unknown	false		high
sync.teads.tv	unknown	unknown	false		high
sptrips.ntta.org	unknown	unknown	false		unknown
a1.seadform.net	unknown	unknown	false		unknown
image8.pubmatic.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.ntta.org/	true		unknown
https://ssptrips.ntta.org/#/	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.223.174.11	ntta.org	United States		327849	ROCKETNETZA	true
34.210.37.154	col.eum-appdynamics.com	United States		16509	AMAZON-02US	false
142.250.74.206	www3.l.google.com	United States		15169	GOOGLEUS	false
35.210.130.15	cdn.w55c.net	United States		19527	GOOGLE-2US	false
185.89.210.153	unknown	Germany		29990	ASN-APPNEXUS	false
3.69.181.164	unknown	United States		16509	AMAZON-02US	false
185.64.190.80	pug-lhrc.pubmnet.com	United Kingdom		62713	AS-PUBMATICUS	false
77.243.51.122	se.semasio.net	Denmark		42697	NETIC-ASDK	false
185.167.164.53	unknown	United States		198622	ADFORMDK	false
77.243.51.121	uip.semasio.net	Denmark		42697	NETIC-ASDK	false
34.255.164.82	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States		16509	AMAZON-02US	false
35.190.80.1	a.nel.cloudflare.com	United States		15169	GOOGLEUS	false
198.47.127.205	pug-ams-bc.pubmnet.com	United States		62713	AS-PUBMATICUS	false
35.71.131.137	match.adsrvr.org	United States		237	MERIT-AS-14US	false
4.232.99.2	unknown	United States		3356	LEVEL3US	false
37.157.6.243	unknown	Denmark		198622	ADFORMDK	false
37.157.6.245	nstrp.adform.net	Denmark		198622	ADFORMDK	false
3.13.214.178	unknown	United States		16509	AMAZON-02US	false
1.1.1.1	unknown	Australia		13335	CLOUDFLARENETUS	false
139.162.185.124	cm.adsafety.net	Netherlands		63949	LINODE-APLinodeLLCUS	false
13.248.245.213	eu-eb2.3lift.com	United States		16509	AMAZON-02US	false
172.217.18.3	unknown	United States		15169	GOOGLEUS	false
185.167.164.39	unknown	United States		198622	ADFORMDK	false
142.250.185.110	unknown	United States		15169	GOOGLEUS	false
37.157.2.228	unknown	Denmark		198622	ADFORMDK	false
216.58.206.46	play.google.com	United States		15169	GOOGLEUS	false
107.178.254.65	pippio.com	United States		15169	GOOGLEUS	false
185.167.164.42	unknown	United States		198622	ADFORMDK	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
142.250.185.195	unknown	United States		15169	GOOGLEUS	false
52.214.247.153	unknown	United States		16509	AMAZON-02US	false
35.244.174.68	idsync.rlcdn.com	United States		15169	GOOGLEUS	false
216.58.212.168	unknown	United States		15169	GOOGLEUS	false
18.197.23.131	pixel.mediaiqdigital.com	United States		16509	AMAZON-02US	false
37.157.6.233	unknown	Denmark		198622	ADFORMDK	false
142.250.185.78	unknown	United States		15169	GOOGLEUS	false
154.57.158.116	unknown	United States		26558	FREEWHEELUS	false
142.250.186.130	unknown	United States		15169	GOOGLEUS	false
172.217.18.14	unknown	United States		15169	GOOGLEUS	false
216.58.206.34	googleads.g.doubleclick.net	United States		15169	GOOGLEUS	false
54.78.254.47	load-euw1.exelator.com	United States		16509	AMAZON-02US	false
142.250.181.234	unknown	United States		15169	GOOGLEUS	false
216.200.232.253	pixel-origin.mathtag.com	United States		30419	MEDIAMATH-INCUS	false
142.250.185.202	unknown	United States		15169	GOOGLEUS	false
157.240.0.6	scontent.xx.fbcdn.net	United States		32934	FACEBOOKUS	false
37.157.2.250	istrp.adform.net	Denmark		198622	ADFORMDK	false
46.228.164.13	d-ams1.turn.com	United Kingdom		56396	TURNGB	false
37.252.172.123	ib.anycast.adnxs.com	European Union		29990	ASN-APPNEXUS	false
185.89.210.180	unknown	Germany		29990	ASN-APPNEXUS	false
87.248.119.252	dcs-ups.g03.yahoodns.net	United Kingdom		203220	YAHOO-DEBDE	false
52.37.75.192	unknown	United States		16509	AMAZON-02US	false
142.250.185.163	unknown	United States		15169	GOOGLEUS	false
43.166.134.219	ntta.org-pay-u5ch.sbs	Japan		4249	LILLY-ASUS	true
52.57.229.140	ActivationEdge-activation-1631408035.eu-central-1.elb.amazonaws.com	United States		16509	AMAZON-02US	false
142.250.186.131	unknown	United States		15169	GOOGLEUS	false
142.250.186.132	unknown	United States		15169	GOOGLEUS	false
172.217.18.98	unknown	United States		15169	GOOGLEUS	false
184.28.88.119	unknown	United States		16625	AKAMAI-ASUS	false
142.250.186.138	unknown	United States		15169	GOOGLEUS	false
23.32.185.35	unknown	United States		16625	AKAMAI-ASUS	false
104.17.24.14	cdnjs.cloudflare.com	United States		13335	CLOUDFLARENETUS	false
52.208.132.226	euw-ice.360yield.com	United States		16509	AMAZON-02US	false
3.125.196.33	ih.adscale.de	United States		16509	AMAZON-02US	false
142.251.5.154	stats.g.doubleclick.net	United States		15169	GOOGLEUS	false
104.18.26.193	unknown	United States		13335	CLOUDFLARENETUS	false
142.250.181.226	cm.g.doubleclick.net	United States		15169	GOOGLEUS	false
18.192.180.216	proxy-euro-2-685782417.eu-central-1.elb.amazonaws.com	United States		16509	AMAZON-02US	false
52.29.248.234	unknown	United States		16509	AMAZON-02US	false
52.48.19.27	match.prod.bidr.io	United States		16509	AMAZON-02US	false
45.223.166.11	wjrhjjv.impervadns.net	United States		327849	ROCKETNETZA	false
91.185.218.28	match.contentexchange.me	Slovenia		41828	TELEMACH-HOSTINGSI	false
46.228.174.117	sync.1rx.io	United Kingdom		56396	TURNGB	false
142.250.185.98	adservice.google.com	United States		15169	GOOGLEUS	false
3.127.178.105	ps.eyeota.net	United States		16509	AMAZON-02US	false
3.160.150.128	cdn.appdynamics.com	United States		16509	AMAZON-02US	false
173.194.76.84	unknown	United States		15169	GOOGLEUS	false
52.51.29.15	ds-pr-bh.ybp.gysm.yahoodns.net	United States		16509	AMAZON-02US	false
44.213.13.163	bidagent.xad.com	United States		14618	AMAZON-AESUS	false
154.54.250.80	unknown	United States		26558	FREEWHEELUS	false
18.184.216.10	unknown	United States		16509	AMAZON-02US	false
162.19.138.82	id5-sync.com	United States		209	CENTURYLINK-US-LEGACY-QWESTUS	false
151.101.66.49	unknown	United States		54113	FASTLYUS	false
142.250.184.195	unknown	United States		15169	GOOGLEUS	false
3.33.220.150	insight.adsrvr.org	United States		8987	AMAZONEXPANSIONGB	false
142.250.184.230	unknown	United States		15169	GOOGLEUS	false
217.79.178.221	unknown	Germany		24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	false
35.206.145.247	unknown	United States		19527	GOOGLE-2US	false
52.213.144.52	unknown	United States		16509	AMAZON-02US	false
54.38.113.4	pixel.onaudience.com	France		16276	OVHFR	false
13.107.42.14	unknown	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.233.237.126	na-ice.360yield.com	United States		14618	AMAZON-AESUS	false
185.64.191.214	imagsync-lhrpairbc.pubmatic.com	United Kingdom		62713	AS-PUBMATICUS	false
52.1.244.107	unknown	United States		14618	AMAZON-AESUS	false
142.250.185.70	dart.l.doubleclick.net	United States		15169	GOOGLEUS	false
172.217.18.102	ad.doubleclick.net	United States		15169	GOOGLEUS	false
172.217.16.194	unknown	United States		15169	GOOGLEUS	false
172.217.16.193	googlehosted.l.googleusercontent.com	United States		15169	GOOGLEUS	false
142.250.185.72	unknown	United States		15169	GOOGLEUS	false
172.217.16.196	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583428
Start date and time:	2025-01-02 18:38:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://ntta.org-pay-u5ch.sbs/us/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@30/6@298/844

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 142.250.185.110, 173.194.76.84, 142.250.185.78, 172.217.18.14
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://ntta.org-pay-u5ch.sbs/us/

LLM Input / Output

Input	Output
URL: https://ntta.org-pay-u5ch.sbs Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://ntta.org-pay-u5ch.sbs
URL: https://www.ntta.org/... Model: Joe Sandbox AI	{ "risk_score": 10, "reasoning": "This script demonstrates high-risk behavior, including dynamic code execution through the use of `eval()` and `unescape()` functions. It also appears to be heavily obfuscated, which is a common tactic used to conceal malicious intent. The script's purpose is unclear, and it poses a significant risk of executing arbitrary code on the user's system, potentially leading to data exfiltration or other malicious activities." }
eval(unescape("eval%28function%28p%2Ca%2Cc%2Ck%2Ce%2Cr%29%7Be%3Dfunction%28c%29%7Breturn%28c%3Ca%3F%27%27%3Ae%28parseInt%28c/a%29%29%29+%28%28c%3Dc%25a%29%3E35%3FString.fromCharCode%28c+29%29%3Ac.toString%2836%29%29%7D%3Bif%28%21%27%27.replace%28/%5E/%2CString%29%29%7Bwhile%28c--%29r%5Be%28c%29%5D%3Dk%5Bc%5D%7C%7Ce%28c%29%3Bk%3D%5Bfunction%28e%29%7Breturn%20r%5Be%5D%7D%5D%3Be%3Dfunction%28%29%7Breturn%27%5C%5Cw+%27%7D%3Bc%3D1%7D%3Bwhile%28c--%29if%28k%5Bc%5D%29p%3Dp.replace%28new%20RegExp%28%27%5C%5Cb%27+e%28c%29+%27%5C%5Cb%27%2C%27g%27%29%2Ck%5Bc%5D%29%3Breturn%20p%7D%28%276%207%28a%2Cb%29%7Bn%7B4%282.9%29%7B3%20c%3D2.9%28%22o%22%29%3Bc.p%28b%2Cf%2Cf%29%3Ba.q%28c%29%7Dg%7B3%20c%3D2.r%28%29%3Ba.s%28%5C%27t%5C%27+b%2Cc%29%7D%7Du%28e%29%7B%7D%7D6%20h%28a%29%7B4%28a.8%29a%3Da.8%3B4%28a%3D%3D%5C%27%5C%27%29v%3B3%20b%3Da.w%28%5C%27%7C%5C%27%29%5B1%5D%3B3%20c%3B3%20d%3D2.x%28%5C%27y%5C%27%29%3Bz%283%20i%3D0%3Bi%3Cd.5%3Bi++%294%28d%5Bi%5D.A%3D%3D%5C%27B-C-D%5C%27%29c%3Dd%5Bi%5D%3B4%282.j%28%5C%27k%5C%27%29%3D%3DE%7C%7C2.j%28%5C%27k%5C%27%29.l.5%3D%3D0%7C%7Cc.5%3D%3D0%7C%7Cc.l.5%3D%3D0%29%7BF%286%28%29%7Bh%28a%29%7D%2CG%29%7Dg%7Bc.8%3Db%3B7%28c%2C%5C%27m%5C%27%29%3B7%28c%2C%5C%27m%5C%27%29%7D%7D%27%2C43%2C43%2C%27%7C%7Cdocument%7Cvar%7Cif%7Clength%7Cfunction%7CGTranslateFireEvent%7Cvalue%7CcreateEvent%7C%7C%7C%7C%7C%7Ctrue%7Celse%7CdoGTranslate%7C%7CgetElementById%7Cgoogle_translate_element2%7CinnerHTML%7Cchange%7Ctry%7CHTMLEvents%7CinitEvent%7CdispatchEvent%7CcreateEventObject%7CfireEvent%7Con%7Ccatch%7Creturn%7Csplit%7CgetElementsByTagName%7Cselect%7Cfor%7CclassName%7Cgoog%7Cte%7Ccombo%7Cnull%7CsetTimeout%7C500%27.split%28%27%7C%27%29%2C0%2C%7B%7D%29%29"))
URL: https://cdnjs.cloudflare.com/ajax/libs/dragula/3.7... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script appears to be a library for drag-and-drop functionality, with no high-risk behaviors such as dynamic code execution or data exfiltration. It uses some legacy practices and aggressive DOM manipulation, but these are typical for such libraries and do not indicate malicious intent." }
!function(e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define([],e):("undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:this).dragula=e()}(function(){return function o(r,i,u){function c(t,e){if(!i[t]){if(!r[t]){var n="function"==typeof require&&require;if(!e&&n)return n(t,!0);if(a)return a(t,!0);throw(n=new Error("Cannot find module '"+t+"'")).code="MODULE_NOT_FOUND",n}n=i[t]={exports:{}},r[t][0].call(n.exports,function(e){return c(r[t][1][e]\|\|e)},n,n.exports,o,r,i,u)}return i[t].exports}for(var a="function"==typeof require&&require,e=0;e<u.length;e++)c(u[e]);return c}({1:[function(e,t,n){"use strict";var o={},r="(?:^\|\\s)",i="(?:\\s\|$)";function u(e){var t=o[e];return t?t.lastIndex=0:o[e]=t=new RegExp(r+e+i,"g"),t}t.exports={add:function(e,t){var n=e.className;n.length?u(t).test(n)\|\|(e.className+=" "+t):e.className=t},rm:function(e,t){e.className=e.className.replace(u(t)," ").trim()}}},{}],2:[function(e,t,n){(function(r){"use strict";var M=e("contra/emitter"),k=e("crossvent"),j=e("./classes"),R=document,q=R.documentElement;function U(e,t,n,o){r.navigator.pointerEnabled?k[t](e,{mouseup:"pointerup",mousedown:"pointerdown",mousemove:"pointermove"}[n],o):r.navigator.msPointerEnabled?k[t](e,{mouseup:"MSPointerUp",mousedown:"MSPointerDown",mousemove:"MSPointerMove"}[n],o):(k[t](e,{mouseup:"touchend",mousedown:"touchstart",mousemove:"touchmove"}[n],o),k[t](e,n,o))}function K(e){if(void 0!==e.touches)return e.touches.length;if(void 0!==e.which&&0!==e.which)return e.which;if(void 0!==e.buttons)return e.buttons;e=e.button;return void 0!==e?1&e?1:2&e?3:4&e?2:0:void 0}function z(e,t){return void 0!==r[t]?r[t]:(q.clientHeight?q:R.body)[e]}function H(e,t,n){var o=(e=e\|\|{}).className\|\|"";return e.className+=" gu-hide",n=R.elementFromPoint(t,n),e.className=o,n}function V(){return!1}function $(){return!0}function G(e){return e.width\|\|e.right-e.left}function J(e){return e.height\|\|e.bottom-e.top}function Q(e){return e.parentNode===R?null:e.parentNode}function W(e){return"INPUT"===e.tagName\|\|"TEXTAREA"===e.tagName\|\|"SELECT"===e.tagName\|\|function e(t){if(!t)return!1;if("false"===t.contentEditable)return!1;if("true"===t.contentEditable)return!0;return e(Q(t))}(e)}function Z(t){return t.nextElementSibling\|\|function(){var e=t;for(;e=e.nextSibling,e&&1!==e.nodeType;);return e}()}function ee(e,t){var t=(n=t).targetTouches&&n.targetTouches.length?n.targetTouches[0]:n.changedTouches&&n.changedTouches.length?n.changedTouches[0]:n,n={pageX:"clientX",pageY:"clientY"};return e in n&&!(e in t)&&n[e]in t&&(e=n[e]),t[e]}t.exports=function(e,t){var l,f,s,d,m,o,r,v,p,h,n;1===arguments.length&&!1===Array.isArray(e)&&(t=e,e=[]);var i,g=null,y=t\|\|{};void 0===y.moves&&(y.moves=$),void 0===y.accepts&&(y.accepts=$),void 0===y.invalid&&(y.invalid=function(){return!1}),void 0===y.containers&&(y.containers=e\|\|[]),void 0===y.isContainer&&(y.isContainer=V),void 0===y.copy&&(y.copy=!1),void 0===y.copySortSource&&(y.copySortSource=!1),void 0===y.revertOnSpill&&(y.revertOnSpill=!1),void 0===y.removeOnSpill&&(y.removeOnSpill=!1),void 0===y.direction&&(y.direction="vertical"),void 0===y.ignoreInputTextSelection&&(y.ignoreInputTextSelection=!0),void 0===y.mirrorContainer&&(y.mirrorContainer=R.body);var w=M({containers:y.containers,start:function(e){e=S(e);e&&C(e)},end:O,cancel:L,remove:X,destroy:function(){c(!0),N({})},canMove:function(e){return!!S(e)},dragging:!1});return!0===y.removeOnSpill&&w.on("over",function(e){j.rm(e,"gu-hide")}).on("out",function(e){w.dragging&&j.add(e,"gu-hide")}),c(),w;function u(e){return-1!==w.containers.indexOf(e)\|\|y.isContainer(e)}function c(e){e=e?"remove":"add";U(q,e,"mousedown",E),U(q,e,"mouseup",N)}function a(e){U(q,e?"remove":"add","mousemove",x)}function b(e){e=e?"remove":"add";k[e](q,"selectstart",T),k[e](q,"click",T)}function T(e){i&&e.preventDefault()}function E(e){var t,n;o=e.clientX,r=e.clientY,1!==K(e)\|\|e.metaKey\|\|e.ctrlKey\|\|(n
URL: https://ssptrips.ntta.org/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a simple browser compatibility check and URL redirection logic. It checks if the user is using an Internet Explorer (IE) browser and redirects them to a 'browser-support' page if true. It also checks if the current URL does not contain a hash fragment, and if the URL path includes 'account', it replaces the URL with a hash-based route. These behaviors are common in web applications and do not demonstrate any high-risk indicators." }
ua = navigator.userAgent; function isIE() { var is_ie = (ua.indexOf("MSIE ") > -1 \|\| ua.indexOf("Trident/") > -1) && !(/Edge\/\d./i.test(ua)); return is_ie; } // \|\| (ua.toLowerCase().indexOf('chrome') == -1 && ua.match(/(safari)\/?\s(\.?\d+(\.\d+))/i)) if (isIE()) { window.location.href = "./browser-support/" } if (!window.location.href.includes('#')) { if (window.location.pathname.includes('account')) { window.location.replace('#/account'); } }
URL: https://www.ntta.org/core/misc/drupal.init.js?v=10... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate Drupal-related code that sets up the necessary event listeners and initializes Drupal behaviors. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The code is primarily focused on ensuring the proper initialization of the Drupal framework, which is a common and expected behavior for Drupal-powered websites." }
if(window.jQuery){jQuery.noConflict();} document.documentElement.className+=' js';(function(Drupal,drupalSettings){const domReady=(callback)=>{const listener=()=>{callback();document.removeEventListener('DOMContentLoaded',listener);};if(document.readyState!=='loading'){setTimeout(callback,0);}else{document.addEventListener('DOMContentLoaded',listener);}};domReady(()=>{Drupal.attachBehaviors(document,drupalSettings);});})(Drupal,window.drupalSettings);
URL: https://www.ntta.org/core/assets/vendor/tabbable/i... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a utility library for managing tabbable elements in the DOM. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is focused on identifying and filtering tabbable elements based on various rules and heuristics, which is a common and legitimate use case. There are no signs of obfuscation or suspicious behavior, and the library seems to be using standard web APIs and techniques. Overall, this script is likely benign and poses a low risk." }
!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports):"function"==typeof define&&define.amd?define(["exports"],e):(t="undefined"!=typeof globalThis?globalThis:t\|\|self,function(){var n=t.tabbable,o=t.tabbable={};e(o),o.noConflict=function(){return t.tabbable=n,o}}())}(this,(function(t){"use strict";var e=["input:not([inert])","select:not([inert])","textarea:not([inert])","a[href]:not([inert])","button:not([inert])","[tabindex]:not(slot):not([inert])","audio[controls]:not([inert])","video[controls]:not([inert])",'[contenteditable]:not([contenteditable="false"]):not([inert])',"details>summary:first-of-type:not([inert])","details:not([inert])"],n=e.join(","),o="undefined"==typeof Element,r=o?function(){}:Element.prototype.matches\|\|Element.prototype.msMatchesSelector\|\|Element.prototype.webkitMatchesSelector,i=!o&&Element.prototype.getRootNode?function(t){var e;return null==t\|\|null===(e=t.getRootNode)\|\|void 0===e?void 0:e.call(t)}:function(t){return null==t?void 0:t.ownerDocument},a=function t(e,n){var o;void 0===n&&(n=!0);var r=null==e\|\|null===(o=e.getAttribute)\|\|void 0===o?void 0:o.call(e,"inert");return""===r\|\|"true"===r\|\|n&&e&&t(e.parentNode)},l=function(t,e,o){if(a(t))return[];var i=Array.prototype.slice.apply(t.querySelectorAll(n));return e&&r.call(t,n)&&i.unshift(t),i=i.filter(o)},u=function t(e,o,i){for(var l=[],u=Array.from(e);u.length;){var d=u.shift();if(!a(d,!1))if("SLOT"===d.tagName){var c=d.assignedElements(),f=t(c.length?c:d.children,!0,i);i.flatten?l.push.apply(l,f):l.push({scopeParent:d,candidates:f})}else{r.call(d,n)&&i.filter(d)&&(o\|\|!e.includes(d))&&l.push(d);var s=d.shadowRoot\|\|"function"==typeof i.getShadowRoot&&i.getShadowRoot(d),p=!a(s,!1)&&(!i.shadowRootFilter\|\|i.shadowRootFilter(d));if(s&&p){var h=t(!0===s?d.children:s.children,!0,i);i.flatten?l.push.apply(l,h):l.push({scopeParent:d,candidates:h})}else u.unshift.apply(u,d.children)}}return l},d=function(t){return!isNaN(parseInt(t.getAttribute("tabindex"),10))},c=function(t){if(!t)throw new Error("No node provided");return t.tabIndex<0&&(/^(AUDIO\|VIDEO\|DETAILS)$/.test(t.tagName)\|\|function(t){var e,n=null==t\|\|null===(e=t.getAttribute)\|\|void 0===e?void 0:e.call(t,"contenteditable");return""===n\|\|"true"===n}(t))&&!d(t)?0:t.tabIndex},f=function(t,e){return t.tabIndex===e.tabIndex?t.documentOrder-e.documentOrder:t.tabIndex-e.tabIndex},s=function(t){return"INPUT"===t.tagName},p=function(t){return function(t){return s(t)&&"radio"===t.type}(t)&&!function(t){if(!t.name)return!0;var e,n=t.form\|\|i(t),o=function(t){return n.querySelectorAll('input[type="radio"][name="'+t+'"]')};if("undefined"!=typeof window&&void 0!==window.CSS&&"function"==typeof window.CSS.escape)e=o(window.CSS.escape(t.name));else try{e=o(t.name)}catch(t){return console.error("Looks like you have a radio button with a name attribute containing invalid CSS selector characters and need the CSS.escape polyfill: %s",t.message),!1}var r=function(t,e){for(var n=0;n<t.length;n++)if(t[n].checked&&t[n].form===e)return t[n]}(e,t.form);return!r\|\|r===t}(t)},h=function(t){var e=t.getBoundingClientRect(),n=e.width,o=e.height;return 0===n&&0===o},v=function(t,e){var n=e.displayCheck,o=e.getShadowRoot;if("hidden"===getComputedStyle(t).visibility)return!0;var a=r.call(t,"details>summary:first-of-type")?t.parentElement:t;if(r.call(a,"details:not([open]) *"))return!0;if(n&&"full"!==n&&"legacy-full"!==n){if("non-zero-area"===n)return h(t)}else{if("function"==typeof o){for(var l=t;t;){var u=t.parentElement,d=i(t);if(u&&!u.shadowRoot&&!0===o(u))return h(t);t=t.assignedSlot?t.assignedSlot:u\|\|d===t.ownerDocument?u:d.host}t=l}if(function(t){var e,n,o,r,a=t&&i(t),l=null===(e=a)\|\|void 0===e?void 0:e.host,u=!1;if(a&&a!==t)for(u=!!(null!==(n=l)&&void 0!==n&&null!==(o=n.ownerDocument)&&void 0!==o&&o.contains(l)\|\|null!=t&&null!==(r=t.ownerDocument)&&void 0!==r&&r.contains(t));!u&&l;){var d,c,f;u=!(null===(c=l=null===(d=a=i(l))\|\|void 0===d?void 0:d.host)\|\|void 0===c\|\|null===(f=c.ownerDocument)\|\|void 0===f\|\|!f.c
URL: https://translate.googleapis.com/_/translate_http/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a utility library with common web functionality, such as URL parsing, query string manipulation, and encoding/decoding operations. While it contains some features that could be used for potentially malicious purposes (e.g., dynamic code execution, data exfiltration), the overall context and lack of clear malicious intent suggest this is likely a benign library. The risk score is on the lower end due to the legitimate nature of the functionality, but some caution is still warranted when integrating this library into a web application." }
"use strict";this.default_tr=this.default_tr\|\|{};(function(_){var window=this; try{ var Tg,Ug,Yg,Zg,$g,bh,ch,eh,fh,gh,hh,ih,kh,mh,nh;_.Sg=function(a,b,c){if(a.forEach&&typeof a.forEach=="function")a.forEach(b,c);else if(_.sa(a)\|\|typeof a==="string")Array.prototype.forEach.call(a,b,c);else for(var d=_.nf(a),e=_.mf(a),f=e.length,g=0;g<f;g++)b.call(c,e[g],d&&d[g],a)};Tg=function(a,b){if(b){b=Number(b);if(isNaN(b)\|\|b<0)throw Error("L`"+b);a.B=b}else a.B=null};Ug=function(a,b){return a?b?decodeURI(a.replace(/%25/g,"%2525")):decodeURIComponent(a):""}; _.Vg=function(a,b,c){a.j=c?Ug(b,!0):b;return a};_.Wg=function(a,b,c){a.h=c?Ug(b,!0):b;return a};_.Xg=function(a,b,c){a.l=c?Ug(b,!0):b;a.l&&(a.l=a.l.replace(/:$/,""));return a};Yg=/[#\/\?@]/g;Zg=/[#\?]/g;$g=/[#\?:]/g;bh=/#/g;ch=/[#\?@]/g;_.dh=function(a){var b=_.pc();a.g.set("zx",b)};eh=function(a){a=a.charCodeAt(0);return"%"+(a>>4&15).toString(16)+(a&15).toString(16)};fh=function(a,b,c){return typeof a==="string"?(a=encodeURI(a).replace(b,eh),c&&(a=a.replace(/%25([0-9a-fA-F]{2})/g,"%$1")),a):null}; gh=function(a){a.g\|\|(a.g=new Map,a.h=0,a.j&&_.Df(a.j,function(b,c){a.add(_.oc(b),c)}))};hh=function(a,b){b=String(b);a.l&&(b=b.toLowerCase());return b};ih=function(a,b){gh(a);b=hh(a,b);return a.g.has(b)};_.jh=function(a,b){this.h=this.g=null;this.j=a\|\|null;this.l=!!b};_.k=_.jh.prototype;_.k.mb=function(){gh(this);return this.h};_.k.add=function(a,b){gh(this);this.j=null;a=hh(this,a);var c=this.g.get(a);c\|\|this.g.set(a,c=[]);c.push(b);this.h+=1;return this}; _.k.remove=function(a){gh(this);a=hh(this,a);return this.g.has(a)?(this.j=null,this.h-=this.g.get(a).length,this.g.delete(a)):!1};_.k.clear=function(){this.g=this.j=null;this.h=0};_.k.Qc=function(a){var b=this.La();return _.va(b,a)};_.k.forEach=function(a,b){gh(this);this.g.forEach(function(c,d){c.forEach(function(e){a.call(b,e,d,this)},this)},this)}; _.k.Zb=function(){gh(this);for(var a=Array.from(this.g.values()),b=Array.from(this.g.keys()),c=[],d=0;d<b.length;d++)for(var e=a[d],f=0;f<e.length;f++)c.push(b[d]);return c};_.k.La=function(a){gh(this);var b=[];if(typeof a==="string")ih(this,a)&&(b=b.concat(this.g.get(hh(this,a))));else{a=Array.from(this.g.values());for(var c=0;c<a.length;c++)b=b.concat(a[c])}return b};_.k.set=function(a,b){gh(this);this.j=null;a=hh(this,a);ih(this,a)&&(this.h-=this.g.get(a).length);this.g.set(a,[b]);this.h+=1;return this}; _.k.get=function(a,b){if(!a)return b;a=this.La(a);return a.length>0?String(a[0]):b};_.k.toString=function(){if(this.j)return this.j;if(!this.g)return"";for(var a=[],b=Array.from(this.g.keys()),c=0;c<b.length;c++){var d=b[c],e=_.nc(d);d=this.La(d);for(var f=0;f<d.length;f++){var g=e;d[f]!==""&&(g+="="+_.nc(d[f]));a.push(g)}}return this.j=a.join("&")};_.k.extend=function(a){for(var b=0;b<arguments.length;b++)_.Sg(arguments[b],function(c,d){this.add(d,c)},this)}; kh=function(a){var b=new _.jh;b.j=a.j;a.g&&(b.g=new Map(a.g),b.h=a.h);return b};_.lh=function(a,b,c){a.remove(b);c.length>0&&(a.j=null,a.g.set(hh(a,b),_.ya(c)),a.h+=c.length)};mh=function(a,b){b&&!a.l&&(gh(a),a.j=null,a.g.forEach(function(c,d){var e=d.toLowerCase();d!=e&&(this.remove(d),_.lh(this,e,c))},a));a.l=b};nh=function(a,b,c){b instanceof _.jh?(a.g=b,mh(a.g,a.o)):(c\|\|(b=fh(b,ch)),a.g=new _.jh(b,a.o))}; _.oh=function(a){this.h=this.A=this.l="";this.B=null;this.s=this.j="";this.o=!1;var b;a instanceof _.oh?(this.o=a.o,_.Xg(this,a.l),this.A=a.A,_.Wg(this,a.h),Tg(this,a.B),_.Vg(this,a.j),nh(this,kh(a.g)),this.s=a.s):a&&(b=String(a).match(_.Bf))?(this.o=!1,_.Xg(this,b[1]\|\|"",!0),this.A=Ug(b[2]\|\|""),_.Wg(this,b[3]\|\|"",!0),Tg(this,b[4]),_.Vg(this,b[5]\|\|"",!0),nh(this,b[6]\|\|"",!0),this.s=Ug(b[7]\|\|"")):(this.o=!1,this.g=new _.jh(null,this.o))}; _.oh.prototype.toString=function(){var a=[],b=this.l;b&&a.push(fh(b,Yg,!0),":");var c=this.h;if(c\|\|b=="file")a.push("//"),(b=this.A)&&a.push(fh(b,Yg,!0),"@"),a.push(_.nc(c).replace(/%25([0-9a-fA-F]{2})/g,"%$1")),c=this.B,c!=null&&a.push(":",String(c));if(c=this.j)this.h&&c.charAt(0)!="/"&&a.push("/
URL: about:srcdoc... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script appears to be a sandboxed messaging system that allows communication between a parent window and an iframe. It uses the Trusted Types API to create safe script URLs, which mitigates some risks. However, the script also dynamically executes remote code, which is a high-risk indicator. Additionally, the script is obfuscated, making it more difficult to analyze. Overall, the script exhibits both benign and potentially risky behaviors, warranting a medium-risk score." }
(function(){'use strict';var f=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,c,b){if(a==Array.prototype\|\|a==Object.prototype)return a;a[c]=b.value;return a};function g(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var c=0;c<a.length;++c){var b=a[c];if(b&&b.Math==Math)return b}throw Error("Cannot find global object");}var h=g(this); function k(a,c){if(c)a:{var b=h;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in b))break a;b=b[e]}a=a[a.length-1];d=b[a];c=c(d);c!=d&&c!=null&&f(b,a,{configurable:!0,writable:!0,value:c})}}k("globalThis",function(a){return a\|\|h});/* Copyright Google LLC SPDX-License-Identifier: Apache-2.0 */ var l=globalThis.trustedTypes,m;function n(){var a=null;if(!l)return a;try{var c=function(b){return b};a=l.createPolicy("goog#html",{createHTML:c,createScript:c,createScriptURL:c})}catch(b){}return a};function p(a){this.g=a}p.prototype.toString=function(){return this.g+""};function q(a){m===void 0&&(m=n());return new p(m?m.createScriptURL(a):a)};if(!function(){if(self.origin)return self.origin==="null";if(location.host!=="")return!1;try{return window.parent.escape(""),!1}catch(a){return!0}}())throw Error("sandboxing error"); window.addEventListener("message",function(a){var c=a.ports[0];a=a.data;var b=a.callbackName.split("."),d=window;b[0]==="window"&&b.shift();for(var e=0;e<b.length-1;e++)d[b[e]]={},d=d[b[e]];d[b[b.length-1]]=function(r){c.postMessage(JSON.stringify(r))};b=document.createElement("script");a=q(a.url);if(a instanceof p)a=a.g;else throw Error("");b.src=a;document.body.appendChild(b)},!0);}).call(this);
URL: https://www.ntta.org/themes/custom/ntta/js/section... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a Drupal behavior that generates anchor navigation links based on the content of the page. It does not exhibit any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script is primarily focused on enhancing the user experience by creating a table of contents-like navigation. While it uses some legacy practices like `once()` and `Drupal.theme.anchornavlink()`, these do not pose significant security risks. Overall, the script seems to be a legitimate and benign implementation within the Drupal framework." }
(function(Drupal){"use strict";Drupal.behaviors.ntta_section={attach:function(context,settings){var pagesection=once("page-section",".page-section[data-toc]"),hasanchornavlink=false,anchornav=document.querySelector(".anchor-nav");if(anchornav&&pagesection.length>0){pagesection.forEach(function(el){const h2=el.getAttribute("data-toc");if(h2){hasanchornavlink=true;anchornav.innerHTML+=Drupal.theme.anchornavlink(el.id,h2,settings.space);}});if(!hasanchornavlink){anchornav.style.display="none";}}},};Drupal.theme.anchornavlink=function(id,text,space){return("<a href='#"+id+"' class='anchor-nav-link "+(space==="about-ntta"?"green":"blue")+" w-inline-block'><div>"+text+"</div><img loading='lazy' src='/themes/custom/ntta/images/tab-arrow.svg' alt='' class='tab-arrow'></a>");};})(Drupal);
URL: https://www.ntta.org Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.ntta.org
URL: https://www.ntta.org/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Holiday Closure", "prominent_button_name": "Manage Your Account or Pay Your Bill Online", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.ntta.org/core/misc/drupal.js?v=10.2.3... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script is a part of the Drupal JavaScript API, which is a well-known and reputable content management system. It defines structures and behaviors for Drupal's frontend operations without any high-risk indicators such as dynamic code execution or data exfiltration. The script primarily focuses on initializing and managing behaviors in a structured manner, which is typical for a CMS like Drupal. There are no interactions with external domains or aggressive DOM manipulations present in the snippet." }
/** * @file * Defines the Drupal JavaScript API. / /* * A jQuery object, typically the return value from a `$(selector)` call. * * Holds an HTMLElement or a collection of HTMLElements. * * @typedef {object} jQuery * * @prop {number} length=0 * Number of elements contained in the jQuery object. / /* * Variable generated by Drupal that holds all translated strings from PHP. * * Content of this variable is automatically created by Drupal when using the * Interface Translation module. It holds the translation of strings used on * the page. * * This variable is used to pass data from the backend to the frontend. Data * contained in `drupalSettings` is used during behavior initialization. * * @global * * @var {object} drupalTranslations / /* * Global Drupal object. * * All Drupal JavaScript APIs are contained in this namespace. * * @global * * @namespace / window.Drupal = { behaviors: {}, locale: {} }; // JavaScript should be made compatible with libraries other than jQuery by // wrapping it in an anonymous closure. (function ( Drupal, drupalSettings, drupalTranslations, console, Proxy, Reflect, ) { /* * Helper to rethrow errors asynchronously. * * This way Errors bubbles up outside of the original callstack, making it * easier to debug errors in the browser. * * @param {Error\|string} error * The error to be thrown. / Drupal.throwError = function (error) { setTimeout(() => { throw error; }, 0); }; /* * Custom error thrown after attach/detach if one or more behaviors failed. * Initializes the JavaScript behaviors for page loads and Ajax requests. * * @callback Drupal~behaviorAttach * * @param {HTMLDocument\|HTMLElement} context * An element to detach behaviors from. * @param {?object} settings * An object containing settings for the current context. It is rarely used. * * @see Drupal.attachBehaviors / /* * Reverts and cleans up JavaScript behavior initialization. * * @callback Drupal~behaviorDetach * * @param {HTMLDocument\|HTMLElement} context * An element to attach behaviors to. * @param {object} settings * An object containing settings for the current context. * @param {string} trigger * One of `'unload'`, `'move'`, or `'serialize'`. * * @see Drupal.detachBehaviors / /* * @typedef {object} Drupal~behavior * * @prop {Drupal~behaviorAttach} attach * Function run on page load and after an Ajax call. * @prop {Drupal~behaviorDetach} [detach] * Function run when content is serialized or removed from the page. / /* * Holds all initialization methods. * * @namespace Drupal.behaviors * * @type {Object.<string, Drupal~behavior>} / /* * Defines a behavior to be run during attach and detach phases. * * Attaches all registered behaviors to a page element. * * Behaviors are event-triggered actions that attach to page elements, * enhancing default non-JavaScript UIs. Behaviors are registered in the * {@link Drupal.behaviors} object using the method 'attach' and optionally * also 'detach'. * * {@link Drupal.attachBehaviors} is added below to the `jQuery.ready` event * and therefore runs on initial page load. Developers implementing Ajax in * their solutions should also call this function after new page content has * been loaded, feeding in an element to be processed, in order to attach all * behaviors to the new content. * * Behaviors should use `var elements = * once('behavior-name', selector, context);` to ensure the behavior is * attached only once to a given element. (Doing so enables the reprocessing * of given elements, which may be needed on occasion despite the ability to * limit behavior attachment to a particular element.) * * @example * Drupal.behaviors.behaviorName = { * attach: function (context, settings) { *
URL: https://www.ntta.org/core/assets/vendor/jquery/jqu... Model: Joe Sandbox AI	```json { "risk_score": 3, "reasoning": "The script includes dynamic code execution through the creation and manipulation of script elements, which can be a high-risk behavior. However, it appears to be a part of a library setup (possibly jQuery), which is a common and legitimate use case. No other high-risk behaviors like data exfiltration or redirects to suspicious domains are present." }
!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[i.call(e)]\|\|"object":typeof e}var t="3.7.1",l=/HTML$/i,ce=function(e,t){return new ce.fn.init(e,t)};function c(e){var t=!!e&&"length"in e&&e.length,n=x(e);return!v(e)&&!y(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}function fe(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()}ce.fn=ce.prototype={jquery:t,constructor:ce,length:0,toArray:function(){return ae.call(this)},get:function(e){return null==e?ae.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=ce.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return ce.each(this,e)},map:function(n){return this.pushStack(ce.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(ae.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(ce.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(ce.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:s,sort:oe.sort,splice:oe.splice},ce.extend=ce.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|v(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(ce.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|ce.isPlainObject(n)?n:{},i=!1,a[t]=ce.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},ce.extend({expando:"jQuery"+(t+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==i.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=ue.call(t,"constructor")&&t.constructor)&&o.call(n)===a)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){m(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(c(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},text:function(e){var t,n="",r=0,i=e.nodeType;if(!i)while(t=e[r++])n+=ce.text(t);return 1===i\|\|11===i?e.textContent:9===i?e.documentElement.textContent:3===i\|\|4===i?e.nodeValue:n},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(c(Object(e))?ce.merge(n,"string"==typeof e?[e]:e):s.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:se.call(t,e,n)},isXMLDoc:function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|\|e).documentElement;return!l.test(t\|\|n&&n.nodeName\|\|"HTML")},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(c(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o
URL: https://www.ntta.org/ Model: Joe Sandbox AI	{ "brands": [ "NTTA" ] }
	{ "brands": [ "NTTA" ] }
URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign up for TollTag", "prominent_button_name": "Login", "text_input_field_labels": [ "Username", "Password", "License Plate", "PIN" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://ssptrips.ntta.org Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://ssptrips.ntta.org
URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Small Sticker - Big Savings", "prominent_button_name": "Login", "text_input_field_labels": [ "Username", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	{ "brands": [ "Zip Cash" ] }
	{ "brands": [ "Zip Cash" ] }
URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Small Sticker Big Savings", "prominent_button_name": "Login", "text_input_field_labels": [ "Username", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	{ "brands": [ "NTTA", "ZipCash" ] }
	{ "brands": [ "NTTA", "ZipCash" ] }
URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	{ "brands": [ "NTTA", "Zip Cash" ] }
	{ "brands": [ "NTTA", "Zip Cash" ] }
URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	```json{ "legit_domain": "ntta.org", "classification": "unknown", "reasons": [ "The URL 'ssptrips.ntta.org' is a subdomain of 'ntta.org', which is the legitimate domain for the North Texas Tollway Authority (NTTA).", "The brand 'Zip Cash' is associated with NTTA, as it is a payment option for tolls in Texas.", "The presence of a subdomain 'ssptrips' does not inherently indicate phishing, as organizations often use subdomains for specific services.", "The input fields (Username, Password, License Plate, PIN) are typical for a toll service login, which aligns with NTTA's services.", "No suspicious elements such as misspellings or unusual domain extensions are present in the URL." ], "riskscore": 2}
URL: ssptrips.ntta.org Brands: Zip Cash Input Fields: Username, Password, License Plate, PIN
URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	```json{ "legit_domain": "ntta.org", "classification": "known", "reasons": [ "The URL 'ssptrips.ntta.org' is a subdomain of 'ntta.org', which is the legitimate domain for NTTA (North Texas Tollway Authority).", "The brand 'NTTA' is classified as 'known' as it is a regional authority managing toll roads in North Texas.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The presence of input fields for 'Username' and 'Password' is typical for a login page, which is expected for a service like NTTA." ], "riskscore": 2}
URL: ssptrips.ntta.org Brands: NTTA Input Fields: Username, Password
URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	```json{ "legit_domain": "ntta.org", "classification": "known", "reasons": [ "The URL 'ssptrips.ntta.org' is a subdomain of 'ntta.org', which is the legitimate domain for NTTA (North Texas Tollway Authority).", "The brand 'NTTA' is classified as 'known' because it is a regional authority managing toll roads in North Texas.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The presence of input fields for 'Username' and 'Password' is typical for a login page, which is expected for a service like NTTA." ], "riskscore": 2}
URL: ssptrips.ntta.org Brands: NTTA Input Fields: Username, Password
URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Small Sticker Big Savings", "prominent_button_name": "Login", "text_input_field_labels": [ "Username", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	{ "brands": [ "NTTA", "Zip Cash" ] }
	{ "brands": [ "NTTA", "Zip Cash" ] }
URL: https://ssptrips.ntta.org/#/ Model: Joe Sandbox AI	```json{ "legit_domain": "ntta.org", "classification": "known", "reasons": [ "The URL 'ssptrips.ntta.org' is a subdomain of 'ntta.org', which is the legitimate domain for NTTA (North Texas Tollway Authority).", "The brand 'NTTA' is classified as 'known' as it is a regional authority managing toll roads in North Texas.", "The use of a subdomain 'ssptrips' does not inherently indicate phishing, as organizations often use subdomains for specific services or portals.", "No suspicious elements such as misspellings or unusual domain extensions are present in the URL." ], "riskscore": 2}
URL: ssptrips.ntta.org Brands: NTTA Input Fields: Username, Password

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 2 16:38:55 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9872632393443497
Encrypted:	false
SSDEEP:
MD5:	2084BDC55BA31B04748BA9238A59A88D
SHA1:	BEDBF03BD375ECAA3B0FD7C5EB4E32BD433057FA
SHA-256:	30B8BAED3C9A1BFD51E6FBAD04318AC354392A9A243A447DB9407FCEABF641D1
SHA-512:	93D2FB48C40A2F73EB2B1409E3BF6EF889B6EB123A5C8D7F09AA5F76AD23F4D787CAD44EB458B552BC5991C0AA088A8DE7E0D66B680F4D011703951E6E3B8232
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....}..1=]..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I"Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V"Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V"Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V"Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........+........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 2 16:38:54 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.002232241690946
Encrypted:	false
SSDEEP:
MD5:	F9B1A4E0904AAFA160B5A0CACB0DF6F7
SHA1:	5AF8FAB58E58F2FFFD18AEEF877D2A4AF54BC434
SHA-256:	BC0B32150CA26EED0F4F5F8D88A5F5D7A7116207A85960EA782C9AC3C7F7904B
SHA-512:	344A4DD924B289BC0985652C751FB1C1636A2E7E040AA299F2064B0E7FD3A767C80603CFA50BA62F507C0F5AA08A4F53A09B4598CF3DB49096EF4D69C8CA2081
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....8..1=]..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I"Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V"Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V"Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V"Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........+........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.012307561900046
Encrypted:	false
SSDEEP:
MD5:	E8BD2A00BD4237C87268C89D8722E1BC
SHA1:	62B60BEAA22005895ACBF4B6B147B702466E7D87
SHA-256:	9747420F63697B6B2DA9ECBE45FBA3352AC2899202B7A168C8082584A657011B
SHA-512:	20BC80BB935F2205550A3B8A87A50EF01FC300C15B63EDFB37B4C3FB76E0B4263F26246CBC3EDE7B7E6975E4EAEF475201205B4C3696DD2138CF664B0395F3AD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I"Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V"Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V"Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........+........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 2 16:38:54 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.002672831096308
Encrypted:	false
SSDEEP:
MD5:	3E09B1DBC741861054CE87D2579062B2
SHA1:	57B8B61CBACD849DCFA07E7200C68B744FAC60A1
SHA-256:	9CC37B37D6D75E57AAA24294D07B624C53BF7CD9E7E2F85A9B9F868BF3C15F6A
SHA-512:	B8FBBD59E0477A152E3D6D747D31D9175E8FA17E5ED4CC778C035D8A1B84D28EACADAD57E4CCF8D0C04C0E8D5A8D13CCD93F8FAFABCA0E8795186DF4FD7A6A96
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....<..1=]..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I"Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V"Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V"Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V"Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........+........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 2 16:38:55 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9916099064333714
Encrypted:	false
SSDEEP:
MD5:	CEF2037AEBBB59B8E6B85E5DCC135A64
SHA1:	4ADFCE87DB4CD647E234B56EC474325D3A2B7E3D
SHA-256:	2B78FA1B0886412B3E2556CE16AA162000E6F803DB78488E95110F898B9472AF
SHA-512:	913FB52D668A367AEA3E0A6F1CDBCE190E56A35DD174D0139DF414EE552B39D8B7CF16F6C317688463C6DF56FC29EF8C61A83F711A0B434122C08DC967547F06
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....!.1=]..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I"Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V"Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V"Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V"Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........+........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 2 16:38:54 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.00268039829407
Encrypted:	false
SSDEEP:
MD5:	1B9F575316EB72B7728C0D3FEAFB8610
SHA1:	83ADEDC8439500105C2C649D7665EB212333B38D
SHA-256:	F929808C3AD34B6BA055C8852751656831A5913F88B20B327162646BE53B2D90
SHA-512:	531C767215C609491890FAE5F60C9EEC493DECF018C8E8DAB9BED86D55DB0B00B2C2623E119D005C70795BF99A09622BCA46A3AEF29F336A59E6D10FEDB55E86
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......1=]..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I"Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V"Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V"Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V"Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........+........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info