Windows Analysis Report
http://www.cpcheckme.com

Overview

General Information

Sample URL: http://www.cpcheckme.com
Analysis ID: 1445862
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Yara detected Powershell download and execute
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected non-DNS traffic on DNS port
Downloads executable code via HTTP
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTML page contains hidden URLs or javascript code
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://www.cpcheckme.com/checkme/rest/test/getScanTypesDetails?ts=1716391642957 Avira URL Cloud: Label: malware
Source: http://www.cpcheckme.com/checkme/rest/test/getScanStatus?ts=1716391676043&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 Avira URL Cloud: Label: malware
Source: http://www.cpcheckme.com/checkme/rest/test/getExcludedEmails?ts=1716391642959 Avira URL Cloud: Label: malware
Source: http://www.cpcheckme.com/checkme/rest/endpoint/p Avira URL Cloud: Label: malware
Source: http://www.cpcheckme.com/checkme/rest/endpoint/start Avira URL Cloud: Label: malware
Source: http://www.cpcheckme.com/checkme/vendor.16be15e20a43eba17559.js Avira URL Cloud: Label: malware
Source: http://www.cpcheckme.com/checkme/assets/libs/fontawesome/fonts/fontawesome-webfont.woff2?v=4.7.0 Avira URL Cloud: Label: malware
Source: http://www.cpcheckme.com/checkme/rest/endpoint/starte Avira URL Cloud: Label: malware
Source: http://www.cpcheckme.com/checkme/rest/test/getAllTests?ts=1716391619429&category= Avira URL Cloud: Label: malware
Source: http://www.cpcheckme.com/checkme/rest/test/getScanStatus?ts=1716391670793&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 Avira URL Cloud: Label: malware
HTML page contains hidden URLs or javascript code
Source: http://www.cpcheckme.com/checkme/ HTTP Parser: Base64 decoded: http://www.cpcheckme.com:80
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb&co=aHR0cDovL3d3dy5jcGNoZWNrbWUuY29tOjgw&hl=en&type=image&v=8k85QBI-qzxmenDv318AZH30&theme=light&size=invisible&badge=bottomright&cb=11wz3iwh9xgn HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=8k85QBI-qzxmenDv318AZH30&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=8k85QBI-qzxmenDv318AZH30&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=8k85QBI-qzxmenDv318AZH30&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb&co=aHR0cDovL3d3dy5jcGNoZWNrbWUuY29tOjgw&hl=en&type=image&v=8k85QBI-qzxmenDv318AZH30&theme=light&size=invisible&badge=bottomright&cb=l5a3zuoxr6a HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb&co=aHR0cDovL3d3dy5jcGNoZWNrbWUuY29tOjgw&hl=en&type=image&v=8k85QBI-qzxmenDv318AZH30&theme=light&size=invisible&badge=bottomright&cb=l5a3zuoxr6a HTTP Parser: No favicon
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_2041672200\LICENSE.txt Jump to behavior
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49807 version: TLS 1.2
Source: Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.0.dr
Source: Binary string: D:\src\EP_CheckMe_V_GALLIUM_POST_CL_VS13\Src\CheckMeAgent\obj\Release\CheckMeAgent.pdb source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AB67000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr
Source: Binary string: D:\src\EP_CheckMe_V_GALLIUM_POST_CL_VS13\Src\CheckMeAgent\obj\Release\CheckMeAgent.pdbP| source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AB67000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr

Networking
barindex
Yara detected Generic Downloader
Source: Yara match File source: 15.0.cpcheckme_yt22zMIg.exe.22b8aa40000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\Downloads\Unconfirmed 6574.crdownload, type: DROPPED
Source: Yara match File source: dropped/chromecache_176, type: DROPPED
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.16:62127 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:62339 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56727 -> 1.1.1.1:53
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 22 May 2024 15:27:41 GMTContent-Type: application/octet-streamContent-Length: 1216832Connection: keep-aliveContent-Disposition: attachment; filename="cpcheckme_yt22zMIg.exe"Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 87 1d 78 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 5e 12 00 00 08 00 00 00 00 00 00 7a 7c 12 00 00 20 00 00 00 80 12 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 12 00 00 02 00 00 a6 93 12 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 7c 12 00 4f 00 00 00 00 80 12 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 68 12 00 40 29 00 00 00 a0 12 00 0c 00 00 00 f0 7a 12 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 80 5c 12 00 00 20 00 00 00 5e 12 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 05 00 00 00 80 12 00 00 06 00 00 00 60 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 12 00 00 02 00 00 00 66 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 7c 12 00 00 00 00 00 48 00 00 00 02 00 05 00 2c 9a 00 00 4c 0d 01 00 01 00 00 00 04 00 00 06 78 a7 01 00 78 d3 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 04 00 6b 00 00 00 01 00 00 11 28 2e 00 00 06 17 17 28 1a 00 00 06 6f 2f 00 00 06 28 2e 00 00 06 17 72 01 00 00 70 28 01 00 00 2b 6f 33 00 00 06 02 28 0d 02 00 06 0a 06 2c 08 06 6f 4f 01 00 06 2c 0c 28 e1 00 00 06 6f e3 00 00 06 de 26 28 e1 00 00 06 06 6f e2 00 00 06 de 0f 0b 28 2e 00 00 06 1a 07 6f 32 00 00 06 de 00 28 2e 00 00 06 6f 31 00 00 06 2a 00 01 10 00 00 00 00 00 00 51 51 00 0f 11 00 00 01 13 30 05 00 84 00 00 00 02 00 00 11 28 2e 00 00 06 17 17 28 1a 00 00 06 6f 2f 00 00 06 28 2e 00 00 06 17 72 92 00 00 70 28 01 00 00 2b 6f 33 00 00 06 7e 1e 00 00 0a 0a 7e 1e 00 00 0a 0b 7e 1e 00 00 0a 0c 72 2f 01 00 70 0c 72 a9 01 00 70 0a 72 19 02 00 70 0b 73 bf 00 00 06 25 08 6f c6 00 00 06 06 07 6f ca 00 00 06 28 2e 00 00 06 17 72 81 02 00 70 06 07 28 1f 00 00 0a 28 01 00 00 2b 6f 33 00 00 06 28 2e 00 00 06 6f 31 00 00 06 2a 1e 02 28 20 00 00 0a 2a 1e 02 28 01 00 00 06 2a ae 7e 01 00 00 04 2d 1e 72 b7 02 00 70 d0 04 00 00 02 28 21 00 00 0a 6f 22 00 00 0a 73 23 00 00 0a 80 01 00 00 04 7
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /checkme/rest/endpoint/start HTTP/1.1Content-Type: application/jsonHost: www.cpcheckme.comCache-Control: no-store,no-cachePragma: no-cacheContent-Length: 20Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.96.89
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: global traffic HTTP traffic detected: GET /ajax/libs/bluebird/3.3.5/bluebird.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.cpcheckme.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api.js?render=explicit HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.cpcheckme.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/checkpoint-theme-v2/images/parsley.png HTTP/1.1Host: www.checkpoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://www.cpcheckme.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.cpcheckme.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/checkpoint-theme-v2/images/parsley.png HTTP/1.1Host: www.checkpoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FmAnyWgMhHnay6U&MD=oYOMN+rE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb&co=aHR0cDovL3d3dy5jcGNoZWNrbWUuY29tOjgw&hl=en&type=image&v=8k85QBI-qzxmenDv318AZH30&theme=light&size=invisible&badge=bottomright&cb=11wz3iwh9xgn HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: http://www.cpcheckme.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=8k85QBI-qzxmenDv318AZH30 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb&co=aHR0cDovL3d3dy5jcGNoZWNrbWUuY29tOjgw&hl=en&type=image&v=8k85QBI-qzxmenDv318AZH30&theme=light&size=invisible&badge=bottomright&cb=11wz3iwh9xgnAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/bg/cF9tiRHt4BzQa_gljZbyGUbjFHSRXJeGZWCTLs0pBwQ.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb&co=aHR0cDovL3d3dy5jcGNoZWNrbWUuY29tOjgw&hl=en&type=image&v=8k85QBI-qzxmenDv318AZH30&theme=light&size=invisible&badge=bottomright&cb=11wz3iwh9xgnAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=8k85QBI-qzxmenDv318AZH30&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: http://www.cpcheckme.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb&co=aHR0cDovL3d3dy5jcGNoZWNrbWUuY29tOjgw&hl=en&type=image&v=8k85QBI-qzxmenDv318AZH30&theme=light&size=invisible&badge=bottomright&cb=l5a3zuoxr6a HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: http://www.cpcheckme.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=8k85QBI-qzxmenDv318AZH30&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: http://www.cpcheckme.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/reload?k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AOG1W2WMBU3Lx0soNhShTRFwELDfLwcuwdnkZ9CgIoYm0zp46CK031UHe6slDJOYHtKJUib-89BCs-dJrXG-9oE
Source: global traffic HTTP traffic detected: GET /js/bg/y5IoXjo-_eM__FZ7BqlwDG0FWQvBnHNJLFAhT4QXhzA.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=8k85QBI-qzxmenDv318AZH30&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMObAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /recaptcha/api2/userverify?k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AOG1W2WMBU3Lx0soNhShTRFwELDfLwcuwdnkZ9CgIoYm0zp46CK031UHe6slDJOYHtKJUib-89BCs-dJrXG-9oE
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FmAnyWgMhHnay6U&MD=oYOMN+rE HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /checkme/ HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=9VZIGm90wfRnifjzbdjTPIdUF6UPW54l7ByzRbnFxTDnL98T7H9Eur6V4lniC5gF19ETotJESA6AHSfP4x4ciKKTv+20fajq6tfw9MvvZN9EQL1oXFLTVActPyOu
Source: global traffic HTTP traffic detected: GET /checkme/assets/libs/fontawesome/css/font-awesome.min.css HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,*/*;q=0.1Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=20Ns1cykc2joaI0uxHJEMYgvGGHUue2tmpaEEXhEwxhv4HNw4ZZKMPAXVTAz9RSIPkfkOMp6Jt2LO8GXwX6ZGNx80WapsoBvhtPVs185fTTCt9rjgfcmGdeqPTBh
Source: global traffic HTTP traffic detected: GET /checkme/vendor.16be15e20a43eba17559.js HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=20Ns1cykc2joaI0uxHJEMYgvGGHUue2tmpaEEXhEwxhv4HNw4ZZKMPAXVTAz9RSIPkfkOMp6Jt2LO8GXwX6ZGNx80WapsoBvhtPVs185fTTCt9rjgfcmGdeqPTBh
Source: global traffic HTTP traffic detected: GET /checkme/bundle.16be15e20a43eba17559.js HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=20Ns1cykc2joaI0uxHJEMYgvGGHUue2tmpaEEXhEwxhv4HNw4ZZKMPAXVTAz9RSIPkfkOMp6Jt2LO8GXwX6ZGNx80WapsoBvhtPVs185fTTCt9rjgfcmGdeqPTBh
Source: global traffic HTTP traffic detected: GET /check/testsAssets/instant_checkup.js?v=0.6652561465103368 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=hgou4MgWyuf1NbxB58p0H24yiV8HjvF4TXMdYeCCY4/W+fPDj1b5HkRAWWgeorZvRW/BM00Apj7x+C8RBFRquQVELDEB/a/egyaCG+1E3tzH/Yfp3YLoph15T1jP
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanTypesDetails?ts=1716391619425 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rNwJ/gw1aCiGSddXo8tle6DTKjzDDrGTr1FsZcdttAgmUPmQlXsIxDRdIMU85JI0wKEYqybpebD1dufFxwO59QWmgjB4zQvAXsHzCTnadZq9W152JyctXaTLr4Or
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getAllTests?ts=1716391619429&category= HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rNwJ/gw1aCiGSddXo8tle6DTKjzDDrGTr1FsZcdttAgmUPmQlXsIxDRdIMU85JI0wKEYqybpebD1dufFxwO59QWmgjB4zQvAXsHzCTnadZq9W152JyctXaTLr4Or
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getExcludedEmails?ts=1716391619429 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rNwJ/gw1aCiGSddXo8tle6DTKjzDDrGTr1FsZcdttAgmUPmQlXsIxDRdIMU85JI0wKEYqybpebD1dufFxwO59QWmgjB4zQvAXsHzCTnadZq9W152JyctXaTLr4Or
Source: global traffic HTTP traffic detected: GET /checkme/fonts/din.woff?v=1.0.0 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveOrigin: http://www.cpcheckme.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rNwJ/gw1aCiGSddXo8tle6DTKjzDDrGTr1FsZcdttAgmUPmQlXsIxDRdIMU85JI0wKEYqybpebD1dufFxwO59QWmgjB4zQvAXsHzCTnadZq9W152JyctXaTLr4Or
Source: global traffic HTTP traffic detected: GET /checkme/assets/libs/fontawesome/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveOrigin: http://www.cpcheckme.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.cpcheckme.com/checkme/assets/libs/fontawesome/css/font-awesome.min.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rNwJ/gw1aCiGSddXo8tle6DTKjzDDrGTr1FsZcdttAgmUPmQlXsIxDRdIMU85JI0wKEYqybpebD1dufFxwO59QWmgjB4zQvAXsHzCTnadZq9W152JyctXaTLr4Or
Source: global traffic HTTP traffic detected: GET /checkme/rest/utils/getCaptchaType HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=fQ1vuCAQ+LX5fP9FFpX4jdqnMkhiJvjU3nvRj5GtmZ1hggHpUKlLmknHsxzKLxUo0skpUvNrqdMIjwyKtJS7T38Vlg2znlGzG4Ypo11dfhg4GJMJ1SR3ctSOwdvL
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getAllTests?ts=1716391619429&category= HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=Gd1uru2VcjlY0Je0e4n8PoEib9ijlg60pKhAZhVIahgFZjZa4+48AVW7q6KoX90AeJDkkWwwBcgaoTr8RoVTKs204AJgEPQ+gL0mR1quQXA7PYaVUT1d0tixllPV
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanTypesDetails?ts=1716391619425 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=fQ1vuCAQ+LX5fP9FFpX4jdqnMkhiJvjU3nvRj5GtmZ1hggHpUKlLmknHsxzKLxUo0skpUvNrqdMIjwyKtJS7T38Vlg2znlGzG4Ypo11dfhg4GJMJ1SR3ctSOwdvL
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getExcludedEmails?ts=1716391619429 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=0mYBx9525ryXtIoqeRqKbJeZKPWEHu74769q2/P/0rN0jCrBXwkvsh1iHvz66BNYG2PgBlt8EEIkoOwHqxZuE1UA1bCeqI+XBChklCloRHSo5d4L1vPJDqnTmwM7
Source: global traffic HTTP traffic detected: GET /checkme/rest/utils/getCaptchaType HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=O+UvY6TXnA9rmHnE72bgdMFFYpRam+J/trsVh2XJULbxW4Ij5wItM9iFOrFSWTfNnmS5qPz4cgn3K41atTYm6lzHDVpi6unFvi+2XvwUl9hPhO4/G+FkZjtvBfNS
Source: global traffic HTTP traffic detected: GET /checkme/ HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=oZwKzeTpVngadSgeD4roJp3GVgWR3NzYjEQPnSG6Zu1xS2uZQirezWaTe/9AcIMkybv5PxLV5mic9qBNHt4TY8wyIM9Wc4WkDqhvVYs0ktGiOIUTKWAu9I9YqTxjIf-None-Match: W/"3971-1684859588000"If-Modified-Since: Tue, 23 May 2023 16:33:08 GMT
Source: global traffic HTTP traffic detected: GET /check/testsAssets/instant_checkup.js?v=0.6537682150719368 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=OwocWPpZs5cdNA0YDmhebwepfiq1p6/4VMaaW37qnkp+q4fj95+8PSwINOLtf1mdvOf1D7REgn5mVAZr8l+unKdwXyocn3Ycu2jaq+iEhdf37h4/X5lgG5KVoodp
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanTypesDetails?ts=1716391642957 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=OwocWPpZs5cdNA0YDmhebwepfiq1p6/4VMaaW37qnkp+q4fj95+8PSwINOLtf1mdvOf1D7REgn5mVAZr8l+unKdwXyocn3Ycu2jaq+iEhdf37h4/X5lgG5KVoodp
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getAllTests?ts=1716391642959&category= HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=OwocWPpZs5cdNA0YDmhebwepfiq1p6/4VMaaW37qnkp+q4fj95+8PSwINOLtf1mdvOf1D7REgn5mVAZr8l+unKdwXyocn3Ycu2jaq+iEhdf37h4/X5lgG5KVoodp
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getExcludedEmails?ts=1716391642959 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=OwocWPpZs5cdNA0YDmhebwepfiq1p6/4VMaaW37qnkp+q4fj95+8PSwINOLtf1mdvOf1D7REgn5mVAZr8l+unKdwXyocn3Ycu2jaq+iEhdf37h4/X5lgG5KVoodp
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanTypesDetails?ts=1716391642957 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=cFGMXUN96TLXW7m1KAtQw1o0Wwl0SflKhVow0etQKvxcO8SPmedQnvmG0pYlGn5m7IXRRjFKDNYyMhf+fwOGNYF9NXBlLcPjP7nQ/QIglWbIdJrzhSWiiNfg6CY9
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getExcludedEmails?ts=1716391642959 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=cFGMXUN96TLXW7m1KAtQw1o0Wwl0SflKhVow0etQKvxcO8SPmedQnvmG0pYlGn5m7IXRRjFKDNYyMhf+fwOGNYF9NXBlLcPjP7nQ/QIglWbIdJrzhSWiiNfg6CY9
Source: global traffic HTTP traffic detected: GET /checkme/rest/utils/getCaptchaType HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=cFGMXUN96TLXW7m1KAtQw1o0Wwl0SflKhVow0etQKvxcO8SPmedQnvmG0pYlGn5m7IXRRjFKDNYyMhf+fwOGNYF9NXBlLcPjP7nQ/QIglWbIdJrzhSWiiNfg6CY9
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getAllTests?ts=1716391642959&category= HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=rpr0HGgZy2f2qU8vDNGoQSh6GHnqTarq6xQSJE6AOHCZ09cWRqa779g0z4awQzetbO0uf1i5awVAgmHuuJ3mr/qFt3/s5fm0K/2JNco9Q8wEjLjyLNKYSXTZO+TC
Source: global traffic HTTP traffic detected: GET /checkme/rest/utils/getCaptchaType HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=nqkbPslmcaeQsyH/RXSyBsP3XeMuXx/24eOvbCdyloxX4y39vVy5M+M4WV5Diegpp2TD86Rax9syCzIfd325AlbkkOH7t/nbwbrY7fAL0umo2f2g/sIpzgq803iS
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/startScan HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=sc8NwWVq+v4WUX8RsnnqqQjt23RnYsJWdQGvOmPVSOjA9+AMus/hV7yrMIehIaJULtIV8pppvOplgNrGLLRr2lylZJWL/W5STfBjbguv9QM7Ad0tbXdaYI21Lg7W
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/updateStatuses HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=jMrsGMf4HBXr3E8kN3u1knV6ORUbOzYHexJToT6pYanc7EwjCLlIunqEls3kew9A2JhXDg2hjSNTbamGtJqEPTE09X6hz0rmhDdHstrEOzA1ADhSzxn+cukEu0d7
Source: global traffic HTTP traffic detected: GET /cpcheckme.exe?uid=yt22zMIg HTTP/1.1Host: cpcheckmefiles-lb-1966426125.eu-west-1.elb.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.cpcheckme.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanStatus?ts=1716391665606&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=i558L86v2j8D6ongz1E93KPCv88l5W+UelXAcR9Awmxn9haPtL4kuJjUF3Fg/FBPKJuGqgv2P8PZ6olc1W7shLsOwqbdLt1kSM1wGpZH7cvDodAllhAXS1XpbbIA
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanStatus?ts=1716391665606&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=x3L0QCYDVkvVRNRGzz0BKBrIucCZorXH9VrET52jl7rscxdCRRTtIQ85NnLZq4kRx187ftH75xALeZe6QGiG5t8nL02KsMevp3/rItyCVg1IftkfQnGRjS5mT/i3
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanStatus?ts=1716391670793&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=+ESM9fTkWMrifQjs9xv+BOBt/iuLeuxrfpoWLjmjaDSaaH8mm4pCvt7kWQQwWRNseD7JSDCSggFLIBec9CyRekMU/HT+p1E6Z4D+MfAZnJUgwqi5eWfIQg/wGcY4
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanStatus?ts=1716391670793&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=fS0XR/8MNPGNfiCAn31eT9IrVnRLIezYwWqrKxPzDiDg+LZ4xO3UcbHm0ihfvVzDjWUSQxTFNzH/1eV870hDvARBw3FH/+3NIHFHKy2nHiCUGA4E8z5Gba1X/uFp
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanStatus?ts=1716391676043&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=DrxrrxdYOi18LtQfPSo+DNSPBORE7Z70/qW66K1uH+SlmoEJwoLcrASiouRyKNERRBOSQyLwIxy3uWFuFF54uCu9Q51TqG/+gnnnuOa9wcYZmfOvHQjc2zgP6JXF
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanStatus?ts=1716391676043&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; _gat=1; AWSALB=qHNXzFQPR8bUEUBeimgOzm3UX2HL/a3tLkxZjxG2G2tIzw9oQBZAtu0/QXva+/qPH9OzUbc0rQcrpbDEap0ZEKrCCDYv96kGcf0ImmPp9anA5VY+y8HdyXW+9dfZ
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanStatus?ts=1716391681227&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://www.cpcheckme.com/checkme/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; AWSALB=wiUJTf+Zln1u9bnrCjRfGvCWkbzer2LZ/9+ZIyESVk5xNHvIgLPX1SstXDNLZp03vt0q+HsRdDV9ckccZqApd1qjH4No4QnMruPPcqGt5FAmYZFdxIGO/4Yjp7CY
Source: global traffic HTTP traffic detected: GET /checkme/rest/test/getScanStatus?ts=1716391681227&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 HTTP/1.1Host: www.cpcheckme.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1557742294.1716391620; _gid=GA1.2.862825209.1716391620; AWSALB=I8BfgbBPrnfAuyYj8Y2QYwDDgLbx4qdg0ehvojFdl9FxCozEKMBDB44icljiAClTZfRDxBZ6+ZVHDSlu3QnVJyYo3NnNZwNs/8EPmUNj1SasgjZ3Zb/WCF2FWtNg
Source: chromecache_155.1.dr String found in binary or memory: L.getElementsByTagName("iframe"),oa=R.length,ka=0;ka<oa;ka++)if(!v&&c(R[ka],E.xe)){pI("https://www.youtube.com/iframe_api");v=!0;break}})}}else I(u.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},t,v=!1;Z.__ytl=n;Z.__ytl.D="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0;Z.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: chromecache_155.1.dr, chromecache_190.1.dr String found in binary or memory: Math.round(p);u["gtm.videoCurrentTime"]=Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=Db()},pd:function(){d()}}};var hc=ma(["data-gtm-yt-inspected-"]),CC=["www.youtube.com","www.youtube-nocookie.com"],DC,EC=!1; equals www.youtube.com (Youtube)
Source: chromecache_190.1.dr String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var h=kA(a,c,e);O(121);if("https://www.facebook.com/tr/"===h["gtm.elementUrl"])return O(122),!0;if(d&&f){for(var m=Nb(b,g.length),n=0;n<g.length;++n)g[n](h,m);return m.done}for(var p=0;p<g.length;++p)g[p](h,function(){});return!0},nA=function(){var a=[],b=function(c){return tb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_190.1.dr String found in binary or memory: e||f||g.length||h.length))return;var n={Wg:d,Ug:e,Vg:f,Lh:g,Mh:h,xe:m,Ab:b},p=G.YT,q=function(){KC(n)};if(p)return p.ready&&p.ready(q),b;var r=G.onYouTubeIframeAPIReady;G.onYouTubeIframeAPIReady=function(){r&&r();q()};I(function(){for(var t=H.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(NC(w,"iframe_api")||NC(w,"player_api"))return b}for(var y=H.getElementsByTagName("iframe"),x=y.length,B=0;B<x;B++)if(!EC&&LC(y[B],n.xe))return xc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_155.1.dr String found in binary or memory: function(h){return h.form===g})};return{store:function(g,h){var m=f(g);m?m.button=h:e.push({form:g,button:h})},get:function(g){var h=f(g);return h?h.button:null}}}function d(e,f,g,h,m){var n=Iz("fsl",g?"nv.mwt":"mwt",0),p;p=g?Iz("fsl","nv.ids",[]):Iz("fsl","ids",[]);if(!p.length)return!0;var q=Nz(e,"gtm.formSubmit",p),r=e.action;r&&r.tagName&&(r=e.cloneNode(!1).action);q["gtm.elementUrl"]=r;O(121);if("https://www.facebook.com/tr/"===r)return O(122),!0;m&&(q["gtm.formSubmitElement"]=m);if(h&&n){if(!tI(q, equals www.facebook.com (Facebook)
Source: chromecache_200.1.dr String found in binary or memory: return b}AC.K="internal.enableAutoEventOnTimer";var hc=ma(["data-gtm-yt-inspected-"]),CC=["www.youtube.com","www.youtube-nocookie.com"],DC,EC=!1; equals www.youtube.com (Youtube)
Source: chromecache_190.1.dr String found in binary or memory: var PB=function(a,b,c,d,e){var f=Iz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Iz("fsl","nv.ids",[]):Iz("fsl","ids",[]);if(!g.length)return!0;var h=Nz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);O(121);if("https://www.facebook.com/tr/"===m)return O(122),!0;h["gtm.elementUrl"]=m;h["gtm.formCanceled"]=c;null!=a.getAttribute("name")&&(h["gtm.interactedFormName"]=a.getAttribute("name"));e&&(h["gtm.formSubmitElement"]=e,h["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!uy(h,vy(b, equals www.facebook.com (Facebook)
Source: global traffic DNS traffic detected: DNS query: www.cpcheckme.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: sc1.checkpoint.com
Source: global traffic DNS traffic detected: DNS query: www.checkpoint.com
Source: global traffic DNS traffic detected: DNS query: cpcheckmefiles-lb-1966426125.eu-west-1.elb.amazonaws.com
Source: unknown HTTP traffic detected: POST /recaptcha/api2/reload?k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 9078sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-protobufferAccept: */*Origin: https://www.google.comX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=8k85QBI-qzxmenDv318AZH30&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMObAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: chromecache_194.1.dr String found in binary or memory: http://api.jqueryui.com/category/ui-core/
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: chromecache_176.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD01000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCA5000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CB53000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CBB5000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD57000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD35000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CC75000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CC53000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CB93000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCEB000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCD9000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CBF6000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCCD000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCAB000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD63000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CBDD000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD23000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CC2B000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CBBB000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CB5F000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CB65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://dualstack.elb-ireland1-1194672184.eu-west-1.elb.amazonaws.com
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/1.asp?FileName=a.pdf&AppID=2&MainID=9&SecID=9&MinID=2
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/1.asp?src=file.jpg&fltr
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/1.asp?xss=%3Cscript%3Ealert%28%221%22%29%3C%2Fscript%3E
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/blockchain.txt
Source: chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/check/testsAssets/post.html
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/e.bz2
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/e.txt
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/e.zip
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/exploit_page_buffer.html
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/getcfg.php?SERVICES=DEVICE.LOG&x=y&AUTHORIZED_GROUP=1
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/win7_64bit_big.com
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/win7_64bit_big.pdf
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://files.cpcheckme.com/win7_64bit_big.zip
Source: chromecache_189.1.dr String found in binary or memory: http://fontawesome.io
Source: chromecache_189.1.dr String found in binary or memory: http://fontawesome.io/license
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://hot-emailer.ru/favicon.ico
Source: chromecache_194.1.dr String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_194.1.dr String found in binary or memory: http://jquery.org/license
Source: chromecache_194.1.dr String found in binary or memory: http://jqueryui.com
Source: chromecache_177.1.dr String found in binary or memory: http://localhost:8282/check/testsAssets/instant_checkup.js
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://login.msa.akadns6.net/favicon.ico
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://ocsp.digicert.com0
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://proxy.my-addr.com/favicon.ico
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://s3-eu-west-1.amazonaws.com/cp-chk-files/win7_64bit_big_enc.zip
Source: chromecache_180.1.dr, chromecache_175.1.dr, chromecache_130.1.dr, chromecache_132.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/Report/SVG/Anonymizer_Usage.svg
Source: chromecache_180.1.dr, chromecache_175.1.dr, chromecache_130.1.dr, chromecache_132.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/Report/SVG/Data_Leakage.svg
Source: chromecache_132.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/Report/SVG/Malware_Infection.svg
Source: chromecache_180.1.dr, chromecache_175.1.dr, chromecache_130.1.dr, chromecache_132.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/Report/SVG/Persistence_Threat.svg
Source: chromecache_180.1.dr, chromecache_175.1.dr, chromecache_130.1.dr, chromecache_132.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/Report/SVG/Ransomware_Attack.svg
Source: chromecache_180.1.dr, chromecache_175.1.dr, chromecache_130.1.dr, chromecache_132.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/Report/SVG/Zero_Day.svg
Source: chromecache_132.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/Report/SVG/browser.svg
Source: chromecache_132.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/Report/SVG/command_and_control_communication_64.svg
Source: chromecache_136.1.dr, chromecache_193.1.dr, chromecache_151.1.dr, chromecache_183.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/SVG/Cloud_Icon.svg
Source: chromecache_136.1.dr, chromecache_193.1.dr, chromecache_151.1.dr, chromecache_183.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/SVG/Endpoint_Icon.svg
Source: chromecache_136.1.dr, chromecache_193.1.dr, chromecache_151.1.dr, chromecache_183.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/SVG/Mobile_Icon.svg
Source: chromecache_136.1.dr, chromecache_193.1.dr, chromecache_151.1.dr, chromecache_183.1.dr String found in binary or memory: http://sc1.checkpoint.com/check-me/SVG/Network_Icon.svg
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CA23000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CAE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CA23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CA23000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CAE4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/CheckMeAgent.Engine.WebApi
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CABB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://site-to-meet.com/favicon.ico
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD01000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCA5000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CB53000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CBCD000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CBB5000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD57000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD35000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CC75000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CC53000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CB93000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD47000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCEB000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CABB000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCF1000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCD9000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD13000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CC43000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CBF6000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCCD000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCAB000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD63000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.cpcheckme.com
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AA42000.00000002.00000001.01000000.00000006.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8C861000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CABB000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2361345704.0000022BA508B000.00000004.00000020.00020000.00000000.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr String found in binary or memory: http://www.cpcheckme.com/checkme/rest/endpoint/
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCA5000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CBB5000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CB93000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCEB000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCD9000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD63000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CB25000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CB43000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD1D000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CC2B000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CB5F000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CC4D000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CAE4000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CBD7000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD85000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD0D000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD73000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD51000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CCFB000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CC13000.00000004.00000800.00020000.00000000.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CD41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.cpcheckme.com/checkme/rest/endpoint/p
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8CC81000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.cpcheckme.com/checkme/rest/endpoint/start
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2361345704.0000022BA506F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cpcheckme.com/checkme/rest/endpoint/starte
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2361345704.0000022BA506F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cpcheckme.com/checkme/rest/endpoint/startse
Source: Unconfirmed 6574.crdownload.0.dr, Google.Widevine.CDM.dll.0.dr, chromecache_176.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://www.fkiinqdfc9un.xyz/login/assets/img/fav.ico
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: http://www.jewelsyz.com/favicon.ico
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AA42000.00000002.00000001.01000000.00000006.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8C861000.00000004.00000800.00020000.00000000.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr String found in binary or memory: http://www.threat-cloud.com/config.php
Source: chromecache_176.1.dr String found in binary or memory: http://www.threat-cloud.com/test/files/HighConfidenceBot.html
Source: sets.json.0.dr String found in binary or memory: https://abczdrowie.pl
Source: chromecache_200.1.dr, chromecache_155.1.dr, chromecache_190.1.dr String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: chromecache_200.1.dr, chromecache_155.1.dr, chromecache_190.1.dr String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: sets.json.0.dr String found in binary or memory: https://alice.tw
Source: chromecache_144.1.dr String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: sets.json.0.dr String found in binary or memory: https://autobild.de
Source: sets.json.0.dr String found in binary or memory: https://baomoi.com
Source: sets.json.0.dr String found in binary or memory: https://bild.de
Source: sets.json.0.dr String found in binary or memory: https://blackrock.com
Source: sets.json.0.dr String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.dr String found in binary or memory: https://bluradio.com
Source: sets.json.0.dr String found in binary or memory: https://bolasport.com
Source: sets.json.0.dr String found in binary or memory: https://bonvivir.com
Source: sets.json.0.dr String found in binary or memory: https://bumbox.com
Source: sets.json.0.dr String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.dr String found in binary or memory: https://cachematrix.com
Source: sets.json.0.dr String found in binary or memory: https://cafemedia.com
Source: sets.json.0.dr String found in binary or memory: https://caracoltv.com
Source: sets.json.0.dr String found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.dr String found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.dr String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.dr String found in binary or memory: https://cardsayings.net
Source: chromecache_200.1.dr, chromecache_155.1.dr, chromecache_190.1.dr String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_177.1.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/bluebird/3.3.5/bluebird.min.js
Source: sets.json.0.dr String found in binary or memory: https://chennien.com
Source: sets.json.0.dr String found in binary or memory: https://clarosports.com
Source: sets.json.0.dr String found in binary or memory: https://clmbtech.com
Source: chromecache_162.1.dr, chromecache_140.1.dr String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_162.1.dr, chromecache_140.1.dr String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: sets.json.0.dr String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.dr String found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.dr String found in binary or memory: https://commentcamarche.com
Source: sets.json.0.dr String found in binary or memory: https://commentcamarche.net
Source: sets.json.0.dr String found in binary or memory: https://computerbild.de
Source: chromecache_155.1.dr String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: sets.json.0.dr String found in binary or memory: https://cookreactor.com
Source: LICENSE.txt.0.dr String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: sets.json.0.dr String found in binary or memory: https://cricbuzz.com
Source: sets.json.0.dr String found in binary or memory: https://desimartini.com
Source: chromecache_162.1.dr, chromecache_140.1.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_162.1.dr, chromecache_140.1.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_162.1.dr, chromecache_140.1.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: sets.json.0.dr String found in binary or memory: https://dewarmsteweek.be
Source: LICENSE.txt.0.dr String found in binary or memory: https://easylist.to/)
Source: sets.json.0.dr String found in binary or memory: https://economictimes.com
Source: sets.json.0.dr String found in binary or memory: https://een.be
Source: sets.json.0.dr String found in binary or memory: https://efront.com
Source: sets.json.0.dr String found in binary or memory: https://eleconomista.net
Source: sets.json.0.dr String found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.dr String found in binary or memory: https://elgrafico.com
Source: sets.json.0.dr String found in binary or memory: https://ella.sv
Source: sets.json.0.dr String found in binary or memory: https://elpais.com.uy
Source: sets.json.0.dr String found in binary or memory: https://elpais.uy
Source: sets.json.0.dr String found in binary or memory: https://etfacademy.it
Source: sets.json.0.dr String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.dr String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.dr String found in binary or memory: https://fakt.pl
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: https://files.cpcheckme.com/check/testsAssets/post.html
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: https://files.cpcheckme.com/e.zip
Source: sets.json.0.dr String found in binary or memory: https://finn.no
Source: sets.json.0.dr String found in binary or memory: https://firstlook.biz
Source: sets.json.0.dr String found in binary or memory: https://gallito.com.uy
Source: sets.json.0.dr String found in binary or memory: https://gettalkdesk.com
Source: chromecache_194.1.dr String found in binary or memory: https://github.com/ded/bowser
Source: LICENSE.txt.0.dr String found in binary or memory: https://github.com/easylist)
Source: chromecache_194.1.dr String found in binary or memory: https://github.com/jsstyles/css-vendor
Source: chromecache_155.1.dr String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: sets.json.0.dr String found in binary or memory: https://gliadomain.com
Source: chromecache_155.1.dr String found in binary or memory: https://google.com
Source: chromecache_155.1.dr String found in binary or memory: https://googleads.g.doubleclick.net
Source: sets.json.0.dr String found in binary or memory: https://grid.id
Source: sets.json.0.dr String found in binary or memory: https://gridgames.app
Source: sets.json.0.dr String found in binary or memory: https://growthrx.in
Source: sets.json.0.dr String found in binary or memory: https://grupolpg.sv
Source: sets.json.0.dr String found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.dr String found in binary or memory: https://hapara.com
Source: sets.json.0.dr String found in binary or memory: https://hc1.com
Source: sets.json.0.dr String found in binary or memory: https://hc1.global
Source: sets.json.0.dr String found in binary or memory: https://hc1cas.com
Source: sets.json.0.dr String found in binary or memory: https://hc1cas.global
Source: sets.json.0.dr String found in binary or memory: https://healthshots.com
Source: sets.json.0.dr String found in binary or memory: https://hearty.app
Source: sets.json.0.dr String found in binary or memory: https://hearty.gift
Source: sets.json.0.dr String found in binary or memory: https://hearty.me
Source: sets.json.0.dr String found in binary or memory: https://heartymail.com
Source: sets.json.0.dr String found in binary or memory: https://hindustantimes.com
Source: sets.json.0.dr String found in binary or memory: https://hj.rs
Source: sets.json.0.dr String found in binary or memory: https://hjck.com
Source: sets.json.0.dr String found in binary or memory: https://human-talk.org
Source: sets.json.0.dr String found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.dr String found in binary or memory: https://idbs-dev.com
Source: sets.json.0.dr String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.dr String found in binary or memory: https://idbs-staging.com
Source: sets.json.0.dr String found in binary or memory: https://indiatimes.com
Source: sets.json.0.dr String found in binary or memory: https://iolam.it
Source: sets.json.0.dr String found in binary or memory: https://ishares.com
Source: sets.json.0.dr String found in binary or memory: https://jagran.com
Source: sets.json.0.dr String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.dr String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.dr String found in binary or memory: https://journaldunet.com
Source: sets.json.0.dr String found in binary or memory: https://journaldunet.fr
Source: sets.json.0.dr String found in binary or memory: https://joyreactor.cc
Source: sets.json.0.dr String found in binary or memory: https://joyreactor.com
Source: sets.json.0.dr String found in binary or memory: https://kaksya.in
Source: sets.json.0.dr String found in binary or memory: https://kompas.com
Source: sets.json.0.dr String found in binary or memory: https://kompas.tv
Source: sets.json.0.dr String found in binary or memory: https://kompasiana.com
Source: sets.json.0.dr String found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.dr String found in binary or memory: https://landyrev.com
Source: sets.json.0.dr String found in binary or memory: https://landyrev.ru
Source: sets.json.0.dr String found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.dr String found in binary or memory: https://lateja.cr
Source: sets.json.0.dr String found in binary or memory: https://libero.it
Source: sets.json.0.dr String found in binary or memory: https://linternaute.com
Source: sets.json.0.dr String found in binary or memory: https://linternaute.fr
Source: sets.json.0.dr String found in binary or memory: https://livehindustan.com
Source: sets.json.0.dr String found in binary or memory: https://livemint.com
Source: sets.json.0.dr String found in binary or memory: https://max.auto
Source: sets.json.0.dr String found in binary or memory: https://medonet.pl
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.dr String found in binary or memory: https://mercadolivre.com
Source: sets.json.0.dr String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.cl
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.com
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.dr String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.dr String found in binary or memory: https://mightytext.net
Source: sets.json.0.dr String found in binary or memory: https://mittanbud.no
Source: sets.json.0.dr String found in binary or memory: https://money.pl
Source: sets.json.0.dr String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.dr String found in binary or memory: https://nacion.com
Source: sets.json.0.dr String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.dr String found in binary or memory: https://nien.co
Source: sets.json.0.dr String found in binary or memory: https://nien.com
Source: sets.json.0.dr String found in binary or memory: https://nien.org
Source: sets.json.0.dr String found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.dr String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.dr String found in binary or memory: https://o2.pl
Source: sets.json.0.dr String found in binary or memory: https://ocdn.eu
Source: sets.json.0.dr String found in binary or memory: https://onet.pl
Source: sets.json.0.dr String found in binary or memory: https://ottplay.com
Source: chromecache_190.1.dr String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_200.1.dr, chromecache_155.1.dr, chromecache_190.1.dr String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: sets.json.0.dr String found in binary or memory: https://paula.com.uy
Source: sets.json.0.dr String found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.dr String found in binary or memory: https://phonandroid.com
Source: chromecache_140.1.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: sets.json.0.dr String found in binary or memory: https://player.pl
Source: sets.json.0.dr String found in binary or memory: https://plejada.pl
Source: sets.json.0.dr String found in binary or memory: https://poalim.site
Source: sets.json.0.dr String found in binary or memory: https://poalim.xyz
Source: sets.json.0.dr String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.dr String found in binary or memory: https://prisjakt.no
Source: sets.json.0.dr String found in binary or memory: https://pudelek.pl
Source: sets.json.0.dr String found in binary or memory: https://punjabijagran.com
Source: sets.json.0.dr String found in binary or memory: https://radio1.be
Source: sets.json.0.dr String found in binary or memory: https://radio2.be
Source: sets.json.0.dr String found in binary or memory: https://reactor.cc
Source: chromecache_140.1.dr String found in binary or memory: https://recaptcha.net
Source: sets.json.0.dr String found in binary or memory: https://repid.org
Source: sets.json.0.dr String found in binary or memory: https://reshim.org
Source: sets.json.0.dr String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.dr String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.dr String found in binary or memory: https://rws3nvtvt.com
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AA42000.00000002.00000001.01000000.00000006.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8C861000.00000004.00000800.00020000.00000000.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr String found in binary or memory: https://s3.us-east-2.amazonaws.com/cpcheckmefiles/files/Malware.enc
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AA42000.00000002.00000001.01000000.00000006.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8C861000.00000004.00000800.00020000.00000000.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr String found in binary or memory: https://s3.us-east-2.amazonaws.com/cpcheckmefiles/files/Ransom.enc
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AA42000.00000002.00000001.01000000.00000006.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8C861000.00000004.00000800.00020000.00000000.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr String found in binary or memory: https://s3.us-east-2.amazonaws.com/cpcheckmefiles/files/antex_test_x64.enc
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AA42000.00000002.00000001.01000000.00000006.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8C861000.00000004.00000800.00020000.00000000.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr String found in binary or memory: https://s3.us-east-2.amazonaws.com/cpcheckmefiles/files/antex_test_x86.enc
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AA42000.00000002.00000001.01000000.00000006.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8C861000.00000004.00000800.00020000.00000000.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr String found in binary or memory: https://s3.us-east-2.amazonaws.com/cpcheckmefiles/files/win7_64bit_big.enc
Source: sets.json.0.dr String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.dr String found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.dr String found in binary or memory: https://salemovetravel.com
Source: sets.json.0.dr String found in binary or memory: https://samayam.com
Source: chromecache_177.1.dr String found in binary or memory: https://sc1.checkpoint.com/ThreatPortal/assets/images/Browser_message.png
Source: chromecache_177.1.dr String found in binary or memory: https://sc1.checkpoint.com/uc/images/favicons/favicon.ico
Source: chromecache_155.1.dr String found in binary or memory: https://script.crazyegg.com/pages/scripts/
Source: sets.json.0.dr String found in binary or memory: https://shock.co
Source: sets.json.0.dr String found in binary or memory: https://smoney.vn
Source: chromecache_155.1.dr String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: sets.json.0.dr String found in binary or memory: https://songshare.com
Source: sets.json.0.dr String found in binary or memory: https://songstats.com
Source: sets.json.0.dr String found in binary or memory: https://sporza.be
Source: sets.json.0.dr String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.dr String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.dr String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.dr String found in binary or memory: https://startupislandtaiwan.org
Source: chromecache_155.1.dr String found in binary or memory: https://static.ads-twitter.com/uwt.js
Source: chromecache_200.1.dr, chromecache_190.1.dr String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_144.1.dr String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: sets.json.0.dr String found in binary or memory: https://stripe.com
Source: sets.json.0.dr String found in binary or memory: https://stripe.network
Source: sets.json.0.dr String found in binary or memory: https://stripecdn.com
Source: sets.json.0.dr String found in binary or memory: https://supereva.it
Source: chromecache_140.1.dr String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_162.1.dr, chromecache_140.1.dr String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_162.1.dr, chromecache_140.1.dr String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_162.1.dr, chromecache_140.1.dr String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_144.1.dr String found in binary or memory: https://tagassistant.google.com/
Source: sets.json.0.dr String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.dr String found in binary or memory: https://talkdeskstgid.com
Source: chromecache_200.1.dr, chromecache_155.1.dr, chromecache_190.1.dr String found in binary or memory: https://td.doubleclick.net
Source: sets.json.0.dr String found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.dr String found in binary or memory: https://technology-revealed.com
Source: sets.json.0.dr String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.dr String found in binary or memory: https://timesinternet.in
Source: sets.json.0.dr String found in binary or memory: https://timesofindia.com
Source: sets.json.0.dr String found in binary or memory: https://tribunnews.com
Source: sets.json.0.dr String found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.dr String found in binary or memory: https://tucarro.com
Source: sets.json.0.dr String found in binary or memory: https://tucarro.com.co
Source: sets.json.0.dr String found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.dr String found in binary or memory: https://tvid.in
Source: sets.json.0.dr String found in binary or memory: https://tvn.pl
Source: sets.json.0.dr String found in binary or memory: https://tvn24.pl
Source: sets.json.0.dr String found in binary or memory: https://unotv.com
Source: sets.json.0.dr String found in binary or memory: https://victorymedium.com
Source: sets.json.0.dr String found in binary or memory: https://vrt.be
Source: sets.json.0.dr String found in binary or memory: https://vwo.com
Source: sets.json.0.dr String found in binary or memory: https://welt.de
Source: sets.json.0.dr String found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.dr String found in binary or memory: https://wildix.com
Source: sets.json.0.dr String found in binary or memory: https://wildixin.com
Source: sets.json.0.dr String found in binary or memory: https://wingify.com
Source: sets.json.0.dr String found in binary or memory: https://wordle.at
Source: sets.json.0.dr String found in binary or memory: https://wp.pl
Source: sets.json.0.dr String found in binary or memory: https://wpext.pl
Source: chromecache_162.1.dr, chromecache_140.1.dr String found in binary or memory: https://www.apache.org/licenses/
Source: sets.json.0.dr String found in binary or memory: https://www.asadcdn.com
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AA42000.00000002.00000001.01000000.00000006.sdmp, cpcheckme_yt22zMIg.exe, 0000000F.00000002.2353061829.0000022B8C861000.00000004.00000800.00020000.00000000.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr String found in binary or memory: https://www.checkpoint.com
Source: chromecache_177.1.dr, chromecache_155.1.dr String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_144.1.dr String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_144.1.dr String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_144.1.dr String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_190.1.dr String found in binary or memory: https://www.google.com
Source: chromecache_144.1.dr String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_177.1.dr String found in binary or memory: https://www.google.com/chrome/
Source: chromecache_177.1.dr String found in binary or memory: https://www.google.com/recaptcha/api.js?render=explicit
Source: chromecache_174.1.dr, chromecache_162.1.dr, chromecache_140.1.dr, chromecache_128.1.dr String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_155.1.dr, chromecache_190.1.dr String found in binary or memory: https://www.googleadservices.com
Source: chromecache_190.1.dr String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_155.1.dr String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_144.1.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_177.1.dr String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_177.1.dr String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-5JCRGP
Source: chromecache_162.1.dr, chromecache_140.1.dr String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/8k85QBI-qzxmenDv318AZH30/recaptcha__.
Source: chromecache_174.1.dr, chromecache_163.1.dr, chromecache_128.1.dr String found in binary or memory: https://www.gstatic.com/recaptcha/releases/8k85QBI-qzxmenDv318AZH30/recaptcha__en.js
Source: chromecache_172.1.dr, chromecache_170.1.dr String found in binary or memory: https://www.invincibull.io/wp-content/uploads/cropped-vince-favicon-512x512-32x32.jpg
Source: chromecache_200.1.dr, chromecache_190.1.dr String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_177.1.dr String found in binary or memory: https://www.mozilla.org/en-US/firefox/
Source: chromecache_155.1.dr, chromecache_190.1.dr String found in binary or memory: https://www.youtube.com/iframe_api
Source: sets.json.0.dr String found in binary or memory: https://ya.ru
Source: sets.json.0.dr String found in binary or memory: https://zalo.me
Source: sets.json.0.dr String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.dr String found in binary or memory: https://zingmp3.vn
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 56737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56737
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62343 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62343
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49807 version: TLS 1.2
Creates files inside the system directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1233813918 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1233813918\sets.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1233813918\manifest.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1233813918\LICENSE Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1233813918\_metadata\ Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1233813918\_metadata\verified_contents.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1233813918\manifest.fingerprint Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1048212 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1048212\Google.Widevine.CDM.dll Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1048212\manifest.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1048212\_metadata\ Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1048212\_metadata\verified_contents.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1048212\manifest.fingerprint Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_2041672200 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_2041672200\LICENSE.txt Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_2041672200\Filtering Rules Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_2041672200\manifest.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_2041672200\_metadata\ Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_2041672200\_metadata\verified_contents.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_2041672200\manifest.fingerprint Jump to behavior
Deletes files inside the Windows folder
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File deleted: C:\Windows\SystemTemp\chrome_BITS_1996_953561296 Jump to behavior
PE file contains more sections than normal
Source: Google.Widevine.CDM.dll.0.dr Static PE information: Number of sections : 12 > 10
PE file does not import any functions
Source: c06b9dbc-dc73-4ca5-8be7-44a4c0c2d82b.tmp.0.dr Static PE information: No import functions for PE file found
PE file overlay found
Source: c06b9dbc-dc73-4ca5-8be7-44a4c0c2d82b.tmp.0.dr Static PE information: Data appended to the last section found
Source: Unconfirmed 6574.crdownload.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: chromecache_176.1.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal60.troj.evad.win@25/158@32/13
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Mutant created: NULL
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe File created: c:\temp\CheckMe.log Jump to behavior
Source: C:\Windows\System32\rundll32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.cpcheckme.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1956,i,12651588172182524890,15873818534290352819,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5184 --field-trial-handle=1956,i,12651588172182524890,15873818534290352819,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe "C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1956,i,12651588172182524890,15873818534290352819,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5184 --field-trial-handle=1956,i,12651588172182524890,15873818534290352819,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Section loaded: iertutil.dll Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.0.dr
Source: Binary string: D:\src\EP_CheckMe_V_GALLIUM_POST_CL_VS13\Src\CheckMeAgent\obj\Release\CheckMeAgent.pdb source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AB67000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr
Source: Binary string: D:\src\EP_CheckMe_V_GALLIUM_POST_CL_VS13\Src\CheckMeAgent\obj\Release\CheckMeAgent.pdbP| source: cpcheckme_yt22zMIg.exe, 0000000F.00000000.1706589859.0000022B8AB67000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 6574.crdownload.0.dr, chromecache_176.1.dr
PE file contains an invalid checksum
Source: c06b9dbc-dc73-4ca5-8be7-44a4c0c2d82b.tmp.0.dr Static PE information: real checksum: 0x1293a6 should be: 0x2fa7
PE file contains sections with non-standard names
Source: Google.Widevine.CDM.dll.0.dr Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.0.dr Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.0.dr Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.0.dr Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.0.dr Static PE information: section name: _RDATA
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Code function: 15_2_00007FFEBC7F2A37 pushad ; ret 15_2_00007FFEBC7F2A43
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Code function: 15_2_00007FFEBC7F1664 push ss; iretd 15_2_00007FFEBC7F1667
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Code function: 15_2_00007FFEBC7F7782 pushad ; ret 15_2_00007FFEBC7F77AD
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Code function: 15_2_00007FFEBC7F03AD push E95E4B53h; ret 15_2_00007FFEBC7F03B9
Source: Unconfirmed 6574.crdownload.0.dr Static PE information: section name: .text entropy: 7.745054109162031
Source: chromecache_176.1.dr Static PE information: section name: .text entropy: 7.745054109162031
Drops PE files
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\Downloads\Unconfirmed 6574.crdownload Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe (copy) Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\Downloads\c06b9dbc-dc73-4ca5-8be7-44a4c0c2d82b.tmp Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1048212\Google.Widevine.CDM.dll Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 176 Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_1048212\Google.Widevine.CDM.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 176
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 176 Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1996_2041672200\LICENSE.txt Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Memory allocated: 22B8AE90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Memory allocated: 22BA4860000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599888 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599775 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599665 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599553 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599426 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599298 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599186 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599073 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598963 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598851 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598739 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598613 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598486 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598374 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598262 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598150 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598040 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597929 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597817 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597673 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597561 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597448 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597338 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597226 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597116 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597006 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596879 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596751 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596639 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596531 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596420 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596308 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596196 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596084 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595956 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595829 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595701 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595589 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595477 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595366 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595255 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595127 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595015 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594904 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594792 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594680 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594568 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594440 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594328 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Window / User API: threadDelayed 9843 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -599888s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6500 Thread sleep count: 9843 > 30 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -599775s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -599665s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -599553s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -599426s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -599298s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -599186s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -599073s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -598963s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -598851s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -598739s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -598613s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -598486s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -598374s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -598262s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -598150s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -598040s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -597929s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -597817s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -597673s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -597561s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -597448s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -597338s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -597226s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -597116s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -597006s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -596879s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -596751s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -596639s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -596531s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -596420s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -596308s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -596196s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -596084s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -595956s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -595829s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -595701s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -595589s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -595477s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -595366s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -595255s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -595127s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -595015s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -594904s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -594792s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -594680s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -594568s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -594440s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe TID: 6436 Thread sleep time: -594328s >= -30000s Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599888 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599775 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599665 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599553 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599426 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599298 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599186 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 599073 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598963 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598851 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598739 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598613 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598486 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598374 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598262 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598150 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 598040 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597929 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597817 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597673 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597561 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597448 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597338 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597226 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597116 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 597006 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596879 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596751 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596639 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596531 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596420 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596308 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596196 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 596084 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595956 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595829 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595701 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595589 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595477 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595366 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595255 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595127 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 595015 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594904 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594792 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594680 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594568 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594440 Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Thread delayed: delay time: 594328 Jump to behavior
Source: cpcheckme_yt22zMIg.exe, 0000000F.00000002.2351903030.0000022B8ACD2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: cpcheckme_yt22zMIg.exe PID: 8176, type: MEMORYSTR
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Queries volume information: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Downloads\cpcheckme_yt22zMIg.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1445862 URL: http://www.cpcheckme.com Startdate: 22/05/2024 Architecture: WINDOWS Score: 60 31 www.cpcheckme.com 2->31 33 dualstack.elb-ireland1-1194672184.eu-west-1.elb.amazonaws.com 2->33 49 Antivirus detection for URL or domain 2->49 51 Yara detected Powershell download and execute 2->51 53 Yara detected Generic Downloader 2->53 7 chrome.exe 43 2->7         started        11 cpcheckme_yt22zMIg.exe 14 17 2->11         started        13 rundll32.exe 2->13         started        signatures3 process4 dnsIp5 35 192.168.2.16, 138, 443, 49699 unknown unknown 7->35 37 192.168.2.17 unknown unknown 7->37 41 2 other IPs or domains 7->41 23 C:\Users\user\...\Unconfirmed 6574.crdownload, PE32 7->23 dropped 25 C:\Windows\...behaviorgraphoogle.Widevine.CDM.dll, PE32+ 7->25 dropped 27 C:\Users\...\cpcheckme_yt22zMIg.exe (copy), PE32 7->27 dropped 29 c06b9dbc-dc73-4ca5-8be7-44a4c0c2d82b.tmp, PE32 7->29 dropped 15 chrome.exe 7->15         started        19 chrome.exe 7->19         started        39 52.213.172.255, 49808, 56728, 56729 AMAZON-02US United States 11->39 file6 process7 dnsIp8 43 18.66.147.106, 443, 49735 MIT-GATEWAYSUS United States 15->43 45 d4epvaz4tpdrm.cloudfront.net 18.66.147.95, 443, 49710 MIT-GATEWAYSUS United States 15->45 47 10 other IPs or domains 15->47 21 Chrome Cache Entry: 176, PE32 15->21 dropped file9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.186.68
 unknown United States
15169 GOOGLEUS false
216.58.212.164
 unknown United States
15169 GOOGLEUS false
52.213.172.255
 unknown United States
16509 AMAZON-02US false
34.251.116.243
 unknown United States
16509 AMAZON-02US false
52.49.232.14
 dualstack.elb-ireland1-1194672184.eu-west-1.elb.amazonaws.com United States
16509 AMAZON-02US false
18.66.147.106
 unknown United States
3 MIT-GATEWAYSUS false
18.66.147.95
 d4epvaz4tpdrm.cloudfront.net United States
3 MIT-GATEWAYSUS false
172.217.18.4
 www.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
104.17.25.14
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.17
192.168.2.16
192.168.2.18

Contacted Domains

Name IP Active
d4epvaz4tpdrm.cloudfront.net 18.66.147.95 true
cdnjs.cloudflare.com 104.17.25.14 true
dualstack.elb-ireland1-1194672184.eu-west-1.elb.amazonaws.com 52.49.232.14 true
www.google.com 172.217.18.4 true
cpcheckmefiles-lb-1966426125.eu-west-1.elb.amazonaws.com 52.213.222.12 true
sc1.checkpoint.com unknown unknown
www.cpcheckme.com unknown unknown
www.checkpoint.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.cpcheckme.com/checkme/rest/test/getScanTypesDetails?ts=1716391642957 false
  • Avira URL Cloud: malware
 unknown
http://www.cpcheckme.com/checkme/rest/test/getScanStatus?ts=1716391676043&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 false
  • Avira URL Cloud: malware
 unknown
http://www.cpcheckme.com/checkme/rest/test/getExcludedEmails?ts=1716391642959 false
  • Avira URL Cloud: malware
 unknown
about:blank false
  • Avira URL Cloud: safe
 unknown
http://www.cpcheckme.com/check/testsAssets/instant_checkup.js?v=0.6652561465103368 false
  • Avira URL Cloud: safe
 unknown
http://www.cpcheckme.com/checkme/rest/endpoint/start false
  • Avira URL Cloud: malware
 unknown
http://www.cpcheckme.com/checkme/vendor.16be15e20a43eba17559.js false
  • Avira URL Cloud: malware
 unknown
https://www.google.com/recaptcha/api2/bframe?hl=en&v=8k85QBI-qzxmenDv318AZH30&k=6LewKIgUAAAAANzf9kcgi8Orr1VGgBzWRk3dOMOb false
    		unknown
    http://www.cpcheckme.com/checkme/assets/libs/fontawesome/fonts/fontawesome-webfont.woff2?v=4.7.0 false
    • Avira URL Cloud: malware
    		 unknown
    http://www.cpcheckme.com/checkme/rest/test/getAllTests?ts=1716391619429&category= false
    • Avira URL Cloud: malware
    		 unknown
    http://www.cpcheckme.com/checkme/rest/test/getScanStatus?ts=1716391670793&id=NmI1ODMxY2EtZDM0YS00OGMxLWExYjMtNjk3ZmE2ZjhkOTY4MTcxNjM5MTY1NTkzNw%3D%3D&type=2 false
    • Avira URL Cloud: malware
    		 unknown