Windows Analysis Report
https://link.edgepilot.com/s/715c9804/bA5oaZ1Sgke_K2-8eD1dXA?u=https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67%26d=4%257Cmail%252F90%252F1716316200%252F1s9UFM-000CiC-67%257Cin6e%257C57e1b682%257C26023477%257C10839452%257C664CE828D09A29E749862A491AAAC3E1%26o=%252Fphtt%253A%252Fgts.souacozr.igc

Overview

General Information

Sample URL: https://link.edgepilot.com/s/715c9804/bA5oaZ1Sgke_K2-8eD1dXA?u=https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67%26d=4%257Cmail%252F90%252F1716316200%252F1s9UFM-000CiC-67%257Cin6e%257C57e1b682%25
Analysis ID: 1445863
Infos:

Detection

Score: 5
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Creates files inside the system directory
Deletes files inside the Windows folder
Detected non-DNS traffic on DNS port
Detected suspicious crossdomain redirect
Drops PE files
Drops PE files to the windows directory (C:\Windows)
HTML page contains hidden URLs or javascript code
HTTP GET or POST without a user agent
PE file contains more sections than normal
PE file contains sections with non-standard names
Stores files to the Windows start menu directory

Classification

HTML page contains hidden URLs or javascript code
Source: https://link.edgepilot.com/s/715c9804/bA5oaZ1Sgke_K2-8eD1dXA?u=https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67%26d=4%257Cmail%252F90%252F1716316200%252F1s9UFM-000CiC-67%257Cin6e%257C57e1b682%257C26023477%257C10839452%257C664CE828D09A29E749862A491AAAC3E1%26o=%252Fphtt%253A%252Fgts.souacozr.igc%252F%26s=z8CAkeos8ozOMyOkyTtC0SiSxhU HTTP Parser: Base64 decoded: https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67&d=4%7Cmail%2F90%2F1716316200%2F1s9UFM-000CiC-67%7Cin6e%7C57e1b682%7C26023477%7C10839452%7C664CE828D09A29E749862A491AAAC3E1&o=%2Fphtt%3A%2Fgts.souacozr.igc%2F&s=z8CAkeos8ozOMyOkyTtC0SiSxhU
Source: https://link.edgepilot.com/s/715c9804/bA5oaZ1Sgke_K2-8eD1dXA?u=https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67%26d=4%257Cmail%252F90%252F1716316200%252F1s9UFM-000CiC-67%257Cin6e%257C57e1b682%257C26023477%257C10839452%257C664CE828D09A29E749862A491AAAC3E1%26o=%252Fphtt%253A%252Fgts.souacozr.igc%252F%26s=z8CAkeos8ozOMyOkyTtC0SiSxhU HTTP Parser: No favicon
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_464398295\LICENSE.txt Jump to behavior
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.17:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.15.178.137:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.0.dr
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.17:55572 -> 1.1.1.1:53
Detected suspicious crossdomain redirect
Source: C:\Program Files\Google\Chrome\Application\chrome.exe HTTP traffic: Redirect from: link.edgepilot.com to https://url6.mailanyone.net/scanner?m=1s9ufm-000cic-67&d=4%7cmail%2f90%2f1716316200%2f1s9ufm-000cic-67%7cin6e%7c57e1b682%7c26023477%7c10839452%7c664ce828d09a29e749862a491aaac3e1&o=%2fphtt%3a%2fgts.souacozr.igc%2f&s=z8cakeos8ozomyokyttc0sisxhu
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: unknown TCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknown TCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknown TCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknown TCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: global traffic HTTP traffic detected: GET /s/715c9804/bA5oaZ1Sgke_K2-8eD1dXA?u=https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67%26d=4%257Cmail%252F90%252F1716316200%252F1s9UFM-000CiC-67%257Cin6e%257C57e1b682%257C26023477%257C10839452%257C664CE828D09A29E749862A491AAAC3E1%26o=%252Fphtt%253A%252Fgts.souacozr.igc%252F%26s=z8CAkeos8ozOMyOkyTtC0SiSxhU HTTP/1.1Host: link.edgepilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /css/app.css?v=1 HTTP/1.1Host: link.edgepilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://link.edgepilot.com/s/715c9804/bA5oaZ1Sgke_K2-8eD1dXA?u=https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67%26d=4%257Cmail%252F90%252F1716316200%252F1s9UFM-000CiC-67%257Cin6e%257C57e1b682%257C26023477%257C10839452%257C664CE828D09A29E749862A491AAAC3E1%26o=%252Fphtt%253A%252Fgts.souacozr.igc%252F%26s=z8CAkeos8ozOMyOkyTtC0SiSxhUAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /jquery-3.2.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://link.edgepilot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://link.edgepilot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://link.edgepilot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://link.edgepilot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/3.3.7/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://link.edgepilot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://link.edgepilot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: link.edgepilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://link.edgepilot.com/s/715c9804/bA5oaZ1Sgke_K2-8eD1dXA?u=https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67%26d=4%257Cmail%252F90%252F1716316200%252F1s9UFM-000CiC-67%257Cin6e%257C57e1b682%257C26023477%257C10839452%257C664CE828D09A29E749862A491AAAC3E1%26o=%252Fphtt%253A%252Fgts.souacozr.igc%252F%26s=z8CAkeos8ozOMyOkyTtC0SiSxhUAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: link.edgepilot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2nNmkLee5U6dPDb&MD=2MkbGsMy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /conf/v2/asgw/fpconfig.min.json?monitorId=asgw HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: fp.msedge.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2nNmkLee5U6dPDb&MD=2MkbGsMy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAdVP32bniHtoTSWa4o9sa1LbYQxFy9yOl4tEPo4U3rc0M1f6wM/8KZB7sL7uC64Ifzn2KrugTXPwuL4JUo7Km4P4U97%2BUQpAcscegZU%2BlxmITvLk1ef73KLb0jzsmcUrPr3fcKvHI9IwmIc1xzBNV2UTv0TCjMp9u2p%2BI3MrOWWbb7frWlS6WNQMgJp7SRg9UlbDQBPdzhmtCQkkOK%2B1M%2BGNECzc8KqwS8VS4FCrhFFqdkPLKgB/3CCfreqHjihR3LvL8xT2y2FDFN9GsdD%2BtX3CESd4Cd52sbqlZQLc2mn0HWAm48IhASvkW7TjJRJJoNsgF9%2BEZZwWu9XLwJMLYwMDZgAACGMo1mOLqVQ3qAH/tRU51DcYcyF7I8xYX%2BCm4027k788z8o/RzX6rjQeHaXuvea2lO7YsR7p6JcKinLClzGC4kv02queBS2tG/TnFGpG679fwOi/8qjokZLfQ%2BtQJnbSaoQFE0QRoDoBUabsDKr6JVhl/6GPTPGtS6Us%2BG5il36p/Z884svPfi8f7%2BD6jgyb/6R6ymbhotaqJsMsahBzNyFSz5GZCWS2DOWC3rZ9hMJo/4TCTkoJ5T85JeCJN61rIDjgRZqPS3aKv2C5WXlMT8FH9qxaIaYF2AYSQY%2Bjk6RKIabZjZGZlBP9e2SRqbr3EP10VsTZse/jY18zmn/k8JsN2wwBgHt2Qb04JQsD2SEWU9DFzPcKtCaDOqstmBBNAj5Dw8rpZGRAaGsm%2BdTBl3scZz5CHvAxKBe5XhLzEbboIuSv6gMKv/rP5S1C5J%2B%2BHG1TxHxGzcHuW8qIPzT4JnlizzumetpCJf5Cb9QlOxpAnn4EG5tjRR0eUTQWi4t4y4ieCnAN1ArjdGMwsQf4gwVfXItgToZVtj8y2O6QriDVWuk1ZWop8MbB2ULH0OhXl7aX2AE%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1716391688User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 54CCD7A843194418B80B2D8E85DB8E39X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic DNS traffic detected: DNS query: link.edgepilot.com
Source: global traffic DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic DNS traffic detected: DNS query: code.jquery.com
Source: global traffic DNS traffic detected: DNS query: url6.mailanyone.net
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /filter HTTP/1.1Host: link.edgepilot.comConnection: keep-aliveContent-Length: 556Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://link.edgepilot.comContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://link.edgepilot.com/s/715c9804/bA5oaZ1Sgke_K2-8eD1dXA?u=https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67%26d=4%257Cmail%252F90%252F1716316200%252F1s9UFM-000CiC-67%257Cin6e%257C57e1b682%257C26023477%257C10839452%257C664CE828D09A29E749862A491AAAC3E1%26o=%252Fphtt%253A%252Fgts.souacozr.igc%252F%26s=z8CAkeos8ozOMyOkyTtC0SiSxhUAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: chromecache_214.1.dr, chromecache_209.1.dr String found in binary or memory: http://getbootstrap.com)
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: Google.Widevine.CDM.dll.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: sets.json.0.dr String found in binary or memory: https://abczdrowie.pl
Source: sets.json.0.dr String found in binary or memory: https://alice.tw
Source: sets.json.0.dr String found in binary or memory: https://autobild.de
Source: sets.json.0.dr String found in binary or memory: https://baomoi.com
Source: sets.json.0.dr String found in binary or memory: https://bild.de
Source: sets.json.0.dr String found in binary or memory: https://blackrock.com
Source: sets.json.0.dr String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.dr String found in binary or memory: https://bluradio.com
Source: sets.json.0.dr String found in binary or memory: https://bolasport.com
Source: sets.json.0.dr String found in binary or memory: https://bonvivir.com
Source: sets.json.0.dr String found in binary or memory: https://bumbox.com
Source: sets.json.0.dr String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.dr String found in binary or memory: https://cachematrix.com
Source: sets.json.0.dr String found in binary or memory: https://cafemedia.com
Source: sets.json.0.dr String found in binary or memory: https://caracoltv.com
Source: sets.json.0.dr String found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.dr String found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.dr String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.dr String found in binary or memory: https://cardsayings.net
Source: sets.json.0.dr String found in binary or memory: https://chennien.com
Source: sets.json.0.dr String found in binary or memory: https://clarosports.com
Source: sets.json.0.dr String found in binary or memory: https://clmbtech.com
Source: sets.json.0.dr String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.dr String found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.dr String found in binary or memory: https://commentcamarche.com
Source: sets.json.0.dr String found in binary or memory: https://commentcamarche.net
Source: sets.json.0.dr String found in binary or memory: https://computerbild.de
Source: sets.json.0.dr String found in binary or memory: https://cookreactor.com
Source: LICENSE.txt.0.dr String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: sets.json.0.dr String found in binary or memory: https://cricbuzz.com
Source: sets.json.0.dr String found in binary or memory: https://desimartini.com
Source: sets.json.0.dr String found in binary or memory: https://dewarmsteweek.be
Source: LICENSE.txt.0.dr String found in binary or memory: https://easylist.to/)
Source: sets.json.0.dr String found in binary or memory: https://economictimes.com
Source: sets.json.0.dr String found in binary or memory: https://een.be
Source: sets.json.0.dr String found in binary or memory: https://efront.com
Source: sets.json.0.dr String found in binary or memory: https://eleconomista.net
Source: sets.json.0.dr String found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.dr String found in binary or memory: https://elgrafico.com
Source: sets.json.0.dr String found in binary or memory: https://ella.sv
Source: sets.json.0.dr String found in binary or memory: https://elpais.com.uy
Source: sets.json.0.dr String found in binary or memory: https://elpais.uy
Source: sets.json.0.dr String found in binary or memory: https://etfacademy.it
Source: sets.json.0.dr String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.dr String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.dr String found in binary or memory: https://fakt.pl
Source: sets.json.0.dr String found in binary or memory: https://finn.no
Source: sets.json.0.dr String found in binary or memory: https://firstlook.biz
Source: sets.json.0.dr String found in binary or memory: https://gallito.com.uy
Source: sets.json.0.dr String found in binary or memory: https://gettalkdesk.com
Source: LICENSE.txt.0.dr String found in binary or memory: https://github.com/easylist)
Source: chromecache_214.1.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: sets.json.0.dr String found in binary or memory: https://gliadomain.com
Source: sets.json.0.dr String found in binary or memory: https://grid.id
Source: sets.json.0.dr String found in binary or memory: https://gridgames.app
Source: sets.json.0.dr String found in binary or memory: https://growthrx.in
Source: sets.json.0.dr String found in binary or memory: https://grupolpg.sv
Source: sets.json.0.dr String found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.dr String found in binary or memory: https://hapara.com
Source: sets.json.0.dr String found in binary or memory: https://hc1.com
Source: sets.json.0.dr String found in binary or memory: https://hc1.global
Source: sets.json.0.dr String found in binary or memory: https://hc1cas.com
Source: sets.json.0.dr String found in binary or memory: https://hc1cas.global
Source: sets.json.0.dr String found in binary or memory: https://healthshots.com
Source: sets.json.0.dr String found in binary or memory: https://hearty.app
Source: sets.json.0.dr String found in binary or memory: https://hearty.gift
Source: sets.json.0.dr String found in binary or memory: https://hearty.me
Source: sets.json.0.dr String found in binary or memory: https://heartymail.com
Source: sets.json.0.dr String found in binary or memory: https://hindustantimes.com
Source: sets.json.0.dr String found in binary or memory: https://hj.rs
Source: sets.json.0.dr String found in binary or memory: https://hjck.com
Source: sets.json.0.dr String found in binary or memory: https://human-talk.org
Source: sets.json.0.dr String found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.dr String found in binary or memory: https://idbs-dev.com
Source: sets.json.0.dr String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.dr String found in binary or memory: https://idbs-staging.com
Source: sets.json.0.dr String found in binary or memory: https://indiatimes.com
Source: sets.json.0.dr String found in binary or memory: https://iolam.it
Source: sets.json.0.dr String found in binary or memory: https://ishares.com
Source: sets.json.0.dr String found in binary or memory: https://jagran.com
Source: sets.json.0.dr String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.dr String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.dr String found in binary or memory: https://journaldunet.com
Source: sets.json.0.dr String found in binary or memory: https://journaldunet.fr
Source: sets.json.0.dr String found in binary or memory: https://joyreactor.cc
Source: sets.json.0.dr String found in binary or memory: https://joyreactor.com
Source: sets.json.0.dr String found in binary or memory: https://kaksya.in
Source: sets.json.0.dr String found in binary or memory: https://kompas.com
Source: sets.json.0.dr String found in binary or memory: https://kompas.tv
Source: sets.json.0.dr String found in binary or memory: https://kompasiana.com
Source: sets.json.0.dr String found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.dr String found in binary or memory: https://landyrev.com
Source: sets.json.0.dr String found in binary or memory: https://landyrev.ru
Source: sets.json.0.dr String found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.dr String found in binary or memory: https://lateja.cr
Source: sets.json.0.dr String found in binary or memory: https://libero.it
Source: sets.json.0.dr String found in binary or memory: https://linternaute.com
Source: sets.json.0.dr String found in binary or memory: https://linternaute.fr
Source: sets.json.0.dr String found in binary or memory: https://livehindustan.com
Source: sets.json.0.dr String found in binary or memory: https://livemint.com
Source: sets.json.0.dr String found in binary or memory: https://max.auto
Source: sets.json.0.dr String found in binary or memory: https://medonet.pl
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.dr String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.dr String found in binary or memory: https://mercadolivre.com
Source: sets.json.0.dr String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.cl
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.dr String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.com
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.dr String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.dr String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.dr String found in binary or memory: https://mightytext.net
Source: sets.json.0.dr String found in binary or memory: https://mittanbud.no
Source: sets.json.0.dr String found in binary or memory: https://money.pl
Source: sets.json.0.dr String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.dr String found in binary or memory: https://nacion.com
Source: sets.json.0.dr String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.dr String found in binary or memory: https://nien.co
Source: sets.json.0.dr String found in binary or memory: https://nien.com
Source: sets.json.0.dr String found in binary or memory: https://nien.org
Source: sets.json.0.dr String found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.dr String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.dr String found in binary or memory: https://o2.pl
Source: sets.json.0.dr String found in binary or memory: https://ocdn.eu
Source: sets.json.0.dr String found in binary or memory: https://onet.pl
Source: sets.json.0.dr String found in binary or memory: https://ottplay.com
Source: sets.json.0.dr String found in binary or memory: https://paula.com.uy
Source: sets.json.0.dr String found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.dr String found in binary or memory: https://phonandroid.com
Source: sets.json.0.dr String found in binary or memory: https://player.pl
Source: sets.json.0.dr String found in binary or memory: https://plejada.pl
Source: sets.json.0.dr String found in binary or memory: https://poalim.site
Source: sets.json.0.dr String found in binary or memory: https://poalim.xyz
Source: sets.json.0.dr String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.dr String found in binary or memory: https://prisjakt.no
Source: sets.json.0.dr String found in binary or memory: https://pudelek.pl
Source: sets.json.0.dr String found in binary or memory: https://punjabijagran.com
Source: sets.json.0.dr String found in binary or memory: https://radio1.be
Source: sets.json.0.dr String found in binary or memory: https://radio2.be
Source: sets.json.0.dr String found in binary or memory: https://reactor.cc
Source: sets.json.0.dr String found in binary or memory: https://repid.org
Source: sets.json.0.dr String found in binary or memory: https://reshim.org
Source: sets.json.0.dr String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.dr String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.dr String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.0.dr String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.dr String found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.dr String found in binary or memory: https://salemovetravel.com
Source: sets.json.0.dr String found in binary or memory: https://samayam.com
Source: sets.json.0.dr String found in binary or memory: https://shock.co
Source: sets.json.0.dr String found in binary or memory: https://smoney.vn
Source: sets.json.0.dr String found in binary or memory: https://songshare.com
Source: sets.json.0.dr String found in binary or memory: https://songstats.com
Source: sets.json.0.dr String found in binary or memory: https://sporza.be
Source: sets.json.0.dr String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.dr String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.dr String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.dr String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.0.dr String found in binary or memory: https://stripe.com
Source: sets.json.0.dr String found in binary or memory: https://stripe.network
Source: sets.json.0.dr String found in binary or memory: https://stripecdn.com
Source: sets.json.0.dr String found in binary or memory: https://supereva.it
Source: sets.json.0.dr String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.dr String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.0.dr String found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.dr String found in binary or memory: https://technology-revealed.com
Source: sets.json.0.dr String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.dr String found in binary or memory: https://timesinternet.in
Source: sets.json.0.dr String found in binary or memory: https://timesofindia.com
Source: sets.json.0.dr String found in binary or memory: https://tribunnews.com
Source: sets.json.0.dr String found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.dr String found in binary or memory: https://tucarro.com
Source: sets.json.0.dr String found in binary or memory: https://tucarro.com.co
Source: sets.json.0.dr String found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.dr String found in binary or memory: https://tvid.in
Source: sets.json.0.dr String found in binary or memory: https://tvn.pl
Source: sets.json.0.dr String found in binary or memory: https://tvn24.pl
Source: sets.json.0.dr String found in binary or memory: https://unotv.com
Source: sets.json.0.dr String found in binary or memory: https://victorymedium.com
Source: sets.json.0.dr String found in binary or memory: https://vrt.be
Source: sets.json.0.dr String found in binary or memory: https://vwo.com
Source: sets.json.0.dr String found in binary or memory: https://welt.de
Source: sets.json.0.dr String found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.dr String found in binary or memory: https://wildix.com
Source: sets.json.0.dr String found in binary or memory: https://wildixin.com
Source: sets.json.0.dr String found in binary or memory: https://wingify.com
Source: sets.json.0.dr String found in binary or memory: https://wordle.at
Source: sets.json.0.dr String found in binary or memory: https://wp.pl
Source: sets.json.0.dr String found in binary or memory: https://wpext.pl
Source: sets.json.0.dr String found in binary or memory: https://www.asadcdn.com
Source: sets.json.0.dr String found in binary or memory: https://ya.ru
Source: sets.json.0.dr String found in binary or memory: https://zalo.me
Source: sets.json.0.dr String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.dr String found in binary or memory: https://zingmp3.vn
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 55582 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 55575
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 55582
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 55575 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.17:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.15.178.137:443 -> 192.168.2.17:49752 version: TLS 1.2
Creates files inside the system directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1390428351 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1390428351\sets.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1390428351\manifest.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1390428351\LICENSE Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1390428351\_metadata\ Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1390428351\_metadata\verified_contents.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1390428351\manifest.fingerprint Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1647812785 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1647812785\Google.Widevine.CDM.dll Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1647812785\manifest.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1647812785\_metadata\ Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1647812785\_metadata\verified_contents.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1647812785\manifest.fingerprint Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_464398295 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_464398295\LICENSE.txt Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_464398295\Filtering Rules Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_464398295\manifest.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_464398295\_metadata\ Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_464398295\_metadata\verified_contents.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_464398295\manifest.fingerprint Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1501033043 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1501033043\cr_en-us_500000_index.bin Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1501033043\manifest.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1501033043\_metadata\ Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1501033043\_metadata\verified_contents.json Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1501033043\manifest.fingerprint Jump to behavior
Deletes files inside the Windows folder
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File deleted: C:\Windows\SystemTemp\chrome_BITS_816_1723632063 Jump to behavior
PE file contains more sections than normal
Source: Google.Widevine.CDM.dll.0.dr Static PE information: Number of sections : 12 > 10
Source: classification engine Classification label: clean5.win@24/68@18/8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://link.edgepilot.com/s/715c9804/bA5oaZ1Sgke_K2-8eD1dXA?u=https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67%26d=4%257Cmail%252F90%252F1716316200%252F1s9UFM-000CiC-67%257Cin6e%257C57e1b682%257C26023477%257C10839452%257C664CE828D09A29E749862A491AAAC3E1%26o=%252Fphtt%253A%252Fgts.souacozr.igc%252F%26s=z8CAkeos8ozOMyOkyTtC0SiSxhU
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1992,i,7532896312697136779,13714068032898897019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1992,i,7532896312697136779,13714068032898897019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.0.dr
PE file contains sections with non-standard names
Source: Google.Widevine.CDM.dll.0.dr Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.0.dr Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.0.dr Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.0.dr Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.0.dr Static PE information: section name: _RDATA
Drops PE files
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1647812785\Google.Widevine.CDM.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_1647812785\Google.Widevine.CDM.dll Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping816_464398295\LICENSE.txt Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1445863 URL: https://link.edgepilot.com/... Startdate: 22/05/2024 Architecture: WINDOWS Score: 5 5 chrome.exe 39 2->5         started        dnsIp3 14 192.168.2.17, 138, 443, 49638 unknown unknown 5->14 16 192.168.2.18 unknown unknown 5->16 18 239.255.255.250 unknown Reserved 5->18 12 C:\Windows\...behaviorgraphoogle.Widevine.CDM.dll, PE32+ 5->12 dropped 9 chrome.exe 5->9         started        file4 process5 dnsIp6 20 www.google.com 216.58.206.36, 443, 49709, 49735 GOOGLEUS United States 9->20 22 216.58.206.68, 443, 55575, 55582 GOOGLEUS United States 9->22 24 4 other IPs or domains 9->24
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
199.30.234.133
 link.edgepilot.com United States
13380 ASN-CUSTUS false
104.18.10.207
 maxcdn.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
216.58.206.36
 www.google.com United States
15169 GOOGLEUS false
216.58.206.68
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
151.101.66.137
 code.jquery.com United States
54113 FASTLYUS false

Private

IP
192.168.2.17
192.168.2.18

Contacted Domains

Name IP Active
link.edgepilot.com 199.30.234.133 true
code.jquery.com 151.101.66.137 true
maxcdn.bootstrapcdn.com 104.18.10.207 true
www.google.com 216.58.206.36 true
url6.mailanyone.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://url6.mailanyone.net/scanner false
    		unknown