Windows Analysis Report
https://u14209785.ct.sendgrid.net/ls/click?upn=u001.7INBLi-2BpMtquNhvHXoCTQCVNO1LZqxvUJf2y77FfP-2B5UjJzbi4XVbcDbVVnMU7Aq-2BBp0W-2BEDZsGCgqikRw5-2B-2F3ChO61-2BK9itderak-2FRfVWA-3DNUit_wVkPrfPw-2BA1AEa0H994O-2FJzhaxRxtbOwGkOMLzRkK9QBnS-2FeJqZygFoDX2zQ1LLKthUGCWL4dHbYNuWBQW36myHgyEN3th3QQ8vEtD1hT0Fpb-2

Overview

General Information

Sample URL:	https://u14209785.ct.sendgrid.net/ls/click?upn=u001.7INBLi-2BpMtquNhvHXoCTQCVNO1LZqxvUJf2y77FfP-2B5UjJzbi4XVbcDbVVnMU7Aq-2BBp0W-2BEDZsGCgqikRw5-2B-2F3ChO61-2BK9itderak-2FRfVWA-3DNUit_wVkPrfPw-2BA1AEa0
Analysis ID:	1501217
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Classification

Signatures

Source: unknown	HTTPS traffic detected: 52.167.249.196:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.7:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.185.211.133:443 -> 192.168.2.7:49774 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 36MB

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.7:61353 -> 1.1.1.1:53

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: u14209785.ct.sendgrid.net to https://telehealth.advancedmd.com?lk=155941#/validate/20duffc0

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200

Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.7INBLi-2BpMtquNhvHXoCTQCVNO1LZqxvUJf2y77FfP-2B5UjJzbi4XVbcDbVVnMU7Aq-2BBp0W-2BEDZsGCgqikRw5-2B-2F3ChO61-2BK9itderak-2FRfVWA-3DNUit_wVkPrfPw-2BA1AEa0H994O-2FJzhaxRxtbOwGkOMLzRkK9QBnS-2FeJqZygFoDX2zQ1LLKthUGCWL4dHbYNuWBQW36myHgyEN3th3QQ8vEtD1hT0Fpb-2F3yHU3oe2cLDgAMxIg962j4YucHm-2FcK1zufaGiAikMp-2FGSm-2B-2FO2SKuPn-2BA4GHK8ZUKn7toM9wCALxARZlVFi7UG2UJUH0CEuZvK5lhzhoBX0ViE9PGpxUKlYmBMxmWYVd0214TK3OvKOQHbgChzGP6uwE5X1RPADjfcTKflywyRSm9hX-2BoCXFdYEaR8hVwVDZ8heE5hloYtyidN4G-2B2 HTTP/1.1Host: u14209785.ct.sendgrid.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?lk=155941 HTTP/1.1Host: telehealth.advancedmd.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?lk=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /runtime.d8944d731f65cf6d.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://th-wfe-102.advancedmd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /polyfills.5119fbe14c60bd43.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://th-wfe-102.advancedmd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SecureSubmit.v1/token/2.1/securesubmit.min.js HTTP/1.1Host: api2.heartlandportico.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main.e703f51cfe48abe2.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://th-wfe-102.advancedmd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16/stable/16.0.2/amds-icons/amds-icons.css HTTP/1.1Host: amds-material-prd.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16/stable/16.0.1/amds-patient-theme-default/amds-patient-theme-default.css HTTP/1.1Host: amds-material-prd.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SecureSubmit.v1/token/2.1/securesubmit.min.js HTTP/1.1Host: api2.heartlandportico.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /styles.d2367e1ebc0e9c82.css HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /polyfills.5119fbe14c60bd43.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /runtime.d8944d731f65cf6d.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main.e703f51cfe48abe2.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /326.98b9a2093566ccd6.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://th-wfe-102.advancedmd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /326.98b9a2093566ccd6.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/accesscodes/20dUfFC0 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16/stable/16.0.2/amds-icons/svgs/telehealth.svg HTTP/1.1Host: amds-material-prd.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://amds-material-prd.advancedmd.com/16/stable/16.0.2/amds-icons/amds-icons.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/featureaccess?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/systemdefaults?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/accesscodes/20dUfFC0 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16/stable/16.0.2/amds-icons/svgs/telehealth.svg HTTP/1.1Host: amds-material-prd.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/featureaccess?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/systemdefaults?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/settings/155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/settings?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/brandingimage/155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/settings/155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/settings/155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/settings?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16/stable/16.0.2/amds-icons/font/amds-icons.woff2 HTTP/1.1Host: amds-material-prd.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://th-wfe-102.advancedmd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://amds-material-prd.advancedmd.com/16/stable/16.0.2/amds-icons/amds-icons.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/settings/155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: u14209785.ct.sendgrid.net
Source: global traffic	DNS traffic detected: DNS query: telehealth.advancedmd.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: th-wfe-102.advancedmd.com
Source: global traffic	DNS traffic detected: DNS query: api2.heartlandportico.com
Source: global traffic	DNS traffic detected: DNS query: amds-material-prd.advancedmd.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: sets.json.4.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.4.dr	String found in binary or memory: https://24.hu
Source: sets.json.4.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.4.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.4.dr	String found in binary or memory: https://alice.tw
Source: sets.json.4.dr	String found in binary or memory: https://ambitionbox.com
Source: chromecache_83.6.dr, chromecache_78.6.dr	String found in binary or memory: https://amds-material-prd.advancedmd.com/16/stable/16.0.1/amds-patient-theme-default/amds-patient-th
Source: chromecache_83.6.dr, chromecache_78.6.dr	String found in binary or memory: https://amds-material-prd.advancedmd.com/16/stable/16.0.2/amds-icons/amds-icons.css
Source: chromecache_78.6.dr	String found in binary or memory: https://api2.heartlandportico.com/SecureSubmit.v1/token/2.1/securesubmit.min.js
Source: sets.json.4.dr	String found in binary or memory: https://autobild.de
Source: sets.json.4.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.4.dr	String found in binary or memory: https://bild.de
Source: sets.json.4.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.4.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.4.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.4.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.4.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.4.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.4.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.4.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.4.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.4.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.4.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.4.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.4.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.4.dr	String found in binary or memory: https://chennien.com
Source: sets.json.4.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.4.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.4.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.4.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.4.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.4.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.4.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.4.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.4.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.4.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.4.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.4.dr	String found in binary or memory: https://css-load.com
Source: sets.json.4.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.4.dr	String found in binary or memory: https://deere.com
Source: sets.json.4.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.4.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.4.dr	String found in binary or memory: https://drimer.io
Source: sets.json.4.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.4.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.4.dr	String found in binary or memory: https://een.be
Source: sets.json.4.dr	String found in binary or memory: https://efront.com
Source: sets.json.4.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.4.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.4.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.4.dr	String found in binary or memory: https://ella.sv
Source: sets.json.4.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.4.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.4.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.4.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.4.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.4.dr	String found in binary or memory: https://finn.no
Source: sets.json.4.dr	String found in binary or memory: https://firstlook.biz
Source: chromecache_76.6.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_76.6.dr	String found in binary or memory: https://fonts.googleapis.com/icon?family=Material
Source: chromecache_72.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialicons/v142/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqW106F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWt06F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtE6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtU6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtk6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWu06F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuk6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWvU6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWxU6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: sets.json.4.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://geforcenow.com
Source: chromecache_83.6.dr	String found in binary or memory: https://getbootstrap.com/)
Source: sets.json.4.dr	String found in binary or memory: https://gettalkdesk.com
Source: chromecache_83.6.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: sets.json.4.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.4.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.4.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://grid.id
Source: sets.json.4.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.4.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.4.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.4.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.4.dr	String found in binary or memory: https://hapara.com
Source: sets.json.4.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1.global
Source: sets.json.4.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.4.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.4.dr	String found in binary or memory: https://hearty.app
Source: sets.json.4.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.4.dr	String found in binary or memory: https://hearty.me
Source: sets.json.4.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.4.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.4.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.4.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.4.dr	String found in binary or memory: https://hj.rs
Source: sets.json.4.dr	String found in binary or memory: https://hjck.com
Source: sets.json.4.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.4.dr	String found in binary or memory: https://html-load.com
Source: sets.json.4.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.4.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.4.dr	String found in binary or memory: https://img-load.com
Source: sets.json.4.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.4.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.4.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.4.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.4.dr	String found in binary or memory: https://interia.pl
Source: sets.json.4.dr	String found in binary or memory: https://intoday.in
Source: sets.json.4.dr	String found in binary or memory: https://iolam.it
Source: sets.json.4.dr	String found in binary or memory: https://ishares.com
Source: sets.json.4.dr	String found in binary or memory: https://jagran.com
Source: sets.json.4.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.4.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.4.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.4.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.4.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.4.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.4.dr	String found in binary or memory: https://kompas.com
Source: sets.json.4.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.4.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.4.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.4.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.4.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.4.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.4.dr	String found in binary or memory: https://libero.it
Source: sets.json.4.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.4.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.4.dr	String found in binary or memory: https://livechat.com
Source: sets.json.4.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.4.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.4.dr	String found in binary or memory: https://livemint.com
Source: sets.json.4.dr	String found in binary or memory: https://max.auto
Source: sets.json.4.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.4.dr	String found in binary or memory: https://meo.pt
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.4.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.4.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.4.dr	String found in binary or memory: https://money.pl
Source: sets.json.4.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.4.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.4.dr	String found in binary or memory: https://nacion.com
Source: sets.json.4.dr	String found in binary or memory: https://naukri.com
Source: sets.json.4.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.4.dr	String found in binary or memory: https://nien.co
Source: sets.json.4.dr	String found in binary or memory: https://nien.com
Source: sets.json.4.dr	String found in binary or memory: https://nien.org
Source: sets.json.4.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.4.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.4.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.4.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.4.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.4.dr	String found in binary or memory: https://o2.pl
Source: sets.json.4.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.4.dr	String found in binary or memory: https://onet.pl
Source: sets.json.4.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.4.dr	String found in binary or memory: https://p106.net
Source: sets.json.4.dr	String found in binary or memory: https://p24.hu
Source: sets.json.4.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.4.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.4.dr	String found in binary or memory: https://player.pl
Source: sets.json.4.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.4.dr	String found in binary or memory: https://poalim.site
Source: sets.json.4.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.4.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.4.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.4.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.4.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.4.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.4.dr	String found in binary or memory: https://radio1.be
Source: sets.json.4.dr	String found in binary or memory: https://radio2.be
Source: sets.json.4.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.4.dr	String found in binary or memory: https://repid.org
Source: sets.json.4.dr	String found in binary or memory: https://reshim.org
Source: sets.json.4.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.4.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.4.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.4.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.4.dr	String found in binary or memory: https://samayam.com
Source: sets.json.4.dr	String found in binary or memory: https://sapo.io
Source: sets.json.4.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.4.dr	String found in binary or memory: https://shock.co
Source: sets.json.4.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.4.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.4.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.4.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.4.dr	String found in binary or memory: https://songshare.com
Source: sets.json.4.dr	String found in binary or memory: https://songstats.com
Source: sets.json.4.dr	String found in binary or memory: https://sporza.be
Source: sets.json.4.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.4.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.4.dr	String found in binary or memory: https://stripe.com
Source: sets.json.4.dr	String found in binary or memory: https://stripe.network
Source: sets.json.4.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.4.dr	String found in binary or memory: https://supereva.it
Source: sets.json.4.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.4.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.4.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.4.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.4.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.4.dr	String found in binary or memory: https://text.com
Source: sets.json.4.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.4.dr	String found in binary or memory: https://the42.ie
Source: sets.json.4.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.4.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.4.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.4.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.4.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.4.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.4.dr	String found in binary or memory: https://top.pl
Source: sets.json.4.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.4.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://tvid.in
Source: sets.json.4.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.4.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.4.dr	String found in binary or memory: https://unotv.com
Source: sets.json.4.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.4.dr	String found in binary or memory: https://vrt.be
Source: sets.json.4.dr	String found in binary or memory: https://vwo.com
Source: sets.json.4.dr	String found in binary or memory: https://welt.de
Source: sets.json.4.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.4.dr	String found in binary or memory: https://wildix.com
Source: sets.json.4.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.4.dr	String found in binary or memory: https://wingify.com
Source: sets.json.4.dr	String found in binary or memory: https://wordle.at
Source: sets.json.4.dr	String found in binary or memory: https://wp.pl
Source: sets.json.4.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.4.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.4.dr	String found in binary or memory: https://ya.ru
Source: sets.json.4.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://zalo.me
Source: sets.json.4.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.4.dr	String found in binary or memory: https://zingmp3.vn

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 52.167.249.196:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.7:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.185.211.133:443 -> 192.168.2.7:49774 version: TLS 1.2

Creates files inside the system directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\manifest.fingerprint	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_6992_1822328550

Jump to behavior

Source: classification engine

Classification label: clean2.win@18/46@18/14

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1924,i,6885173539796808452,12185716589163999248,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u14209785.ct.sendgrid.net/ls/click?upn=u001.7INBLi-2BpMtquNhvHXoCTQCVNO1LZqxvUJf2y77FfP-2B5UjJzbi4XVbcDbVVnMU7Aq-2BBp0W-2BEDZsGCgqikRw5-2B-2F3ChO61-2BK9itderak-2FRfVWA-3DNUit_wVkPrfPw-2BA1AEa0H994O-2FJzhaxRxtbOwGkOMLzRkK9QBnS-2FeJqZygFoDX2zQ1LLKthUGCWL4dHbYNuWBQW36myHgyEN3th3QQ8vEtD1hT0Fpb-2F3yHU3oe2cLDgAMxIg962j4YucHm-2FcK1zufaGiAikMp-2FGSm-2B-2FO2SKuPn-2BA4GHK8ZUKn7toM9wCALxARZlVFi7UG2UJUH0CEuZvK5lhzhoBX0ViE9PGpxUKlYmBMxmWYVd0214TK3OvKOQHbgChzGP6uwE5X1RPADjfcTKflywyRSm9hX-2BoCXFdYEaR8hVwVDZ8heE5hloYtyidN4G-2B2"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1924,i,6885173539796808452,12185716589163999248,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Confirm

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.245.199.82	d2854g9pmj9ff.cloudfront.net	United States	16509	AMAZON-02US	false
167.89.115.35	u14209785.ct.sendgrid.net	United States	11377	SENDGRIDUS	false
35.211.11.79	api2.heartlandportico.com	United States	19527	GOOGLE-2US	false
65.9.86.82	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
65.9.86.2	d1iepj4h4jdfzx.cloudfront.net	United States	16509	AMAZON-02US	false
13.227.219.27	d11ag707s7acdq.cloudfront.net	United States	16509	AMAZON-02US	false
18.244.18.105	unknown	United States	16509	AMAZON-02US	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.7
192.168.2.16
192.168.2.13
192.168.2.23

Contacted Domains

Name	IP	Active
api2.heartlandportico.com	35.211.11.79	true
d2854g9pmj9ff.cloudfront.net	18.245.199.82	true
www.google.com	142.250.184.228	true
u14209785.ct.sendgrid.net	167.89.115.35	true
d11ag707s7acdq.cloudfront.net	13.227.219.27	true
d1iepj4h4jdfzx.cloudfront.net	65.9.86.2	true
telehealth.advancedmd.com	unknown	unknown
amds-material-prd.advancedmd.com	unknown	unknown
th-wfe-102.advancedmd.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api2.heartlandportico.com/SecureSubmit.v1/token/2.1/securesubmit.min.js	false	Avira URL Cloud: safe	unknown
https://u14209785.ct.sendgrid.net/ls/click?upn=u001.7INBLi-2BpMtquNhvHXoCTQCVNO1LZqxvUJf2y77FfP-2B5UjJzbi4XVbcDbVVnMU7Aq-2BBp0W-2BEDZsGCgqikRw5-2B-2F3ChO61-2BK9itderak-2FRfVWA-3DNUit_wVkPrfPw-2BA1AEa0H994O-2FJzhaxRxtbOwGkOMLzRkK9QBnS-2FeJqZygFoDX2zQ1LLKthUGCWL4dHbYNuWBQW36myHgyEN3th3QQ8vEtD1hT0Fpb-2F3yHU3oe2cLDgAMxIg962j4YucHm-2FcK1zufaGiAikMp-2FGSm-2B-2FO2SKuPn-2BA4GHK8ZUKn7toM9wCALxARZlVFi7UG2UJUH0CEuZvK5lhzhoBX0ViE9PGpxUKlYmBMxmWYVd0214TK3OvKOQHbgChzGP6uwE5X1RPADjfcTKflywyRSm9hX-2BoCXFdYEaR8hVwVDZ8heE5hloYtyidN4G-2B2	false		unknown
https://th-wfe-102.advancedmd.com/api/configuration/settings?officeKey=155941	false	Avira URL Cloud: safe	unknown
https://th-wfe-102.advancedmd.com/api/configuration/featureaccess?officeKey=155941	false	Avira URL Cloud: safe	unknown
https://amds-material-prd.advancedmd.com/16/stable/16.0.2/amds-icons/svgs/telehealth.svg	false	Avira URL Cloud: safe	unknown
https://th-wfe-102.advancedmd.com/api/configuration/systemdefaults?officeKey=155941	false	Avira URL Cloud: safe	unknown
https://amds-material-prd.advancedmd.com/16/stable/16.0.1/amds-patient-theme-default/amds-patient-theme-default.css	false	Avira URL Cloud: safe	unknown
https://th-wfe-102.advancedmd.com/styles.d2367e1ebc0e9c82.css	false	Avira URL Cloud: safe	unknown
https://th-wfe-102.advancedmd.com/326.98b9a2093566ccd6.js	false	Avira URL Cloud: safe	unknown
https://th-wfe-102.advancedmd.com/api/telehealth/settings/155941	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\LICENSE	ASCII text	EE002CB9E51BB8DFA89640A406A1090A	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\_metadata\verified_contents.json	JSON data	68E6B5733E04AB7BF19699A84D8ABBC2	1C11F06CA1AD3ED8116D356AB9164FD1D52B5CF0	F095F969D6711F53F97747371C83D5D634EAEF21C54CB1A6A1CC5B816D633709
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\manifest.fingerprint	ASCII text, with no line terminators	CFB54589424206D0AE6437B5673F498D	D1EF6314F0F68EFDD0BA8F6CA9E59BFF863B1609	285AC183C35350B4B77332172413902F83726CA8F53D63859B5DA082FD425A1C
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\manifest.json	JSON data	C3419069A1C30140B77045ABA38F12CF	11920F0C1E55CADC7D2893D1EEBB268B3459762A	DB9A702209807BA039871E542E8356219F342A8D9C9CA34BCD9A86727F4A3A0F
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\sets.json	JSON data	EEA4913A6625BEB838B3E4E79999B627	1B4966850F1B117041407413B70BFA925FD83703	20EF4DE871ECE3C5F14867C4AE8465999C7A2CC1633525E752320E61F78A373C
Chrome Cache Entry: 68	ASCII text, with very long lines (3177), with no line terminators	5416DF9D71EBDA7E99C4D78A0E31E90B	9804FD50A0B53A3921FEAE0CD01D602DCFA51573	3255A596ACF4739B08D17F0FAAF406F429597ED0B3B3D8328DA43FD21B718022
Chrome Cache Entry: 69	Web Open Font Format (Version 2), TrueType, length 48236, version 1.0	015C126A3520C9A8F6A27979D0266E96	2ACF956561D44434A6D84204670CF849D3215D5F	3C4D6A1421C7DDB7E404521FE8C4CD5BE5AF446D7689CD880BE26612EAAD3CFA
Chrome Cache Entry: 70	Unicode text, UTF-8 text	AF18B306DACF639E6C26B597E0FFF5D8	061FD114FD35A7019610038FFF7C97B11ABC56AE	3E045375CA9E54636E811C583718BC6FE8AB5F15BEE65C9F70F1B203643873AE
Chrome Cache Entry: 71	Web Open Font Format (Version 2), TrueType, length 50296, version 1.0	B02AB8B0D683A0457568340DBA20309E	E18C3B8737970D37BE1BB85B0F588303A89E63BB	0D8601A776B7DC777CD23BC42392D05A43DF0D6402328E8913B58811083B513D
Chrome Cache Entry: 72	ASCII text	71D6A57D21337114032CA39B294F3591	ADA1D867672276F16EF4D3B8A46A519FBA8E3D4E	36B2057EB5EEF261A2CBB8C149DCF3A11EDAA15CCD8E3D462EB34999F5FF8F2A
Chrome Cache Entry: 73	SVG Scalable Vector Graphics image	64F03B14C822545B9B6A2918A3EE0688	A89D86E84FB28AB901A8E731810AAB2B9C4884B9	FB39B49C4F82D0DA6930D7E0EFBCCFBA44263ECD05ADB7E34BE7A2D157C53BFC
Chrome Cache Entry: 74	Unicode text, UTF-8 text, with very long lines (32000)	73C6850396835226A45224698B43059A	DB4255AFD4B5E1A03DAE721E1D0C367B011DE405	23A2910290EFB69A0B108FDE2A3BAEC75EA713CBCB354C4F129A51042D3C3178
Chrome Cache Entry: 75	Web Open Font Format (Version 2), TrueType, length 35928, version 1.0	F817C22F8B2A29A77C00BC40EFA51D89	3B59883E2D51704FE465F6D5B620E165DC5AA83B	549BAA771DF2325F5C0104E9CE0979D19E5383583C6D5D915C628807443EE872
Chrome Cache Entry: 76	ASCII text, with very long lines (780)	2A0197B648567ECD60D8927CB585CB3D	20EB3DE4CCD50AC70DBDD1AC3B800950A2D1AB7A	97CC3B880B852C5ABBE7FBACE52EDF06D93105A1895C7AAC46D0C6CCABF3400F
Chrome Cache Entry: 77	Unicode text, UTF-8 text, with very long lines (32000)	73C6850396835226A45224698B43059A	DB4255AFD4B5E1A03DAE721E1D0C367B011DE405	23A2910290EFB69A0B108FDE2A3BAEC75EA713CBCB354C4F129A51042D3C3178
Chrome Cache Entry: 78	HTML document, ASCII text, with very long lines (1845)	682360757E90A1C724AC7391E96510BB	BAEF382E5F4F3CBB940498CB1C0EC35031C7A24F	9E3CA1140FDE0C26F70AE61E64B5C869603705C50B5E70AFF81A41BAC02744D7
Chrome Cache Entry: 79	ASCII text, with very long lines (65536), with no line terminators	9F313E7743AC7952FF988CD95CDFEF41	2657E0C2BE311B61645EB69F0E054B171E1802D6	12AC040C62A68013311605264FC5CB594BB56646E2CE40C71295AADD8E13C467
Chrome Cache Entry: 80	ASCII text, with very long lines (11440), with no line terminators	972F2E9F946280CEB5D87C2748C7C87D	3C8A99261A15F9EF7D4ABF091B1AB706D8CE3D63	D27A2EDAEB1AF1D04124687A054BB25043A069C9BBFD63CF9A147F51C83CB714
Chrome Cache Entry: 81	ASCII text, with very long lines (3177), with no line terminators	5416DF9D71EBDA7E99C4D78A0E31E90B	9804FD50A0B53A3921FEAE0CD01D602DCFA51573	3255A596ACF4739B08D17F0FAAF406F429597ED0B3B3D8328DA43FD21B718022
Chrome Cache Entry: 82	ASCII text, with very long lines (65536), with no line terminators	9F313E7743AC7952FF988CD95CDFEF41	2657E0C2BE311B61645EB69F0E054B171E1802D6	12AC040C62A68013311605264FC5CB594BB56646E2CE40C71295AADD8E13C467
Chrome Cache Entry: 83	ASCII text, with very long lines (63831)	84D5F10B015E4F1BF6AF926CAA324235	8D88F659421175F79B458CC8C2177D737B5AB491	87AC9B0B6E6C1A44C9DD2BC34FE1949BF7D85ADC9801433C2B566B0EDB6D6B64
Chrome Cache Entry: 84	ASCII text, with very long lines (34812), with no line terminators	C5474913C9EEBD695E4C931B57EE5711	E47DF7D2311E94B4209243739D3B68548BD48262	76D06FB89AB5A43E9782388B843198C481A98CCF37C4D86C7ADA747C9AC147BC
Chrome Cache Entry: 85	ASCII text, with very long lines (11440), with no line terminators	972F2E9F946280CEB5D87C2748C7C87D	3C8A99261A15F9EF7D4ABF091B1AB706D8CE3D63	D27A2EDAEB1AF1D04124687A054BB25043A069C9BBFD63CF9A147F51C83CB714
Chrome Cache Entry: 86	ASCII text, with no line terminators	FDF2973E6B47E9696F2DBE9BA3FC3FA4	CCCB966332341B8760333E89FBFE731EFD9B2824	DAD04333B045F5386162D56914EE92BC59F42DE79D4A3514DE4C32234044F57A
Chrome Cache Entry: 87	ASCII text, with very long lines (34812), with no line terminators	C5474913C9EEBD695E4C931B57EE5711	E47DF7D2311E94B4209243739D3B68548BD48262	76D06FB89AB5A43E9782388B843198C481A98CCF37C4D86C7ADA747C9AC147BC
Chrome Cache Entry: 88	SVG Scalable Vector Graphics image	64F03B14C822545B9B6A2918A3EE0688	A89D86E84FB28AB901A8E731810AAB2B9C4884B9	FB39B49C4F82D0DA6930D7E0EFBCCFBA44263ECD05ADB7E34BE7A2D157C53BFC
Chrome Cache Entry: 89	ASCII text, with very long lines (1572)	3C89B4E5563F4BA0410A1D7D4F3AD23E	6455000459BF2AD68625B8B554A652CC84145261	B17609553B24140FC01409B78FA834FE878DE6410FE9E8996B0A5F6A984DDD6D
Chrome Cache Entry: 90	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	7A97A94B3A886BECAB8BD482A0C85874	94A07EF125633818F92EA3457967A0A927CCB332	05E6C55EF2FB42FBE3385C541E3976A2C4B329EB9A89D9D0B406C84D97C2686E
Chrome Cache Entry: 91	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	7A97A94B3A886BECAB8BD482A0C85874	94A07EF125633818F92EA3457967A0A927CCB332	05E6C55EF2FB42FBE3385C541E3976A2C4B329EB9A89D9D0B406C84D97C2686E

Source: unknown	HTTPS traffic detected: 52.167.249.196:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.7:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.185.211.133:443 -> 192.168.2.7:49774 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 36MB

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.7:61353 -> 1.1.1.1:53

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: u14209785.ct.sendgrid.net to https://telehealth.advancedmd.com?lk=155941#/validate/20duffc0

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 52.167.249.196
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200

Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.7INBLi-2BpMtquNhvHXoCTQCVNO1LZqxvUJf2y77FfP-2B5UjJzbi4XVbcDbVVnMU7Aq-2BBp0W-2BEDZsGCgqikRw5-2B-2F3ChO61-2BK9itderak-2FRfVWA-3DNUit_wVkPrfPw-2BA1AEa0H994O-2FJzhaxRxtbOwGkOMLzRkK9QBnS-2FeJqZygFoDX2zQ1LLKthUGCWL4dHbYNuWBQW36myHgyEN3th3QQ8vEtD1hT0Fpb-2F3yHU3oe2cLDgAMxIg962j4YucHm-2FcK1zufaGiAikMp-2FGSm-2B-2FO2SKuPn-2BA4GHK8ZUKn7toM9wCALxARZlVFi7UG2UJUH0CEuZvK5lhzhoBX0ViE9PGpxUKlYmBMxmWYVd0214TK3OvKOQHbgChzGP6uwE5X1RPADjfcTKflywyRSm9hX-2BoCXFdYEaR8hVwVDZ8heE5hloYtyidN4G-2B2 HTTP/1.1Host: u14209785.ct.sendgrid.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?lk=155941 HTTP/1.1Host: telehealth.advancedmd.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?lk=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /runtime.d8944d731f65cf6d.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://th-wfe-102.advancedmd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /polyfills.5119fbe14c60bd43.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://th-wfe-102.advancedmd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SecureSubmit.v1/token/2.1/securesubmit.min.js HTTP/1.1Host: api2.heartlandportico.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main.e703f51cfe48abe2.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://th-wfe-102.advancedmd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16/stable/16.0.2/amds-icons/amds-icons.css HTTP/1.1Host: amds-material-prd.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16/stable/16.0.1/amds-patient-theme-default/amds-patient-theme-default.css HTTP/1.1Host: amds-material-prd.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SecureSubmit.v1/token/2.1/securesubmit.min.js HTTP/1.1Host: api2.heartlandportico.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /styles.d2367e1ebc0e9c82.css HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /polyfills.5119fbe14c60bd43.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /runtime.d8944d731f65cf6d.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main.e703f51cfe48abe2.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /326.98b9a2093566ccd6.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://th-wfe-102.advancedmd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /326.98b9a2093566ccd6.js HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/accesscodes/20dUfFC0 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/?lk=155941Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16/stable/16.0.2/amds-icons/svgs/telehealth.svg HTTP/1.1Host: amds-material-prd.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://amds-material-prd.advancedmd.com/16/stable/16.0.2/amds-icons/amds-icons.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/featureaccess?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/systemdefaults?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/accesscodes/20dUfFC0 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16/stable/16.0.2/amds-icons/svgs/telehealth.svg HTTP/1.1Host: amds-material-prd.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/featureaccess?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/systemdefaults?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/settings/155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/settings?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/brandingimage/155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/settings/155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://th-wfe-102.advancedmd.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/settings/155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/configuration/settings?officeKey=155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16/stable/16.0.2/amds-icons/font/amds-icons.woff2 HTTP/1.1Host: amds-material-prd.advancedmd.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://th-wfe-102.advancedmd.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://amds-material-prd.advancedmd.com/16/stable/16.0.2/amds-icons/amds-icons.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/telehealth/settings/155941 HTTP/1.1Host: th-wfe-102.advancedmd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: u14209785.ct.sendgrid.net
Source: global traffic	DNS traffic detected: DNS query: telehealth.advancedmd.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: th-wfe-102.advancedmd.com
Source: global traffic	DNS traffic detected: DNS query: api2.heartlandportico.com
Source: global traffic	DNS traffic detected: DNS query: amds-material-prd.advancedmd.com

Source: unknown

Source: sets.json.4.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.4.dr	String found in binary or memory: https://24.hu
Source: sets.json.4.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.4.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.4.dr	String found in binary or memory: https://alice.tw
Source: sets.json.4.dr	String found in binary or memory: https://ambitionbox.com
Source: chromecache_83.6.dr, chromecache_78.6.dr	String found in binary or memory: https://amds-material-prd.advancedmd.com/16/stable/16.0.1/amds-patient-theme-default/amds-patient-th
Source: chromecache_83.6.dr, chromecache_78.6.dr	String found in binary or memory: https://amds-material-prd.advancedmd.com/16/stable/16.0.2/amds-icons/amds-icons.css
Source: chromecache_78.6.dr	String found in binary or memory: https://api2.heartlandportico.com/SecureSubmit.v1/token/2.1/securesubmit.min.js
Source: sets.json.4.dr	String found in binary or memory: https://autobild.de
Source: sets.json.4.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.4.dr	String found in binary or memory: https://bild.de
Source: sets.json.4.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.4.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.4.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.4.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.4.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.4.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.4.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.4.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.4.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.4.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.4.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.4.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.4.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.4.dr	String found in binary or memory: https://chennien.com
Source: sets.json.4.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.4.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.4.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.4.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.4.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.4.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.4.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.4.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.4.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.4.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.4.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.4.dr	String found in binary or memory: https://css-load.com
Source: sets.json.4.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.4.dr	String found in binary or memory: https://deere.com
Source: sets.json.4.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.4.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.4.dr	String found in binary or memory: https://drimer.io
Source: sets.json.4.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.4.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.4.dr	String found in binary or memory: https://een.be
Source: sets.json.4.dr	String found in binary or memory: https://efront.com
Source: sets.json.4.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.4.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.4.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.4.dr	String found in binary or memory: https://ella.sv
Source: sets.json.4.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.4.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.4.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.4.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.4.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.4.dr	String found in binary or memory: https://finn.no
Source: sets.json.4.dr	String found in binary or memory: https://firstlook.biz
Source: chromecache_76.6.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_76.6.dr	String found in binary or memory: https://fonts.googleapis.com/icon?family=Material
Source: chromecache_72.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialicons/v142/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqW106F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWt06F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtE6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtU6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtk6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWu06F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuk6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWvU6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWxU6F15M.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_89.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: sets.json.4.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://geforcenow.com
Source: chromecache_83.6.dr	String found in binary or memory: https://getbootstrap.com/)
Source: sets.json.4.dr	String found in binary or memory: https://gettalkdesk.com
Source: chromecache_83.6.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: sets.json.4.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.4.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.4.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://grid.id
Source: sets.json.4.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.4.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.4.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.4.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.4.dr	String found in binary or memory: https://hapara.com
Source: sets.json.4.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1.global
Source: sets.json.4.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.4.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.4.dr	String found in binary or memory: https://hearty.app
Source: sets.json.4.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.4.dr	String found in binary or memory: https://hearty.me
Source: sets.json.4.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.4.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.4.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.4.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.4.dr	String found in binary or memory: https://hj.rs
Source: sets.json.4.dr	String found in binary or memory: https://hjck.com
Source: sets.json.4.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.4.dr	String found in binary or memory: https://html-load.com
Source: sets.json.4.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.4.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.4.dr	String found in binary or memory: https://img-load.com
Source: sets.json.4.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.4.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.4.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.4.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.4.dr	String found in binary or memory: https://interia.pl
Source: sets.json.4.dr	String found in binary or memory: https://intoday.in
Source: sets.json.4.dr	String found in binary or memory: https://iolam.it
Source: sets.json.4.dr	String found in binary or memory: https://ishares.com
Source: sets.json.4.dr	String found in binary or memory: https://jagran.com
Source: sets.json.4.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.4.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.4.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.4.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.4.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.4.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.4.dr	String found in binary or memory: https://kompas.com
Source: sets.json.4.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.4.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.4.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.4.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.4.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.4.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.4.dr	String found in binary or memory: https://libero.it
Source: sets.json.4.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.4.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.4.dr	String found in binary or memory: https://livechat.com
Source: sets.json.4.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.4.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.4.dr	String found in binary or memory: https://livemint.com
Source: sets.json.4.dr	String found in binary or memory: https://max.auto
Source: sets.json.4.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.4.dr	String found in binary or memory: https://meo.pt
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.4.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.4.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.4.dr	String found in binary or memory: https://money.pl
Source: sets.json.4.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.4.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.4.dr	String found in binary or memory: https://nacion.com
Source: sets.json.4.dr	String found in binary or memory: https://naukri.com
Source: sets.json.4.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.4.dr	String found in binary or memory: https://nien.co
Source: sets.json.4.dr	String found in binary or memory: https://nien.com
Source: sets.json.4.dr	String found in binary or memory: https://nien.org
Source: sets.json.4.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.4.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.4.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.4.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.4.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.4.dr	String found in binary or memory: https://o2.pl
Source: sets.json.4.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.4.dr	String found in binary or memory: https://onet.pl
Source: sets.json.4.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.4.dr	String found in binary or memory: https://p106.net
Source: sets.json.4.dr	String found in binary or memory: https://p24.hu
Source: sets.json.4.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.4.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.4.dr	String found in binary or memory: https://player.pl
Source: sets.json.4.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.4.dr	String found in binary or memory: https://poalim.site
Source: sets.json.4.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.4.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.4.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.4.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.4.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.4.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.4.dr	String found in binary or memory: https://radio1.be
Source: sets.json.4.dr	String found in binary or memory: https://radio2.be
Source: sets.json.4.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.4.dr	String found in binary or memory: https://repid.org
Source: sets.json.4.dr	String found in binary or memory: https://reshim.org
Source: sets.json.4.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.4.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.4.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.4.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.4.dr	String found in binary or memory: https://samayam.com
Source: sets.json.4.dr	String found in binary or memory: https://sapo.io
Source: sets.json.4.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.4.dr	String found in binary or memory: https://shock.co
Source: sets.json.4.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.4.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.4.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.4.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.4.dr	String found in binary or memory: https://songshare.com
Source: sets.json.4.dr	String found in binary or memory: https://songstats.com
Source: sets.json.4.dr	String found in binary or memory: https://sporza.be
Source: sets.json.4.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.4.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.4.dr	String found in binary or memory: https://stripe.com
Source: sets.json.4.dr	String found in binary or memory: https://stripe.network
Source: sets.json.4.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.4.dr	String found in binary or memory: https://supereva.it
Source: sets.json.4.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.4.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.4.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.4.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.4.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.4.dr	String found in binary or memory: https://text.com
Source: sets.json.4.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.4.dr	String found in binary or memory: https://the42.ie
Source: sets.json.4.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.4.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.4.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.4.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.4.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.4.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.4.dr	String found in binary or memory: https://top.pl
Source: sets.json.4.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.4.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://tvid.in
Source: sets.json.4.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.4.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.4.dr	String found in binary or memory: https://unotv.com
Source: sets.json.4.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.4.dr	String found in binary or memory: https://vrt.be
Source: sets.json.4.dr	String found in binary or memory: https://vwo.com
Source: sets.json.4.dr	String found in binary or memory: https://welt.de
Source: sets.json.4.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.4.dr	String found in binary or memory: https://wildix.com
Source: sets.json.4.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.4.dr	String found in binary or memory: https://wingify.com
Source: sets.json.4.dr	String found in binary or memory: https://wordle.at
Source: sets.json.4.dr	String found in binary or memory: https://wp.pl
Source: sets.json.4.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.4.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.4.dr	String found in binary or memory: https://ya.ru
Source: sets.json.4.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://zalo.me
Source: sets.json.4.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.4.dr	String found in binary or memory: https://zingmp3.vn

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 52.167.249.196:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.7:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.185.211.133:443 -> 192.168.2.7:49774 version: TLS 1.2

Creates files inside the system directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6992_1056580268\manifest.fingerprint	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_6992_1822328550

Jump to behavior

Source: classification engine

Classification label: clean2.win@18/46@18/14

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1924,i,6885173539796808452,12185716589163999248,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u14209785.ct.sendgrid.net/ls/click?upn=u001.7INBLi-2BpMtquNhvHXoCTQCVNO1LZqxvUJf2y77FfP-2B5UjJzbi4XVbcDbVVnMU7Aq-2BBp0W-2BEDZsGCgqikRw5-2B-2F3ChO61-2BK9itderak-2FRfVWA-3DNUit_wVkPrfPw-2BA1AEa0H994O-2FJzhaxRxtbOwGkOMLzRkK9QBnS-2FeJqZygFoDX2zQ1LLKthUGCWL4dHbYNuWBQW36myHgyEN3th3QQ8vEtD1hT0Fpb-2F3yHU3oe2cLDgAMxIg962j4YucHm-2FcK1zufaGiAikMp-2FGSm-2B-2FO2SKuPn-2BA4GHK8ZUKn7toM9wCALxARZlVFi7UG2UJUH0CEuZvK5lhzhoBX0ViE9PGpxUKlYmBMxmWYVd0214TK3OvKOQHbgChzGP6uwE5X1RPADjfcTKflywyRSm9hX-2BoCXFdYEaR8hVwVDZ8heE5hloYtyidN4G-2B2"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1924,i,6885173539796808452,12185716589163999248,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Confirm

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1501217
Product:	CloudBasic
Start time:	15:39:40
Start date:	29.08.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs