Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpg

Overview

General Information

Sample URL:https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpg
Analysis ID:1446920
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Detected non-DNS traffic on DNS port
Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 2692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 2800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2316,i,10189186568564156967,13113194519922559545,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6392 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpg" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpgHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49746 version: TLS 1.0
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: global trafficTCP traffic: 192.168.2.4:49736 -> 1.1.1.1:53
Source: unknownHTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49746 version: TLS 1.0
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.126.151
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.126.151
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /surveys/718515628/691bbd23inv0MSC_logo_small.jpg HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpgAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=sGzgukbWCgqVTFK8RynhukzqcK1nDyrSGiwiUbQA8SUwWGfBqaq5XG58uFLG6hKMMszzOx0NrFj+ljPnxxW3ypKwNO1noRt6g98j2Qt3DykINNnftu85o9GXGBCX; AWSALBCORS=sGzgukbWCgqVTFK8RynhukzqcK1nDyrSGiwiUbQA8SUwWGfBqaq5XG58uFLG6hKMMszzOx0NrFj+ljPnxxW3ypKwNO1noRt6g98j2Qt3DykINNnftu85o9GXGBCX
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficDNS traffic detected: DNS query: survey.vovici.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 23:24:14 GMTContent-Type: text/htmlContent-Length: 1245Connection: closeSet-Cookie: AWSALB=rp2Iuq5QQq951654R2BmVyIFa28Tttp4LV595GweO7hcO9MW8BQv5o5lXqivbcL7gqzTIHHW2M/jJCHZ1lYw7r7q6zX3bqHpmF6iYLozHdHiM0SGj06cwkGzhZG4; Expires=Thu, 30 May 2024 23:24:14 GMT; Path=/Set-Cookie: AWSALBCORS=rp2Iuq5QQq951654R2BmVyIFa28Tttp4LV595GweO7hcO9MW8BQv5o5lXqivbcL7gqzTIHHW2M/jJCHZ1lYw7r7q6zX3bqHpmF6iYLozHdHiM0SGj06cwkGzhZG4; Expires=Thu, 30 May 2024 23:24:14 GMT; Path=/; SameSite=None; SecureServer: Microsoft-IIS/10.0X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31536000; includeSubDomains
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: classification engineClassification label: clean1.win@16/4@4/4
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2316,i,10189186568564156967,13113194519922559545,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpg"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2316,i,10189186568564156967,13113194519922559545,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media3
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive4
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpg0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://survey.vovici.com/favicon.ico0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalse
    		unknown
    www.google.com
    		142.250.185.100
    		truefalse
      		unknown
      survey.vovici.com
      		35.160.201.168
      		truefalse
        		unknown
        fp2e7a.wpc.phicdn.net
        		192.229.221.95
        		truefalse
          		unknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpgfalse
            		unknown
            https://survey.vovici.com/favicon.icofalse
            • Avira URL Cloud: safe
            		unknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            239.255.255.250
            		unknownReserved
            		unknownunknownfalse
            35.160.201.168
            		survey.vovici.comUnited States
            		16509AMAZON-02USfalse
            142.250.185.100
            		www.google.comUnited States
            		15169GOOGLEUSfalse

            Private

            IP
            192.168.2.4

            General Information

            Joe Sandbox version:40.0.0 Tourmaline
            Analysis ID:1446920
            Start date and time:2024-05-24 01:23:11 +02:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 3m 10s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:browseurl.jbs
            Sample URL:https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpg
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:8
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Detection:CLEAN
            Classification:clean1.win@16/4@4/4

            Warnings

            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
            • Excluded IPs from analysis (whitelisted): 142.250.74.206, 142.250.186.35, 74.125.71.84, 34.104.35.123, 192.229.221.95, 199.232.210.172, 20.114.59.183, 20.166.126.56, 40.127.169.103, 52.165.164.15, 142.250.185.131, 93.184.221.240
            • Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, update.googleapis.com, hlb.apr-52dd2-0.edgecastdns.net, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
            • Not all processes where analyzed, report is missing behavior information
            • Report size getting too big, too many NtSetInformationFile calls found.
            • VT rate limit hit for: https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpg

            Simulations

            Behavior and APIs

            ⊘No simulations

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            Chrome Cache Entry: 40

            Download File
            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.10], baseline, precision 8, 800x110, components 3
            Category:downloaded
            Size (bytes):53733
            Entropy (8bit):7.815228746624947
            Encrypted:false
            SSDEEP:1536:M0C5unDBD/FfCLwcIeZFj3z+IUnz9dijm/J:Mv5unD3CEczaIKzbijq
            MD5:8BB7485C379A726A18AFD2E7800C3ABC
            SHA1:3B5BEBBD4D428780C2D31AE3A0A7BA8B19C22867
            SHA-256:D0AC3A2637C730FB3BFC3DCAE3DE7A23A4366F2791FF567185CDEF95604A3113
            SHA-512:AAD75037D14958EB00BBBEE974B37DFD10A9379274DC76DAEC6C5C5D4A6DB9F4BB3D04BB674CE7501B4D51B5B0976053A39015FD7669899E78F0932CCFDCF18E
            Malicious:false
            Reputation:low
            URL:https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpg
            Preview:......JFIF.....,.,.....hExif..MM.*.................>...........F.(...........1.........N.......,.......,....paint.net 4.2.10.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,

            Chrome Cache Entry: 41

            Download File
            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
            File Type:HTML document, ASCII text, with CRLF line terminators
            Category:downloaded
            Size (bytes):1245
            Entropy (8bit):5.462849750105637
            Encrypted:false
            SSDEEP:24:hM0mIAvy4Wvsqs1Ra7JZRGNeHX+AYcvP2wk1RjdEF3qpMk5:lmIAq1UqsziJZ+eHX+AdP2TvpMk5
            MD5:5343C1A8B203C162A3BF3870D9F50FD4
            SHA1:04B5B886C20D88B57EEA6D8FF882624A4AC1E51D
            SHA-256:DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
            SHA-512:E0F50ACB6061744E825A4051765CEBF23E8C489B55B190739409D8A79BB08DAC8F919247A4E5F65A015EA9C57D326BBEF7EA045163915129E01F316C4958D949
            Malicious:false
            Reputation:low
            URL:https://survey.vovici.com/favicon.ico
            Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">.. ..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="co

            Static File Info

            ⊘No static file info

            Network Behavior

            Network Port Distribution

            TCP Packets

            TimestampSource PortDest PortSource IPDest IP
            May 24, 2024 01:24:03.220243931 CEST49675443192.168.2.4173.222.162.32
            May 24, 2024 01:24:13.006438971 CEST49675443192.168.2.4173.222.162.32
            May 24, 2024 01:24:13.041143894 CEST4973653192.168.2.41.1.1.1
            May 24, 2024 01:24:13.048640966 CEST53497361.1.1.1192.168.2.4
            May 24, 2024 01:24:13.051265001 CEST4973653192.168.2.41.1.1.1
            May 24, 2024 01:24:13.051333904 CEST4973653192.168.2.41.1.1.1
            May 24, 2024 01:24:13.051333904 CEST4973653192.168.2.41.1.1.1
            May 24, 2024 01:24:13.051400900 CEST4973653192.168.2.41.1.1.1
            May 24, 2024 01:24:13.052018881 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.052052021 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:13.052138090 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.052179098 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.052186012 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:13.052232981 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.052373886 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.052385092 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:13.052504063 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.052510977 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:13.072511911 CEST53497361.1.1.1192.168.2.4
            May 24, 2024 01:24:13.077106953 CEST53497361.1.1.1192.168.2.4
            May 24, 2024 01:24:13.114201069 CEST53497361.1.1.1192.168.2.4
            May 24, 2024 01:24:13.447365046 CEST53497361.1.1.1192.168.2.4
            May 24, 2024 01:24:13.447510004 CEST4973653192.168.2.41.1.1.1
            May 24, 2024 01:24:13.978187084 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:13.978853941 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.978879929 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:13.979974985 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:13.980036974 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.982779980 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.982863903 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:13.983783007 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.983792067 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:13.985028028 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:13.986073971 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.986083031 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:13.987318039 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:13.987379074 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.992775917 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:13.992839098 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:14.034516096 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.034646988 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.034656048 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:14.078269958 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.242343903 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.242363930 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.242372990 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.242400885 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.242407084 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.242410898 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.242422104 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.242455006 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.242474079 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.242474079 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.242503881 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.260009050 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.260026932 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.260090113 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.260104895 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.301090956 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.331938982 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.331965923 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.332015991 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.332019091 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.332040071 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.332051039 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.332078934 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.332106113 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.332998991 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.333059072 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.333070040 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.333090067 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.333110094 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.333149910 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.425863028 CEST49737443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.425906897 CEST4434973735.160.201.168192.168.2.4
            May 24, 2024 01:24:14.529731035 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.570528030 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:14.735634089 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:14.735723019 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:14.735785007 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.739717007 CEST49738443192.168.2.435.160.201.168
            May 24, 2024 01:24:14.739736080 CEST4434973835.160.201.168192.168.2.4
            May 24, 2024 01:24:15.519731045 CEST49741443192.168.2.4142.250.185.100
            May 24, 2024 01:24:15.519773960 CEST44349741142.250.185.100192.168.2.4
            May 24, 2024 01:24:15.519855022 CEST49741443192.168.2.4142.250.185.100
            May 24, 2024 01:24:15.520602942 CEST49741443192.168.2.4142.250.185.100
            May 24, 2024 01:24:15.520625114 CEST44349741142.250.185.100192.168.2.4
            May 24, 2024 01:24:16.194730997 CEST44349741142.250.185.100192.168.2.4
            May 24, 2024 01:24:16.200284004 CEST49741443192.168.2.4142.250.185.100
            May 24, 2024 01:24:16.200301886 CEST44349741142.250.185.100192.168.2.4
            May 24, 2024 01:24:16.201342106 CEST44349741142.250.185.100192.168.2.4
            May 24, 2024 01:24:16.201426029 CEST49741443192.168.2.4142.250.185.100
            May 24, 2024 01:24:16.203361988 CEST49741443192.168.2.4142.250.185.100
            May 24, 2024 01:24:16.203430891 CEST44349741142.250.185.100192.168.2.4
            May 24, 2024 01:24:16.218061924 CEST49743443192.168.2.4184.28.90.27
            May 24, 2024 01:24:16.218108892 CEST44349743184.28.90.27192.168.2.4
            May 24, 2024 01:24:16.218236923 CEST49743443192.168.2.4184.28.90.27
            May 24, 2024 01:24:16.223671913 CEST49743443192.168.2.4184.28.90.27
            May 24, 2024 01:24:16.223690033 CEST44349743184.28.90.27192.168.2.4
            May 24, 2024 01:24:16.250408888 CEST49741443192.168.2.4142.250.185.100
            May 24, 2024 01:24:16.250417948 CEST44349741142.250.185.100192.168.2.4
            May 24, 2024 01:24:16.297277927 CEST49741443192.168.2.4142.250.185.100
            May 24, 2024 01:24:17.077826023 CEST44349743184.28.90.27192.168.2.4
            May 24, 2024 01:24:17.077886105 CEST49743443192.168.2.4184.28.90.27
            May 24, 2024 01:24:17.100886106 CEST49743443192.168.2.4184.28.90.27
            May 24, 2024 01:24:17.100918055 CEST44349743184.28.90.27192.168.2.4
            May 24, 2024 01:24:17.102061987 CEST44349743184.28.90.27192.168.2.4
            May 24, 2024 01:24:17.156666994 CEST49743443192.168.2.4184.28.90.27
            May 24, 2024 01:24:17.259610891 CEST49743443192.168.2.4184.28.90.27
            May 24, 2024 01:24:17.302534103 CEST44349743184.28.90.27192.168.2.4
            May 24, 2024 01:24:17.464575052 CEST44349743184.28.90.27192.168.2.4
            May 24, 2024 01:24:17.464736938 CEST44349743184.28.90.27192.168.2.4
            May 24, 2024 01:24:17.464799881 CEST49743443192.168.2.4184.28.90.27
            May 24, 2024 01:24:17.465008020 CEST49743443192.168.2.4184.28.90.27
            May 24, 2024 01:24:17.465008020 CEST49743443192.168.2.4184.28.90.27
            May 24, 2024 01:24:17.465019941 CEST44349743184.28.90.27192.168.2.4
            May 24, 2024 01:24:17.465028048 CEST44349743184.28.90.27192.168.2.4
            May 24, 2024 01:24:17.506346941 CEST49744443192.168.2.4184.28.90.27
            May 24, 2024 01:24:17.506378889 CEST44349744184.28.90.27192.168.2.4
            May 24, 2024 01:24:17.506468058 CEST49744443192.168.2.4184.28.90.27
            May 24, 2024 01:24:17.506747961 CEST49744443192.168.2.4184.28.90.27
            May 24, 2024 01:24:17.506761074 CEST44349744184.28.90.27192.168.2.4
            May 24, 2024 01:24:18.209146976 CEST44349744184.28.90.27192.168.2.4
            May 24, 2024 01:24:18.209238052 CEST49744443192.168.2.4184.28.90.27
            May 24, 2024 01:24:18.210637093 CEST49744443192.168.2.4184.28.90.27
            May 24, 2024 01:24:18.210645914 CEST44349744184.28.90.27192.168.2.4
            May 24, 2024 01:24:18.211414099 CEST44349744184.28.90.27192.168.2.4
            May 24, 2024 01:24:18.212529898 CEST49744443192.168.2.4184.28.90.27
            May 24, 2024 01:24:18.258492947 CEST44349744184.28.90.27192.168.2.4
            May 24, 2024 01:24:18.512176991 CEST44349744184.28.90.27192.168.2.4
            May 24, 2024 01:24:18.512532949 CEST44349744184.28.90.27192.168.2.4
            May 24, 2024 01:24:18.512598991 CEST49744443192.168.2.4184.28.90.27
            May 24, 2024 01:24:18.515141010 CEST49744443192.168.2.4184.28.90.27
            May 24, 2024 01:24:18.515185118 CEST44349744184.28.90.27192.168.2.4
            May 24, 2024 01:24:18.515213966 CEST49744443192.168.2.4184.28.90.27
            May 24, 2024 01:24:18.515229940 CEST44349744184.28.90.27192.168.2.4
            May 24, 2024 01:24:19.692831993 CEST44349730173.222.162.32192.168.2.4
            May 24, 2024 01:24:19.693094015 CEST49730443192.168.2.4173.222.162.32
            May 24, 2024 01:24:24.728128910 CEST4972380192.168.2.42.19.126.151
            May 24, 2024 01:24:24.736720085 CEST49730443192.168.2.4173.222.162.32
            May 24, 2024 01:24:24.737016916 CEST80497232.19.126.151192.168.2.4
            May 24, 2024 01:24:24.737051964 CEST49730443192.168.2.4173.222.162.32
            May 24, 2024 01:24:24.737072945 CEST4972380192.168.2.42.19.126.151
            May 24, 2024 01:24:24.739675999 CEST49746443192.168.2.4173.222.162.32
            May 24, 2024 01:24:24.739727020 CEST44349746173.222.162.32192.168.2.4
            May 24, 2024 01:24:24.740588903 CEST49746443192.168.2.4173.222.162.32
            May 24, 2024 01:24:24.742804050 CEST49746443192.168.2.4173.222.162.32
            May 24, 2024 01:24:24.742822886 CEST44349746173.222.162.32192.168.2.4
            May 24, 2024 01:24:24.746711969 CEST44349730173.222.162.32192.168.2.4
            May 24, 2024 01:24:24.751490116 CEST44349730173.222.162.32192.168.2.4
            May 24, 2024 01:24:25.352355957 CEST44349746173.222.162.32192.168.2.4
            May 24, 2024 01:24:25.352447987 CEST49746443192.168.2.4173.222.162.32
            May 24, 2024 01:24:26.150254011 CEST44349741142.250.185.100192.168.2.4
            May 24, 2024 01:24:26.150325060 CEST44349741142.250.185.100192.168.2.4
            May 24, 2024 01:24:26.150372028 CEST49741443192.168.2.4142.250.185.100
            May 24, 2024 01:24:27.702883005 CEST49741443192.168.2.4142.250.185.100
            May 24, 2024 01:24:27.702903986 CEST44349741142.250.185.100192.168.2.4
            May 24, 2024 01:24:44.504790068 CEST44349746173.222.162.32192.168.2.4
            May 24, 2024 01:24:44.504856110 CEST49746443192.168.2.4173.222.162.32
            May 24, 2024 01:25:15.538861990 CEST49753443192.168.2.4142.250.185.100
            May 24, 2024 01:25:15.538892984 CEST44349753142.250.185.100192.168.2.4
            May 24, 2024 01:25:15.539024115 CEST49753443192.168.2.4142.250.185.100
            May 24, 2024 01:25:15.539315939 CEST49753443192.168.2.4142.250.185.100
            May 24, 2024 01:25:15.539329052 CEST44349753142.250.185.100192.168.2.4
            May 24, 2024 01:25:16.314302921 CEST44349753142.250.185.100192.168.2.4
            May 24, 2024 01:25:16.314793110 CEST49753443192.168.2.4142.250.185.100
            May 24, 2024 01:25:16.314805984 CEST44349753142.250.185.100192.168.2.4
            May 24, 2024 01:25:16.315263033 CEST44349753142.250.185.100192.168.2.4
            May 24, 2024 01:25:16.315804958 CEST49753443192.168.2.4142.250.185.100
            May 24, 2024 01:25:16.315891981 CEST44349753142.250.185.100192.168.2.4
            May 24, 2024 01:25:16.360516071 CEST49753443192.168.2.4142.250.185.100
            May 24, 2024 01:25:26.196753025 CEST44349753142.250.185.100192.168.2.4
            May 24, 2024 01:25:26.196932077 CEST44349753142.250.185.100192.168.2.4
            May 24, 2024 01:25:26.197108984 CEST49753443192.168.2.4142.250.185.100
            May 24, 2024 01:25:27.578605890 CEST49753443192.168.2.4142.250.185.100
            May 24, 2024 01:25:27.578627110 CEST44349753142.250.185.100192.168.2.4

            UDP Packets

            TimestampSource PortDest PortSource IPDest IP
            May 24, 2024 01:24:11.328797102 CEST53602201.1.1.1192.168.2.4
            May 24, 2024 01:24:11.328808069 CEST53565791.1.1.1192.168.2.4
            May 24, 2024 01:24:12.397010088 CEST53521381.1.1.1192.168.2.4
            May 24, 2024 01:24:13.013813019 CEST6535353192.168.2.41.1.1.1
            May 24, 2024 01:24:13.013967991 CEST4922153192.168.2.41.1.1.1
            May 24, 2024 01:24:13.025800943 CEST53492211.1.1.1192.168.2.4
            May 24, 2024 01:24:13.043914080 CEST53653531.1.1.1192.168.2.4
            May 24, 2024 01:24:15.487871885 CEST5050853192.168.2.41.1.1.1
            May 24, 2024 01:24:15.488018990 CEST6138953192.168.2.41.1.1.1
            May 24, 2024 01:24:15.495954037 CEST53613891.1.1.1192.168.2.4
            May 24, 2024 01:24:15.495965958 CEST53505081.1.1.1192.168.2.4
            May 24, 2024 01:24:24.854654074 CEST138138192.168.2.4192.168.2.255
            May 24, 2024 01:24:29.578325033 CEST53626811.1.1.1192.168.2.4
            May 24, 2024 01:24:48.485953093 CEST53556511.1.1.1192.168.2.4
            May 24, 2024 01:25:10.965457916 CEST53512291.1.1.1192.168.2.4
            May 24, 2024 01:25:11.070282936 CEST53630381.1.1.1192.168.2.4

            DNS Queries

            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
            May 24, 2024 01:24:13.013813019 CEST192.168.2.41.1.1.10x56adStandard query (0)survey.vovici.comA (IP address)IN (0x0001)false
            May 24, 2024 01:24:13.013967991 CEST192.168.2.41.1.1.10x8009Standard query (0)survey.vovici.com65IN (0x0001)false
            May 24, 2024 01:24:15.487871885 CEST192.168.2.41.1.1.10x5300Standard query (0)www.google.comA (IP address)IN (0x0001)false
            May 24, 2024 01:24:15.488018990 CEST192.168.2.41.1.1.10x6b3bStandard query (0)www.google.com65IN (0x0001)false

            DNS Answers

            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
            May 24, 2024 01:24:13.043914080 CEST1.1.1.1192.168.2.40x56adNo error (0)survey.vovici.com35.160.201.168A (IP address)IN (0x0001)false
            May 24, 2024 01:24:13.043914080 CEST1.1.1.1192.168.2.40x56adNo error (0)survey.vovici.com54.148.105.250A (IP address)IN (0x0001)false
            May 24, 2024 01:24:15.495954037 CEST1.1.1.1192.168.2.40x6b3bNo error (0)www.google.com65IN (0x0001)false
            May 24, 2024 01:24:15.495965958 CEST1.1.1.1192.168.2.40x5300No error (0)www.google.com142.250.185.100A (IP address)IN (0x0001)false
            May 24, 2024 01:24:23.868849039 CEST1.1.1.1192.168.2.40x16f4No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
            May 24, 2024 01:24:23.868849039 CEST1.1.1.1192.168.2.40x16f4No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
            May 24, 2024 01:24:24.746726990 CEST1.1.1.1192.168.2.40x1727No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
            May 24, 2024 01:24:24.746726990 CEST1.1.1.1192.168.2.40x1727No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false

            HTTP Request Dependency Graph

            • survey.vovici.com
            • https:
            • fs.microsoft.com

            HTTPS Proxied Packets

            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            0192.168.2.44973735.160.201.1684432800C:\Program Files\Google\Chrome\Application\chrome.exe
            TimestampBytes transferredDirectionData
            2024-05-23 23:24:13 UTC708OUTGET /surveys/718515628/691bbd23inv0MSC_logo_small.jpg HTTP/1.1
            Host: survey.vovici.com
            Connection: keep-alive
            sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
            sec-ch-ua-mobile: ?0
            sec-ch-ua-platform: "Windows"
            Upgrade-Insecure-Requests: 1
            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
            Sec-Fetch-Site: none
            Sec-Fetch-Mode: navigate
            Sec-Fetch-User: ?1
            Sec-Fetch-Dest: document
            Accept-Encoding: gzip, deflate, br
            Accept-Language: en-US,en;q=0.9
            2024-05-23 23:24:14 UTC787INHTTP/1.1 200 OK
            Date: Thu, 23 May 2024 23:24:14 GMT
            Content-Type: image/jpeg
            Content-Length: 53733
            Connection: close
            Set-Cookie: AWSALB=sGzgukbWCgqVTFK8RynhukzqcK1nDyrSGiwiUbQA8SUwWGfBqaq5XG58uFLG6hKMMszzOx0NrFj+ljPnxxW3ypKwNO1noRt6g98j2Qt3DykINNnftu85o9GXGBCX; Expires=Thu, 30 May 2024 23:24:14 GMT; Path=/
            Set-Cookie: AWSALBCORS=sGzgukbWCgqVTFK8RynhukzqcK1nDyrSGiwiUbQA8SUwWGfBqaq5XG58uFLG6hKMMszzOx0NrFj+ljPnxxW3ypKwNO1noRt6g98j2Qt3DykINNnftu85o9GXGBCX; Expires=Thu, 30 May 2024 23:24:14 GMT; Path=/; SameSite=None; Secure
            Last-Modified: Mon, 27 Apr 2020 16:29:42 GMT
            Accept-Ranges: bytes
            ETag: "fb1bdedb11cd61:0"
            Server: Microsoft-IIS/10.0
            X-XSS-Protection: 1; mode=block
            X-Content-Type-Options: nosniff
            Strict-Transport-Security: max-age=31536000; includeSubDomains
            2024-05-23 23:24:14 UTC15597INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 00 68 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 11 00 00 00 4e 00 00 00 00 00 00 01 2c 00 00 00 01 00 00 01 2c 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 31 30 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            Data Ascii: JFIF,,hExifMM*>F(1N,,paint.net 4.2.10XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP
            2024-05-23 23:24:14 UTC1422INData Raw: 60 ae a2 3c 7f a8 9d 43 ed c2 e4 83 65 65 f6 63 08 33 f9 80 1f b3 94 50 01 45 00 14 50 01 45 00 14 50 01 45 00 14 50 01 45 00 14 50 01 45 00 14 50 01 45 00 14 50 01 5e 43 f1 f7 e3 06 83 f0 0b e0 cf c4 8f 8c 5e 24 31 b6 99 e0 1f 0b 6a 3a e2 da 3c a2 13 aa ea ab 18 b6 d0 34 28 65 3c 25 d6 bf ae dc 69 da 2d a3 1f 94 5c df c4 58 85 c9 1c 98 fc 65 3c bf 03 8d c7 d5 fe 16 0b 09 88 c5 d4 e9 ee 61 a8 ce b4 f5 e9 ee c1 9f 45 c2 1c 3b 8b e2 fe 2c e1 7e 13 c0 26 f1 dc 51 c4 59 2f 0e e0 f9 63 cc fe b5 9d 66 58 6c b7 0f 68 fd a7 ed 71 30 b2 eb b1 fc 04 f8 c7 c5 ba f7 8f 7c 5b e2 7f 1c 78 a2 f9 f5 2f 12 78 c3 c4 1a c7 89 f5 fd 42 4f bf 79 ac 6b b7 f7 1a 9e a3 72 46 4e d1 2d dd cc ae a8 0e d8 d4 84 5c 2a 81 5c dd 7f 9f d5 aa d4 af 56 ad 7a af 9a a5 6a 93 ab 52 4f ed 4e
            Data Ascii: `<Ceec3PEPEPEPEPEPEP^C^$1j:<4(e<%i-\Xe<aE;,~&QY/cfXlhq0|[x/xBOykrFN-\*\VzjRON
            2024-05-23 23:24:14 UTC16384INData Raw: 15 fc c3 ff 00 c1 7a 3e 2e 9d 53 e2 3f c1 8f 82 16 37 2c 6d bc 21 e1 7d 5b e2 1f 88 20 8d c1 86 4d 5b c5 f7 df d8 ba 1c 37 2b d5 6e f4 cd 2f c3 5a 8d cc 40 e0 8b 6f 11 06 e4 4a bb 7f 34 f1 73 17 f5 6e 06 cc e0 9b 52 c6 57 c0 61 22 d7 9e 32 96 22 6b fe de a5 87 a9 17 e4 d9 fd c3 fb 3a f8 7b fb 77 e9 55 c1 18 a9 41 54 a3 c3 39 57 16 f1 0d 68 b4 da 5e cf 87 71 f9 46 16 6e db 3a 58 fc e3 09 56 2d e9 cf 08 ae b6 7f cf fd 15 fc 74 7f d2 78 57 f5 3b ff 00 04 22 f8 45 ff 00 08 ef c1 1f 8a 5f 19 af ad bc bb ff 00 89 5e 37 b5 f0 be 8f 2c b1 7c ed e1 af 00 59 3b 3d cd ac c4 64 41 7d e2 2f 11 eb 16 77 28 84 2c 93 68 30 99 37 18 63 db fa 87 83 f8 4f ac f1 c6 06 ab 57 58 1c 26 61 8b 7a 68 af 86 96 12 2f e5 3c 5c 5a ec ec cf e1 1f da 3f c4 3f d8 9f 45 8e 2a c0 a9 fb 39
            Data Ascii: z>.S?7,m!}[ M[7+n/Z@oJ4snRWa"2"k:{wUAT9Wh^qFn:XV-txW;"E_^7,|Y;=dA}/w(,h07cOWX&azh/<\Z??E*9
            2024-05-23 23:24:14 UTC16384INData Raw: 52 97 e4 47 fc 16 a3 e2 e7 fc 2b ef d8 fa 7f 03 d9 dc f9 5a bf c6 5f 1a e8 1e 12 11 c7 21 8e e0 78 7b 43 94 f8 c7 5f ba 4c 60 b5 b9 9b 44 d1 f4 7b c5 07 e7 87 5c 11 b0 28 ed 5f c7 f5 7e 39 e3 4e 2f eb 1c 62 a8 27 a6 07 2a c1 61 da ed 2a 93 af 8c 6f c9 b8 e2 a1 f2 48 ff 00 4a 3f 66 27 0f 7f 63 fd 1a ea 66 b2 85 a7 c5 7e 20 f1 3e 73 1a 8e 36 73 a1 82 c3 e5 1c 37 08 a9 6e e9 c2 b6 45 89 71 5b 29 ce ad b7 61 45 7e 48 7f a2 47 e9 37 fc 12 67 e1 17 fc 2d 9f db 6f e1 94 97 56 bf 69 d1 7e 18 43 ab 7c 58 d6 38 c8 89 bc 29 0c 50 78 66 6c 90 57 31 f8 db 55 f0 c4 98 3c b2 24 9b 79 19 1f da 95 7f 55 f8 21 84 f6 3c 2b 8d c5 35 69 63 33 9a ed 3e f4 b0 f8 5c 25 28 7d d5 7d bf de 7f cf f7 ed 4d e2 1f ed 2f 1f 78 67 21 a7 3e 6a 3c 35 e1 b6 53 1a b4 ef fc 3c c3 37 ce f3 fc
            Data Ascii: RG+Z_!x{C_L`D{\(_~9N/b'*a*oHJ?f'cf~ >s6s7nEq[)aE~HG7g-oVi~C|X8)PxflW1U<$yU!<+5ic3>\%(}}M/xg!>j<5S<7
            2024-05-23 23:24:14 UTC3946INData Raw: fe 76 74 7f c3 a0 7f 69 5f fa 1d fe 06 ff 00 e1 4b e3 ef fe 76 74 7f c4 25 e2 3f fa 0d c9 3f f0 a7 1f ff 00 ce d0 ff 00 8a 87 f8 2b ff 00 44 bf 8a 3f f8 65 e1 3f fe 8d 83 fe 1d 03 fb 4a ff 00 d0 ef f0 37 ff 00 0a 5f 1f 7f f3 b3 a3 fe 1d 03 fb 4a ff 00 d0 ef f0 37 ff 00 0a 5f 1f 7f f3 b3 a3 fe 21 2f 11 ff 00 d0 6e 49 ff 00 85 38 ff 00 fe 76 87 fc 54 3f c1 5f fa 25 fc 51 ff 00 c3 2f 09 ff 00 f4 6c 1f f0 e8 1f da 57 fe 87 7f 81 bf f8 52 f8 fb ff 00 9d 9d 1f f0 e8 1f da 57 fe 87 7f 81 bf f8 52 f8 fb ff 00 9d 9d 1f f1 09 78 8f fe 83 72 4f fc 29 c7 ff 00 f3 b4 3f e2 a1 fe 0a ff 00 d1 2f e2 8f fe 19 78 4f ff 00 a3 60 ff 00 87 40 fe d2 bf f4 3b fc 0d ff 00 c2 97 c7 df fc ec eb dd 3e 13 7f c1 0c 3e 34 78 be 6b 6d 43 c7 df 19 be 17 f8 5b c3 32 4a cb 24 fe 0f b5 f1
            Data Ascii: vti_Kvt%??+D?e?J7_J7_!/nI8vT?_%Q/lWRWRxrO)?/xO`@;>>4xkmC[2J$


            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            1192.168.2.44973835.160.201.1684432800C:\Program Files\Google\Chrome\Application\chrome.exe
            TimestampBytes transferredDirectionData
            2024-05-23 23:24:14 UTC916OUTGET /favicon.ico HTTP/1.1
            Host: survey.vovici.com
            Connection: keep-alive
            sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
            sec-ch-ua-mobile: ?0
            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
            sec-ch-ua-platform: "Windows"
            Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
            Sec-Fetch-Site: same-origin
            Sec-Fetch-Mode: no-cors
            Sec-Fetch-Dest: image
            Referer: https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpg
            Accept-Encoding: gzip, deflate, br
            Accept-Language: en-US,en;q=0.9
            Cookie: AWSALB=sGzgukbWCgqVTFK8RynhukzqcK1nDyrSGiwiUbQA8SUwWGfBqaq5XG58uFLG6hKMMszzOx0NrFj+ljPnxxW3ypKwNO1noRt6g98j2Qt3DykINNnftu85o9GXGBCX; AWSALBCORS=sGzgukbWCgqVTFK8RynhukzqcK1nDyrSGiwiUbQA8SUwWGfBqaq5XG58uFLG6hKMMszzOx0NrFj+ljPnxxW3ypKwNO1noRt6g98j2Qt3DykINNnftu85o9GXGBCX
            2024-05-23 23:24:14 UTC698INHTTP/1.1 404 Not Found
            Date: Thu, 23 May 2024 23:24:14 GMT
            Content-Type: text/html
            Content-Length: 1245
            Connection: close
            Set-Cookie: AWSALB=rp2Iuq5QQq951654R2BmVyIFa28Tttp4LV595GweO7hcO9MW8BQv5o5lXqivbcL7gqzTIHHW2M/jJCHZ1lYw7r7q6zX3bqHpmF6iYLozHdHiM0SGj06cwkGzhZG4; Expires=Thu, 30 May 2024 23:24:14 GMT; Path=/
            Set-Cookie: AWSALBCORS=rp2Iuq5QQq951654R2BmVyIFa28Tttp4LV595GweO7hcO9MW8BQv5o5lXqivbcL7gqzTIHHW2M/jJCHZ1lYw7r7q6zX3bqHpmF6iYLozHdHiM0SGj06cwkGzhZG4; Expires=Thu, 30 May 2024 23:24:14 GMT; Path=/; SameSite=None; Secure
            Server: Microsoft-IIS/10.0
            X-XSS-Protection: 1; mode=block
            X-Content-Type-Options: nosniff
            Strict-Transport-Security: max-age=31536000; includeSubDomains
            2024-05-23 23:24:14 UTC1245INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c
            Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - Fil


            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            2192.168.2.449743184.28.90.27443
            TimestampBytes transferredDirectionData
            2024-05-23 23:24:17 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
            Connection: Keep-Alive
            Accept: */*
            Accept-Encoding: identity
            User-Agent: Microsoft BITS/7.8
            Host: fs.microsoft.com
            2024-05-23 23:24:17 UTC467INHTTP/1.1 200 OK
            Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
            Content-Type: application/octet-stream
            ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
            Last-Modified: Tue, 16 May 2017 22:58:00 GMT
            Server: ECAcc (chd/079C)
            X-CID: 11
            X-Ms-ApiVersion: Distribute 1.2
            X-Ms-Region: prod-eus2-z1
            Cache-Control: public, max-age=27578
            Date: Thu, 23 May 2024 23:24:17 GMT
            Connection: close
            X-CID: 2


            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            3192.168.2.449744184.28.90.27443
            TimestampBytes transferredDirectionData
            2024-05-23 23:24:18 UTC239OUTGET /fs/windows/config.json HTTP/1.1
            Connection: Keep-Alive
            Accept: */*
            Accept-Encoding: identity
            If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
            Range: bytes=0-2147483646
            User-Agent: Microsoft BITS/7.8
            Host: fs.microsoft.com
            2024-05-23 23:24:18 UTC514INHTTP/1.1 200 OK
            ApiVersion: Distribute 1.1
            Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
            Content-Type: application/octet-stream
            ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
            Last-Modified: Tue, 16 May 2017 22:58:00 GMT
            Server: ECAcc (lpl/EF06)
            X-CID: 11
            X-Ms-ApiVersion: Distribute 1.2
            X-Ms-Region: prod-weu-z1
            Cache-Control: public, max-age=27530
            Date: Thu, 23 May 2024 23:24:18 GMT
            Content-Length: 55
            Connection: close
            X-CID: 2
            2024-05-23 23:24:18 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
            Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


            Statistics

            CPU Usage

            Click to jump to process

            Memory Usage

            Click to jump to process

            Behavior

            Click to jump to process

            System Behavior

            General

            Target ID:0
            Start time:19:24:06
            Start date:23/05/2024
            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
            Imagebase:0x7ff76e190000
            File size:3'242'272 bytes
            MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:false

            General

            Target ID:2
            Start time:19:24:09
            Start date:23/05/2024
            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2316,i,10189186568564156967,13113194519922559545,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
            Imagebase:0x7ff76e190000
            File size:3'242'272 bytes
            MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:false

            General

            Target ID:3
            Start time:19:24:12
            Start date:23/05/2024
            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://survey.vovici.com/surveys/718515628/691bbd23inv0MSC_logo_small.jpg"
            Imagebase:0x7ff76e190000
            File size:3'242'272 bytes
            MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            Disassembly

            ⊘No disassembly