Windows Analysis Report
https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178

Overview

General Information

Sample URL:	https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178
Analysis ID:	1446922
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

Source: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178	HTTP Parser: No favicon
Source: https://survey.vovici.com/oh/2AD3ADAC691BBD2308DC7A75D80BDEE178	HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49759 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62955 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.6:62951 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:55938 -> 1.1.1.1:53

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49759 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET /och/2AD3ADAC691BBD2308DC7A75D80BDEE178 HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/bootstrap.min.css?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/kendo/css/kendo.common.min.css?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/kendo/css/kendo.bootstrap.min.css?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/structure.css?9B9CBA55 HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /surveys/718515628/691bbd23/theme.css?9B9CBA5500000965 HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/jquery.min.js?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/bootstrap.min.js?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/jquery.placeholder.js?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/support.js?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/kendo/js/kendo.all.min.js?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /surveys/718515628/691bbd23/MSC_R_tagline_RGB.png HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/surveys/718515628/691bbd23/theme.css?9B9CBA5500000965Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh; AWSALBCORS=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/prev.png HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/static/structure.css?9B9CBA55Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh; AWSALBCORS=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/next.png HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/static/structure.css?9B9CBA55Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh; AWSALBCORS=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/loading.gif HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/static/structure.css?9B9CBA55Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh; AWSALBCORS=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/close.png HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/static/structure.css?9B9CBA55Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh; AWSALBCORS=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/close.png HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/next.png HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/prev.png HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/loading.gif HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /surveys/718515628/691bbd23/MSC_R_tagline_RGB.png HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /oh/2AD3ADAC691BBD2308DC7A75D80BDEE178 HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALBCORS=exP3iQa0YCZjqyxwz1NTzgMlqxp7lI0yh15H41N1FRwkbt6Wo3/uZPQ0hgmtoWOhPFp8snq6qM371o1+WWqMM5gjAYg5wxRd5FEGEbGV4TJuKljxf7X4NACmASMP; AWSALB=WlkJ85Jofj81b01rKSr4Q9tM+d2mo2hxpfXB4wO99m3a2y404SKcqOhip0g9Z0I8YS4aPhnc+SvA3xPMeeHkJ/8DO4bSswXKvh54Ke+zTBlefBd2c5b3fv77YtAB
Source: global traffic	HTTP traffic detected: GET /oh/2AD3ADAC691BBD2308DC7A75D80BDEE178 HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=exP3iQa0YCZjqyxwz1NTzgMlqxp7lI0yh15H41N1FRwkbt6Wo3/uZPQ0hgmtoWOhPFp8snq6qM371o1+WWqMM5gjAYg5wxRd5FEGEbGV4TJuKljxf7X4NACmASMP

Source: global traffic	DNS traffic detected: DNS query: survey.vovici.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 23:24:19 GMTContent-Type: text/htmlContent-Length: 1245Connection: closeSet-Cookie: AWSALB=W4+R7pTuGnnCvXPP7NTk4YwcH30PWCok+zrjI6hb4nlSlaPWgGVAcfLa9vvDd3wAlDTizj0snqbUZJqQ0cToY8NvfzD8rmMScrTiSTN7BkbkExrF4t9WLyFoYyU6; Expires=Thu, 30 May 2024 23:24:19 GMT; Path=/Set-Cookie: AWSALBCORS=W4+R7pTuGnnCvXPP7NTk4YwcH30PWCok+zrjI6hb4nlSlaPWgGVAcfLa9vvDd3wAlDTizj0snqbUZJqQ0cToY8NvfzD8rmMScrTiSTN7BkbkExrF4t9WLyFoYyU6; Expires=Thu, 30 May 2024 23:24:19 GMT; Path=/; SameSite=None; SecureServer: Microsoft-IIS/10.0X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31536000; includeSubDomains

Source: chromecache_133.2.dr	String found in binary or memory: http://jqueryui.com/about)
Source: chromecache_133.2.dr	String found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Verdana
Source: chromecache_138.2.dr	String found in binary or memory: http://survey.vovici.com/oh/2AD3ADAC691BBD2308DC7A75D80BDEE178
Source: chromecache_140.2.dr, chromecache_152.2.dr	String found in binary or memory: http://www.telerik.com/kendo-ui)
Source: chromecache_140.2.dr, chromecache_152.2.dr	String found in binary or memory: http://www.telerik.com/purchase/license-agreement/kendo-ui-complete
Source: sets.json.0.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.0.dr	String found in binary or memory: https://alice.tw
Source: sets.json.0.dr	String found in binary or memory: https://autobild.de
Source: sets.json.0.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.0.dr	String found in binary or memory: https://bild.de
Source: sets.json.0.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.0.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.0.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.0.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.0.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.0.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.0.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.0.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.0.dr	String found in binary or memory: https://chennien.com
Source: sets.json.0.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.0.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.0.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.0.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.0.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.0.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.0.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.0.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.0.dr	String found in binary or memory: https://een.be
Source: sets.json.0.dr	String found in binary or memory: https://efront.com
Source: sets.json.0.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.0.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.0.dr	String found in binary or memory: https://ella.sv
Source: sets.json.0.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.0.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.0.dr	String found in binary or memory: https://finn.no
Source: sets.json.0.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.0.dr	String found in binary or memory: https://gallito.com.uy
Source: chromecache_147.2.dr, chromecache_150.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: sets.json.0.dr	String found in binary or memory: https://gettalkdesk.com
Source: chromecache_131.2.dr	String found in binary or memory: https://github.com/gjunge/rateit.js
Source: chromecache_150.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: sets.json.0.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.0.dr	String found in binary or memory: https://grid.id
Source: sets.json.0.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.0.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.0.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.0.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://hapara.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.global
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.0.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.0.dr	String found in binary or memory: https://hearty.app
Source: sets.json.0.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.0.dr	String found in binary or memory: https://hearty.me
Source: sets.json.0.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.0.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.0.dr	String found in binary or memory: https://hj.rs
Source: sets.json.0.dr	String found in binary or memory: https://hjck.com
Source: sets.json.0.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.0.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.0.dr	String found in binary or memory: https://iolam.it
Source: sets.json.0.dr	String found in binary or memory: https://ishares.com
Source: sets.json.0.dr	String found in binary or memory: https://jagran.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.0.dr	String found in binary or memory: https://kompas.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.0.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.0.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.0.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.0.dr	String found in binary or memory: https://libero.it
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.0.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.0.dr	String found in binary or memory: https://livemint.com
Source: sets.json.0.dr	String found in binary or memory: https://max.auto
Source: sets.json.0.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.0.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.0.dr	String found in binary or memory: https://money.pl
Source: sets.json.0.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://nacion.com
Source: sets.json.0.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.co
Source: sets.json.0.dr	String found in binary or memory: https://nien.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.org
Source: sets.json.0.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.dr	String found in binary or memory: https://o2.pl
Source: sets.json.0.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.0.dr	String found in binary or memory: https://onet.pl
Source: sets.json.0.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.0.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.0.dr	String found in binary or memory: https://player.pl
Source: sets.json.0.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.0.dr	String found in binary or memory: https://poalim.site
Source: sets.json.0.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.0.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.0.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.0.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://radio1.be
Source: sets.json.0.dr	String found in binary or memory: https://radio2.be
Source: sets.json.0.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://repid.org
Source: sets.json.0.dr	String found in binary or memory: https://reshim.org
Source: sets.json.0.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.0.dr	String found in binary or memory: https://samayam.com
Source: sets.json.0.dr	String found in binary or memory: https://shock.co
Source: sets.json.0.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.0.dr	String found in binary or memory: https://songshare.com
Source: sets.json.0.dr	String found in binary or memory: https://songstats.com
Source: sets.json.0.dr	String found in binary or memory: https://sporza.be
Source: sets.json.0.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.0.dr	String found in binary or memory: https://stripe.com
Source: sets.json.0.dr	String found in binary or memory: https://stripe.network
Source: sets.json.0.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.0.dr	String found in binary or memory: https://supereva.it
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.0.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.0.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.0.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.0.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.0.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://tvid.in
Source: sets.json.0.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.0.dr	String found in binary or memory: https://unotv.com
Source: sets.json.0.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.0.dr	String found in binary or memory: https://vrt.be
Source: sets.json.0.dr	String found in binary or memory: https://vwo.com
Source: sets.json.0.dr	String found in binary or memory: https://welt.de
Source: sets.json.0.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.dr	String found in binary or memory: https://wildix.com
Source: sets.json.0.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.0.dr	String found in binary or memory: https://wingify.com
Source: sets.json.0.dr	String found in binary or memory: https://wordle.at
Source: sets.json.0.dr	String found in binary or memory: https://wp.pl
Source: sets.json.0.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.0.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.0.dr	String found in binary or memory: https://ya.ru
Source: sets.json.0.dr	String found in binary or memory: https://zalo.me
Source: sets.json.0.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://zingmp3.vn

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55942
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62953
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 55940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 62953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 55942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62955 version: TLS 1.2

Creates files inside the system directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\manifest.fingerprint	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_5692_1107154480

Jump to behavior

Source: classification engine

Classification label: clean2.win@24/46@8/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2000,i,948018042709324076,2356385525770831721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2000,i,948018042709324076,2356385525770831721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.148.105.250	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.160.201.168	survey.vovici.com	United States	16509	AMAZON-02US	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.6

Contacted Domains

Name	IP	Active
www.google.com	216.58.206.36	true
survey.vovici.com	35.160.201.168	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://survey.vovici.com/static/support.js?000022CB	false	Avira URL Cloud: safe	unknown
https://survey.vovici.com/static/bootstrap.min.css?000022CB	false	Avira URL Cloud: safe	unknown
https://survey.vovici.com/static/images/lightbox/close.png	false	Avira URL Cloud: safe	unknown
https://survey.vovici.com/static/images/lightbox/next.png	false	Avira URL Cloud: safe	unknown
https://survey.vovici.com/static/bootstrap.min.js?000022CB	false	Avira URL Cloud: safe	unknown
https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178	false		unknown
https://survey.vovici.com/surveys/718515628/691bbd23/theme.css?9B9CBA5500000965	false	Avira URL Cloud: safe	unknown
https://survey.vovici.com/static/images/lightbox/prev.png	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\LICENSE	ASCII text	EE002CB9E51BB8DFA89640A406A1090A	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\_metadata\verified_contents.json	JSON data	884209DC825F17BCF6433F2DD3C7E6FD	A38A1A859C781FD6F7BD52CFD62CE685CA5A910D	B62C892D3B126AD917D30310BD400C333029727C88140E9C9E6420AE3E26DEED
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\manifest.fingerprint	ASCII text, with no line terminators	12E4B45B481A49CB9793C4EB9EEB686D	8A1C3CD932D7441ACA1FDA1B077BFFAC53067E6A	0B26105D6FCD078FC074E3F43012735C3C9D62E20B3C4DB205DEA4A8841ACE18
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\manifest.json	JSON data	96644BF9C61D98F0ABBCB29D385C4DF2	83F15025C8B68D609DC3653517B224C8AED08602	2D6F188933F762A98D6F5796438D63D1415F3661D04522C32900984440297F80
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\sets.json	JSON data	94679DFD3B9168DAA5214E36B8E12730	DE6965B81658AD978483F3A809641C66C2A92D12	83D4ABA459DB56533A15A34889D633A5EB0AE6CFB90483D5BC60FC6CA72AC7D3
Chrome Cache Entry: 131	ASCII text, with very long lines (4413)	F5FF8B5621A6F9E45A8DEB5BF80F5F27	3161C5A9F7348A48F6A7DB9C100B969AC992E968	ED2E1F01FF033DD49DDC9612BAD7C3C4EB9BA03C274274BE8530F77F89758D08
Chrome Cache Entry: 132	ASCII text, with very long lines (37864), with CRLF, LF line terminators	D5FC1CFD93CD8304C9DC3E4A1299E13A	4C7B86C8CFB04B1A376C781B80CAF5DD32FDDF68	5EFEACE9847E559F33A11639E9DAB26685688071751ECC5C2A65D54E7BC4F985
Chrome Cache Entry: 133	assembler source, ASCII text, with very long lines (1398), with CRLF line terminators	59EA8549C7E94F7CEDB64E12F95AFAA9	AD429623AD27D56BE0A316C7676CF28B7C6B0526	BC2D26386FEB4D69DCAC5A3247D263BBA32356E73BFB51E400E36655E1E747A6
Chrome Cache Entry: 134	ASCII text, with very long lines (3191), with CRLF line terminators	C42E8B86D474FF4CB0BB1C2099863FC5	DA340F9F849D72153CD596E62FFCF949C425A511	0EE6F5D783689225FE25889D210EC31DC398E6E2F75450DB5ED0D97A9C148627
Chrome Cache Entry: 135	HTML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators	7616818599123E2C17B6859C5FBF8EEC	FC7EA55BB04B8E05449E4996CAEDAD75762AA39F	4435B6F982C894F426FEE00F88D9506BC919CC6BA8A8DBC14E153FFB5FC97D93
Chrome Cache Entry: 136	PNG image data, 50 x 45, 8-bit/color RGBA, non-interlaced	31F15875975AAB69085470AABBFEC802	777E92C050F600B4519299C3D786B8F2F459FEA4	15B869B02C6FBAA8C6C26445A2DD2D9BAD80FD27B1409F8179E5DD89DC89D90A
Chrome Cache Entry: 137	ASCII text, with very long lines (32078), with CRLF line terminators	E100AB2F93ADDCAC69392713CC4BF614	383BEE318DCB55D38896EF02E0DB9773186B14D7	AB9225081BF7B22478768A7B80A741833128CBBA94ACC524CB8989CD90490CAF
Chrome Cache Entry: 138	HTML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators	766D07ACE0500B88B17C743DF0B0BB65	189375E2D40136978389B856698E31F2D9FD253A	DAAEE6DB720F1F7302FE2D6996557E0482835CDB4B9CB29AC23AD8FC99CA4808
Chrome Cache Entry: 139	assembler source, ASCII text, with CRLF, LF line terminators	AA767B60BF9F3BCCA0A0F56E5F3AE88C	387C565F042150664BA94F47B9F44FC1B09EFCE9	D07E8CD15BF84A22601D1A1294DF3754154385D526DA80DEEAEAB5D61A6462FA
Chrome Cache Entry: 140	ASCII text, with very long lines (996)	43203858B498DDDAF9FEFD1AB1ADD486	F00040E6407621E54B3B79C4776B6210E2773E91	BA394FBDFAA9ABDE603C7915E8BB3326F25013A50E30D25364E958B27595B751
Chrome Cache Entry: 141	GIF image data, version 89a, 32 x 32	2299AD0B3F63413F026DFEC20C205B8F	CF720B50CF8DDE0E1A84CE1C6A77788BFC5882D5	225AA88B6AB02C06222EC9468D62E15FA188E39CDB9431D1F55401AD380753ED
Chrome Cache Entry: 142	HTML document, ASCII text, with CRLF line terminators	5343C1A8B203C162A3BF3870D9F50FD4	04B5B886C20D88B57EEA6D8FF882624A4AC1E51D	DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
Chrome Cache Entry: 143	PNG image data, 1685 x 246, 8-bit/color RGBA, non-interlaced	4423E0DF8337FE3A2B4AA659A904E0EF	546374A861EA501D5B9E7E0FB0495057A765C3CF	79D1FD028E5A5A5B814D42096FABCA5EB5819E5EF818D0A184ABF683C29B79D8
Chrome Cache Entry: 144	PNG image data, 27 x 27, 8-bit colormap, non-interlaced	D9D2D0B1308CB694AA8116915592E2A9	3CA48361CFE0E41163023D03C26296F375BB3EAC	5D62E6C90005BFB71F6ABB440F9E4753681CB23BBD5E60477AB6F442D2F0E69C
Chrome Cache Entry: 145	PNG image data, 27 x 27, 8-bit colormap, non-interlaced	D9D2D0B1308CB694AA8116915592E2A9	3CA48361CFE0E41163023D03C26296F375BB3EAC	5D62E6C90005BFB71F6ABB440F9E4753681CB23BBD5E60477AB6F442D2F0E69C
Chrome Cache Entry: 146	PNG image data, 50 x 45, 8-bit/color RGBA, non-interlaced	84B76DEE6B27B795E89E3649078A11C2	6640A3432F7BA7AEA6129CDF7A5D3EABD47C295C	7FD9273F20FDB1229C224341271A119020A5EEE74CCF6B4605730917C864CAF2
Chrome Cache Entry: 147	ASCII text, with very long lines (39553)	2F34B630FFE30BA2FF2B91E3F3C322A1	B16FD8226BD6BFB08E568F1B1D0A21D60247CEFB	9EE2FCFF6709E4D0D24B09CA0FC56AADE12B4961ED9C43FD13B03248BFB57AFE
Chrome Cache Entry: 148	PNG image data, 1685 x 246, 8-bit/color RGBA, non-interlaced	4423E0DF8337FE3A2B4AA659A904E0EF	546374A861EA501D5B9E7E0FB0495057A765C3CF	79D1FD028E5A5A5B814D42096FABCA5EB5819E5EF818D0A184ABF683C29B79D8
Chrome Cache Entry: 149	GIF image data, version 89a, 32 x 32	2299AD0B3F63413F026DFEC20C205B8F	CF720B50CF8DDE0E1A84CE1C6A77788BFC5882D5	225AA88B6AB02C06222EC9468D62E15FA188E39CDB9431D1F55401AD380753ED
Chrome Cache Entry: 150	ASCII text, with very long lines (65369)	E73DDC09923BBD3F932F7E164596D595	C99656670033632B8EC6A80E3C4F0241EA61B096	E31FD62BFD6AC97FF9022755D22B8F6F0355CB40D806391784922108A05125DB
Chrome Cache Entry: 151	PNG image data, 50 x 45, 8-bit/color RGBA, non-interlaced	84B76DEE6B27B795E89E3649078A11C2	6640A3432F7BA7AEA6129CDF7A5D3EABD47C295C	7FD9273F20FDB1229C224341271A119020A5EEE74CCF6B4605730917C864CAF2
Chrome Cache Entry: 152	ASCII text, with very long lines (962)	F9A77D4942BCD2C6E412D003F1FCC046	076923019E7CB61C48F797CB4E4EDB705E7EE3C6	9F01979CD5BCE0646F2A30ADE6E9129103BCBAB84889D9A514BEE54F61E65541
Chrome Cache Entry: 153	PNG image data, 50 x 45, 8-bit/color RGBA, non-interlaced	31F15875975AAB69085470AABBFEC802	777E92C050F600B4519299C3D786B8F2F459FEA4	15B869B02C6FBAA8C6C26445A2DD2D9BAD80FD27B1409F8179E5DD89DC89D90A

Source: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178	HTTP Parser: No favicon
Source: https://survey.vovici.com/oh/2AD3ADAC691BBD2308DC7A75D80BDEE178	HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49759 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62955 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.6:62951 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:55938 -> 1.1.1.1:53

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49759 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET /och/2AD3ADAC691BBD2308DC7A75D80BDEE178 HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/bootstrap.min.css?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/kendo/css/kendo.common.min.css?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/kendo/css/kendo.bootstrap.min.css?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/structure.css?9B9CBA55 HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /surveys/718515628/691bbd23/theme.css?9B9CBA5500000965 HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/jquery.min.js?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/bootstrap.min.js?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/jquery.placeholder.js?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/support.js?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /static/kendo/js/kendo.all.min.js?000022CB HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; AWSALBCORS=rCXDoin34k8k+Ygq6kJFjwoZvXsmX9dYKsb6ay+styL8WaOJTkBrpDh5nDvqr4OzcSkKsu7Twj/DZeH+DeM2VPvOw8PJf+us6DamriDSUdbpiyXZLmKQJYCqiyjU; ASP.NET_SessionId=4l4mj1quseszulhcael1nayc
Source: global traffic	HTTP traffic detected: GET /surveys/718515628/691bbd23/MSC_R_tagline_RGB.png HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/surveys/718515628/691bbd23/theme.css?9B9CBA5500000965Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh; AWSALBCORS=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/prev.png HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/static/structure.css?9B9CBA55Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh; AWSALBCORS=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/next.png HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/static/structure.css?9B9CBA55Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh; AWSALBCORS=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/loading.gif HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/static/structure.css?9B9CBA55Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh; AWSALBCORS=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/close.png HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/static/structure.css?9B9CBA55Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh; AWSALBCORS=ZJxH1KT97ri1s4ykzUBTCRoytVse1f0bQBCuWfbCN2HUH7bCRWLEazhImUMM9Hba/IpydiNz7tq1MpfHM2Jfilr00cu3QvTuLqsisp3Y9w4uMyMAD3Z8HuxD0tsh
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: survey.vovici.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/close.png HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/next.png HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/prev.png HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /static/images/lightbox/loading.gif HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /surveys/718515628/691bbd23/MSC_R_tagline_RGB.png HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALB=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX; AWSALBCORS=hWNbVXrUV+CHPAT1x7wGDCGQotM8s4v7veIsBy2PwtS8GH5GKt8Skr7mDcJNY2nkNgZbGmI7YGZPE0tCucMLq0nTLdYTK4VAyUj1wmXko+SC+LE0KVKTyaoPEtlX
Source: global traffic	HTTP traffic detected: GET /oh/2AD3ADAC691BBD2308DC7A75D80BDEE178 HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASP.NET_SessionId=4l4mj1quseszulhcael1nayc; AWSALBCORS=exP3iQa0YCZjqyxwz1NTzgMlqxp7lI0yh15H41N1FRwkbt6Wo3/uZPQ0hgmtoWOhPFp8snq6qM371o1+WWqMM5gjAYg5wxRd5FEGEbGV4TJuKljxf7X4NACmASMP; AWSALB=WlkJ85Jofj81b01rKSr4Q9tM+d2mo2hxpfXB4wO99m3a2y404SKcqOhip0g9Z0I8YS4aPhnc+SvA3xPMeeHkJ/8DO4bSswXKvh54Ke+zTBlefBd2c5b3fv77YtAB
Source: global traffic	HTTP traffic detected: GET /oh/2AD3ADAC691BBD2308DC7A75D80BDEE178 HTTP/1.1Host: survey.vovici.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: AWSALB=exP3iQa0YCZjqyxwz1NTzgMlqxp7lI0yh15H41N1FRwkbt6Wo3/uZPQ0hgmtoWOhPFp8snq6qM371o1+WWqMM5gjAYg5wxRd5FEGEbGV4TJuKljxf7X4NACmASMP

Source: global traffic	DNS traffic detected: DNS query: survey.vovici.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic

Source: chromecache_133.2.dr	String found in binary or memory: http://jqueryui.com/about)
Source: chromecache_133.2.dr	String found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Verdana
Source: chromecache_138.2.dr	String found in binary or memory: http://survey.vovici.com/oh/2AD3ADAC691BBD2308DC7A75D80BDEE178
Source: chromecache_140.2.dr, chromecache_152.2.dr	String found in binary or memory: http://www.telerik.com/kendo-ui)
Source: chromecache_140.2.dr, chromecache_152.2.dr	String found in binary or memory: http://www.telerik.com/purchase/license-agreement/kendo-ui-complete
Source: sets.json.0.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.0.dr	String found in binary or memory: https://alice.tw
Source: sets.json.0.dr	String found in binary or memory: https://autobild.de
Source: sets.json.0.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.0.dr	String found in binary or memory: https://bild.de
Source: sets.json.0.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.0.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.0.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.0.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.0.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.0.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.0.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.0.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.0.dr	String found in binary or memory: https://chennien.com
Source: sets.json.0.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.0.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.0.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.0.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.0.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.0.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.0.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.0.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.0.dr	String found in binary or memory: https://een.be
Source: sets.json.0.dr	String found in binary or memory: https://efront.com
Source: sets.json.0.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.0.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.0.dr	String found in binary or memory: https://ella.sv
Source: sets.json.0.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.0.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.0.dr	String found in binary or memory: https://finn.no
Source: sets.json.0.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.0.dr	String found in binary or memory: https://gallito.com.uy
Source: chromecache_147.2.dr, chromecache_150.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: sets.json.0.dr	String found in binary or memory: https://gettalkdesk.com
Source: chromecache_131.2.dr	String found in binary or memory: https://github.com/gjunge/rateit.js
Source: chromecache_150.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: sets.json.0.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.0.dr	String found in binary or memory: https://grid.id
Source: sets.json.0.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.0.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.0.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.0.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://hapara.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.global
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.0.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.0.dr	String found in binary or memory: https://hearty.app
Source: sets.json.0.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.0.dr	String found in binary or memory: https://hearty.me
Source: sets.json.0.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.0.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.0.dr	String found in binary or memory: https://hj.rs
Source: sets.json.0.dr	String found in binary or memory: https://hjck.com
Source: sets.json.0.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.0.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.0.dr	String found in binary or memory: https://iolam.it
Source: sets.json.0.dr	String found in binary or memory: https://ishares.com
Source: sets.json.0.dr	String found in binary or memory: https://jagran.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.0.dr	String found in binary or memory: https://kompas.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.0.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.0.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.0.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.0.dr	String found in binary or memory: https://libero.it
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.0.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.0.dr	String found in binary or memory: https://livemint.com
Source: sets.json.0.dr	String found in binary or memory: https://max.auto
Source: sets.json.0.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.0.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.0.dr	String found in binary or memory: https://money.pl
Source: sets.json.0.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://nacion.com
Source: sets.json.0.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.co
Source: sets.json.0.dr	String found in binary or memory: https://nien.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.org
Source: sets.json.0.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.dr	String found in binary or memory: https://o2.pl
Source: sets.json.0.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.0.dr	String found in binary or memory: https://onet.pl
Source: sets.json.0.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.0.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.0.dr	String found in binary or memory: https://player.pl
Source: sets.json.0.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.0.dr	String found in binary or memory: https://poalim.site
Source: sets.json.0.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.0.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.0.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.0.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://radio1.be
Source: sets.json.0.dr	String found in binary or memory: https://radio2.be
Source: sets.json.0.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://repid.org
Source: sets.json.0.dr	String found in binary or memory: https://reshim.org
Source: sets.json.0.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.0.dr	String found in binary or memory: https://samayam.com
Source: sets.json.0.dr	String found in binary or memory: https://shock.co
Source: sets.json.0.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.0.dr	String found in binary or memory: https://songshare.com
Source: sets.json.0.dr	String found in binary or memory: https://songstats.com
Source: sets.json.0.dr	String found in binary or memory: https://sporza.be
Source: sets.json.0.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.0.dr	String found in binary or memory: https://stripe.com
Source: sets.json.0.dr	String found in binary or memory: https://stripe.network
Source: sets.json.0.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.0.dr	String found in binary or memory: https://supereva.it
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.0.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.0.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.0.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.0.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.0.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://tvid.in
Source: sets.json.0.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.0.dr	String found in binary or memory: https://unotv.com
Source: sets.json.0.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.0.dr	String found in binary or memory: https://vrt.be
Source: sets.json.0.dr	String found in binary or memory: https://vwo.com
Source: sets.json.0.dr	String found in binary or memory: https://welt.de
Source: sets.json.0.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.dr	String found in binary or memory: https://wildix.com
Source: sets.json.0.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.0.dr	String found in binary or memory: https://wingify.com
Source: sets.json.0.dr	String found in binary or memory: https://wordle.at
Source: sets.json.0.dr	String found in binary or memory: https://wp.pl
Source: sets.json.0.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.0.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.0.dr	String found in binary or memory: https://ya.ru
Source: sets.json.0.dr	String found in binary or memory: https://zalo.me
Source: sets.json.0.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://zingmp3.vn

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55942
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62953
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 55940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 62953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 55942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:55942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62955 version: TLS 1.2

Creates files inside the system directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping5692_1763505986\manifest.fingerprint	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_5692_1107154480

Jump to behavior

Source: classification engine

Classification label: clean2.win@24/46@8/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2000,i,948018042709324076,2356385525770831721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2000,i,948018042709324076,2356385525770831721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1446922
Product:	CloudBasic
Start time:	01:23:13
Start date:	24.05.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://survey.vovici.com/och/2AD3ADAC691BBD2308DC7A75D80BDEE178