Edit tour

Windows Analysis Report
https://research.law.asia/

Overview

General Information

Sample URL:	https://research.law.asia/
Analysis ID:	1520321
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Phishing site detected (based on favicon image match)

Detected hidden input values containing email addresses (often used in phishing pages)

Form action URLs do not match main URL

Found iframes

HTML body contains password input but no form action

Submit button contains javascript call

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6220 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2224,i,8563058853509584086,1516556891725383286,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://research.law.asia/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /pslog.gif?type=1 HTTP/1.1Host: pagesense-collect.zoho.comConnection: keep-aliveContent-Length: 1563sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://www.zoho.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.zoho.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ZohoMarkRef="https://www.zoho.com/survey/"; ZohoMarkSrc="direct:survey|direct:survey|direct:survey"; zsca63a3daff87f4d33b6cffbe7a949ff5f=1727417632193zsc0.6238374381554663; zft-sdc=isef%3Dtrue-isfr%3Dtrue-source%3Ddirect; zps-tgr-dts=sc%3D1-expAppOnNewSession%3D%5B%5D-pc%3D1-sesst%3D1727417632195

Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Form action: //accounts.zoho.com/accounts/register.ac com zoho
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Form action: //accounts.zoho.com/accounts/register.ac com zoho
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Form action: //accounts.zoho.com/accounts/register.ac com zoho
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Form action: //accounts.zoho.com/accounts/register.ac com zoho

Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://cdn.pagesense.io/stage-script/framePageNew-7c74117f6a_.html
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://cdn.pagesense.io/stage-script/framePageNew-7c74117f6a_.html
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.in/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.eu/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.jp/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.com.au/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zohocloud.ca/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.sa/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://cdn.pagesense.io/stage-script/framePageNew-7c74117f6a_.html
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.in/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.eu/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.jp/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.com.au/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zohocloud.ca/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.sa/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://cdn.pagesense.io/stage-script/framePageNew-7c74117f6a_.html
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.in/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.eu/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.jp/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.com.au/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zohocloud.ca/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/survey/	HTTP Parser: Iframe src: https://www.zoho.sa/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://cdn.pagesense.io/stage-script/framePageNew-7c74117f6a_.html
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://cdn.pagesense.io/stage-script/framePageNew-7c74117f6a_.html
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.in/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fth%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.eu/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fth%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.jp/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fth%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.com.au/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fth%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zohocloud.ca/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fth%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.sa/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fth%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://cdn.pagesense.io/stage-script/framePageNew-7c74117f6a_.html
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://cdn.pagesense.io/stage-script/framePageNew-7c74117f6a_.html
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.in/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.eu/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.jp/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.com.au/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zohocloud.ca/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.sa/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://cdn.pagesense.io/stage-script/framePageNew-7c74117f6a_.html
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.in/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.eu/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.jp/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.com.au/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zohocloud.ca/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: Iframe src: https://www.zoho.sa/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Far%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=

Source: https://www.zoho.com/survey/	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://www.zoho.com/survey/	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/survey/	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/survey/	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/survey/	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/survey/	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: On click: validateOTP()

Source: https://www.zoho.com/survey/	HTTP Parser: No favicon
Source: https://www.zoho.com/survey/	HTTP Parser: No favicon
Source: https://www.zoho.com/survey/	HTTP Parser: No favicon
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No favicon
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No favicon

Source: https://www.zoho.com/survey/	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/survey/	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/survey/	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/survey/	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/survey/	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="author".. found

Source: https://www.zoho.com/survey/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/survey/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/survey/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/survey/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/survey/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found
Source: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:50387 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64

Source: global traffic	DNS traffic detected: DNS query: research.law.asia
Source: global traffic	DNS traffic detected: DNS query: www.zoho.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.zohocdn.com
Source: global traffic	DNS traffic detected: DNS query: www.zohowebstatic.com
Source: global traffic	DNS traffic detected: DNS query: zohotagmanager.cdn.pagesense.io
Source: global traffic	DNS traffic detected: DNS query: accounts.zoho.com
Source: global traffic	DNS traffic detected: DNS query: cdn.pagesense.io
Source: global traffic	DNS traffic detected: DNS query: widgets.zohosalesiq.com
Source: global traffic	DNS traffic detected: DNS query: vts.zohopublic.com
Source: global traffic	DNS traffic detected: DNS query: accounts.zoho.in
Source: global traffic	DNS traffic detected: DNS query: accounts.zoho.eu
Source: global traffic	DNS traffic detected: DNS query: accounts.zoho.com.au
Source: global traffic	DNS traffic detected: DNS query: accounts.zoho.jp
Source: global traffic	DNS traffic detected: DNS query: accounts.zohocloud.ca
Source: global traffic	DNS traffic detected: DNS query: accounts.zoho.sa
Source: global traffic	DNS traffic detected: DNS query: salesiq.zoho.com
Source: global traffic	DNS traffic detected: DNS query: pagesense-collect.zoho.com
Source: global traffic	DNS traffic detected: DNS query: js.zohocdn.com
Source: global traffic	DNS traffic detected: DNS query: css.zohocdn.com
Source: global traffic	DNS traffic detected: DNS query: us4-files.zohopublic.com
Source: global traffic	DNS traffic detected: DNS query: salesiq.zohopublic.com
Source: global traffic	DNS traffic detected: DNS query: www.zoho.com.cn
Source: global traffic	DNS traffic detected: DNS query: www.zoho.in
Source: global traffic	DNS traffic detected: DNS query: www.zoho.eu
Source: global traffic	DNS traffic detected: DNS query: www.zoho.jp
Source: global traffic	DNS traffic detected: DNS query: www.zoho.com.au
Source: global traffic	DNS traffic detected: DNS query: www.zohocloud.ca
Source: global traffic	DNS traffic detected: DNS query: www.zoho.sa
Source: global traffic	DNS traffic detected: DNS query: cdn.zoho.com.cn
Source: global traffic	DNS traffic detected: DNS query: webfonts.zoho.com
Source: global traffic	DNS traffic detected: DNS query: pagesense.zoho.com
Source: global traffic	DNS traffic detected: DNS query: su.zoho.com
Source: global traffic	DNS traffic detected: DNS query: cdn.pagesense.cn
Source: global traffic	DNS traffic detected: DNS query: salesiq.zoho.com.cn
Source: global traffic	DNS traffic detected: DNS query: static.zohocdn.com.cn
Source: global traffic	DNS traffic detected: DNS query: files.zohopublic.com.cn
Source: global traffic	DNS traffic detected: DNS query: salesiq.zohopublic.com.cn
Source: global traffic	DNS traffic detected: DNS query: vts.zohopublic.com.cn
Source: global traffic	DNS traffic detected: DNS query: accounts.zoho.com.cn
Source: global traffic	DNS traffic detected: DNS query: hm.baidu.com
Source: global traffic	DNS traffic detected: DNS query: pagesense-collect.zoho.com.cn
Source: global traffic	DNS traffic detected: DNS query: js-stratus.zohostatic.com.cn
Source: global traffic	DNS traffic detected: DNS query: su.zoho.com.cn

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closeDate: Fri, 27 Sep 2024 06:13:56 GMTServer: AmazonS3X-Cache: Error from cloudfrontVia: 1.1 43244f77affffa1d8942dd025413b8d8.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA60-P10X-Amz-Cf-Id: _hVakvxytP6BgEKrF4TWkPeZ0pOMMEO7w7y5DqewXmTU8JCuWpbX-Q==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: NimbusContent-Type: text/htmlContent-Length: 7433Connection: closenimbus-id: bgvKwleIiLbrMhYt2wJNsA61L6ezDuoV-CN3ETag: "605dd186-1d09"Date: Fri, 20 Sep 2024 13:10:09 GMTvary: accept-encodingX-Nimbus-Cache: HIT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: NimbusContent-Type: application/jsonContent-Length: 105Connection: closenimbus-id: DLv4PlafuaJbdTxzP27JBzpdSApUn0Kq-CN3Vary: accept-encodingx-sts-request-id: cx3-5397e82135a848e38264d3cdc0656699X-Content-Type-Options: nosniffstrict-transport-security: max-age=15768000Date: Fri, 27 Sep 2024 06:14:20 GMTCache-Control: no-store, max-age=0X-Frame-Options: ALLOW-FROM zohopagesense.zohostratus.com.cnX-Nimbus-Cache: MISS
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closeDate: Fri, 27 Sep 2024 06:14:40 GMTServer: AmazonS3X-Cache: Error from cloudfrontVia: 1.1 0679859c01a1d918f3fb77e42174ecf8.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA60-P10X-Amz-Cf-Id: yRAsXDFjjxVGywbO0ARGjly2-ZSluDD3OYft8HSz8fDkQv-h5wUYkw==
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closeDate: Fri, 27 Sep 2024 06:15:07 GMTServer: AmazonS3X-Cache: Error from cloudfrontVia: 1.1 c630c028c0123d2a5e8fa36e68049386.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA60-P10X-Amz-Cf-Id: JElGJsp5W4sb14wL3vDtYeOGUo5FjhZh8iV566Lv_bwOvfPHzfTd8g==

Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: http://www.sitemaps.org/schemas/sitemap/0.9
Source: chromecache_243.2.dr, chromecache_415.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/12-effective-ways-to-collect-feedback.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/analyze-reports.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/buy-responses-terms.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/common-survey-mistakes-to-avoid.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/create.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/crm-integration.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/customer-touchpoint.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/email-distribution-terms.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/features.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/fraudulent-data-and-what-to-do-about-it.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/google-sheets-integration.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/integrations.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/mobile.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/net-promoter-score-calculator.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/personalize.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/plan-comparison.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/pre-screening-questions.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/pricing.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/question-types.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/scoring-survey-results.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/secure-surveys.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/send-surveys.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/share-survey-and-reports.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/signup.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/students-school-climate-survey.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/survey-completion-rate-vs-response-rate.html
Source: chromecache_243.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	String found in binary or memory: https://www.zoho.com.cn/survey/survey-response-collection.html
Source: chromecache_243.2.dr, chromecache_359.2.dr, chromecache_418.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/analytics-integration.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/analyze-reports.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/campaigns-integration.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/create.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/crm-integration.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/features.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/free-poll-creator.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/google-sheets-integration.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/inline-email-survey.html
Source: chromecache_243.2.dr, chromecache_359.2.dr	String found in binary or memory: https://www.zoho.com/ar/survey/integrations.html

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2224,i,8563058853509584086,1516556891725383286,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://research.law.asia/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2224,i,8563058853509584086,1516556891725383286,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Drive-by Compromise	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://www.zoho.com/nl/survey/plan-comparison.html	0%	Avira URL Cloud	safe
https://cdn.zoho.com.cn/sites/zweb/js/common/zcms.js	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/create.html	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/confirmation-bias-survey-data.html	0%	Avira URL Cloud	safe
https://www.zoho.com/es-xl/survey/salesiq-integration.html	0%	Avira URL Cloud	safe
https://www.zoho.com/de/survey/scoring-survey-results.html	0%	Avira URL Cloud	safe
https://www.zoho.com/es-xl/survey/crm-integration.html	0%	Avira URL Cloud	safe
https://www.zoho.com/vi/survey/research-panels.html	0%	Avira URL Cloud	safe
https://cdn.pagesense.cn/ztmjs/7fe34041c5e3453fb29411d97b45d939.js	0%	Avira URL Cloud	safe
https://www.zohowebstatic.com/sites/zweb/js/language/t/th.js	0%	Avira URL Cloud	safe
https://www.zoho.com/pt-br/survey/personalize.html	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/templates.html	0%	Avira URL Cloud	safe
https://www.zoho.com/id/survey/crm-integration.html	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/12-effective-ways-to-collect-feedback.html	0%	Avira URL Cloud	safe
https://www.zoho.com/fr/survey/create.html	0%	Avira URL Cloud	safe
https://static.zohocdn.com.cn/zohosecurity/v6_0/js/security-url-validator.min.js	0%	Avira URL Cloud	safe
https://www.zoho.com/es-xl/survey/secure-surveys.html	0%	Avira URL Cloud	safe
https://www.zoho.com/de/survey/online-opinion-polls.html	0%	Avira URL Cloud	safe
https://www.zoho.com/th/survey/question-types.html	0%	Avira URL Cloud	safe
https://www.zoho.com/jp/survey/share-survey-and-reports.html	0%	Avira URL Cloud	safe
https://cdn.zoho.com.cn/sites/zweb/images/survey/survey-home-icons-sprite-2x.png	0%	Avira URL Cloud	safe
https://www.zoho.com/ar/survey/integrations.html	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/surveygizmo-alternative.html	0%	Avira URL Cloud	safe
https://www.zoho.com/vi/survey/share-survey-and-reports.html	0%	Avira URL Cloud	safe
https://www.zoho.com/th/survey/survey-response-collection.html	0%	Avira URL Cloud	safe
https://www.zoho.com/de/survey/salesiq-integration.html	0%	Avira URL Cloud	safe
https://www.zoho.com/fr/survey/survey-response-collection.html	0%	Avira URL Cloud	safe
https://www.zoho.com.cn/sites/zweb/images/zh-hans/zoho_general_pages/subtn_img.png	0%	Avira URL Cloud	safe
https://www.zohowebstatic.com/sites/zweb/images/commonroot/zoho-logo-web.svg	0%	Avira URL Cloud	safe
https://www.zoho.com/pt-br/survey/campaigns-integration.html	0%	Avira URL Cloud	safe
https://www.zoho.com/th/survey/share-survey-and-reports.html	0%	Avira URL Cloud	safe
https://www.zoho.com/th/survey/free-poll-creator.html	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/net-promoter-score-calculator.html	0%	Avira URL Cloud	safe
https://www.zoho.com.cn/survey/buy-responses-terms.html	0%	Avira URL Cloud	safe
https://cdn.pagesense.io/js/fzloyco9/a63a3daff87f4d33b6cffbe7a949ff5f_secondary.js	0%	Avira URL Cloud	safe
https://static.zohocdn.com/zohofonts/zohopuvi/4.0/Zoho_Puvi_Semibold.woff2	0%	Avira URL Cloud	safe
https://www.zoho.com.au/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=	0%	Avira URL Cloud	safe
https://www.zohowebstatic.com/sites/zweb/images/survey/conclude-2x.jpeg	0%	Avira URL Cloud	safe
https://www.zoho.com/es-xl/survey/plan-comparison.html	0%	Avira URL Cloud	safe
https://www.zoho.com/nl/survey/crm-integration.html	0%	Avira URL Cloud	safe
https://accounts.zoho.com.cn/register/script?temp_redirect=true&service_language=zh&load_country=false&servicename=ZohoSurvey&loadcss=false&mode=24&serviceurl=https://survey.zoho.com.cn/success_signup.do?from=zoho	0%	Avira URL Cloud	safe
https://cdn.zoho.com.cn/sites/zweb/images/survey/chris-easterwood-territory-recruiter.jpeg	0%	Avira URL Cloud	safe
https://www.zoho.com/vi/survey/online-opinion-polls.html	0%	Avira URL Cloud	safe
https://www.zoho.com/th/survey/product-menu/?zredirect=f	0%	Avira URL Cloud	safe
https://www.zoho.com/de/survey/plan-comparison.html	0%	Avira URL Cloud	safe
https://www.zoho.com/jp/survey/performance-appraisal-survey.html	0%	Avira URL Cloud	safe
https://www.zoho.com/fr/survey/surveymonkey-alternatives.html	0%	Avira URL Cloud	safe
https://www.zohowebstatic.com/sites/zweb/images/survey/survey-customerfeedback.jpeg	0%	Avira URL Cloud	safe
https://www.zoho.com/th/survey/online-questionnaire.html	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/how-to-write-great-survey-questions.html	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/login.html	0%	Avira URL Cloud	safe
https://www.zoho.com/pt-br/survey/send-surveys.html	0%	Avira URL Cloud	safe
https://www.zoho.com/de/survey/secure-surveys.html	0%	Avira URL Cloud	safe
https://cdn.zoho.com.cn/sites/zweb/images/survey/survey-footer_0.png	0%	Avira URL Cloud	safe
https://www.zoho.com/nl/survey/google-sheets-integration.html	0%	Avira URL Cloud	safe
https://www.zohocloud.ca/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=	0%	Avira URL Cloud	safe
https://static.zohocdn.com/webfonts/robotobold/font_latin.woff2	0%	Avira URL Cloud	safe
https://www.zoho.jp/lp/mar-com.html?ZohoMarkRef=https%3A%2F%2Fwww.zoho.com%2Fth%2Fsurvey%2F%3Fzredirect%3Df%26zsrc%3Dlangdropdown&ZohoMarkSrc=direct%3Asurvey%7Cdirect%3Asurvey%7Cdirect%3Asurvey&cookie-uid=	0%	Avira URL Cloud	safe
https://www.zoho.com/vi/survey/google-sheets-integration.html	0%	Avira URL Cloud	safe
https://www.zoho.com/vi/survey/	0%	Avira URL Cloud	safe
https://www.zoho.com/pt-br/survey/share-survey-and-reports.html	0%	Avira URL Cloud	safe
https://www.zoho.com.cn/survey/common-survey-mistakes-to-avoid.html	0%	Avira URL Cloud	safe
https://cdn.zoho.com.cn/sites/zweb/images/survey/conclude-survey.mp4	0%	Avira URL Cloud	safe
https://static.zohocdn.com.cn/salesiq/js/siqnewchatwindow_luTDuQmu8PUkQ-SPm-Jtygx3CxOQy5y6cYIhYmsoOfz9GUZFRbtoqUOfaVcFWNps_.js	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/success-story/katie-tucker.html	0%	Avira URL Cloud	safe
https://www.zoho.com.cn/survey/	0%	Avira URL Cloud	safe
https://static.zohocdn.com/zohofonts/zohopuvi/4.0/Zoho_Puvi_Regular.woff2	0%	Avira URL Cloud	safe
https://www.zoho.com/ar/survey/surveymonkey-alternatives.html	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/offline-surveys.html	0%	Avira URL Cloud	safe
https://cdn.zoho.com.cn/sites/zweb/css/language/zh-hans.css	0%	Avira URL Cloud	safe
https://cdn.zoho.com.cn/sites/zweb/images/survey/survey-education.jpeg	0%	Avira URL Cloud	safe
https://www.zoho.com/es-xl/survey/send-surveys.html	0%	Avira URL Cloud	safe
https://www.zoho.com/pt-br/survey/research-panels.html	0%	Avira URL Cloud	safe
https://www.zoho.com/ar/survey/mobile.html	0%	Avira URL Cloud	safe
https://www.zoho.com/th/survey/	0%	Avira URL Cloud	safe
https://www.zoho.com/fr/survey/inline-email-survey.html	0%	Avira URL Cloud	safe
https://www.zoho.com/jp/survey/client-service-feedback-survey.html	0%	Avira URL Cloud	safe
https://static.zohocdn.com/zohofonts/zohopuvi/4.0/Zoho_Puvi_Bold.woff2	0%	Avira URL Cloud	safe
https://www.zoho.com/jp/survey/market-segmentation-survey.html	0%	Avira URL Cloud	safe
https://www.zoho.com/vi/survey/secure-surveys.html	0%	Avira URL Cloud	safe
https://cdn.zoho.com.cn/sites/zweb/images/survey/bill-peters-visual-artist.jpeg	0%	Avira URL Cloud	safe
https://pagesense-collect.zoho.com/pslog.gif?type=1	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/fraudulent-data-and-what-to-do-about-it.html	0%	Avira URL Cloud	safe
https://pagesense-collect.zoho.com/pslog.gif?type=2	0%	Avira URL Cloud	safe
https://www.zoho.com/sites/zweb/js/common/prod_menu.js?_=1727417625497	0%	Avira URL Cloud	safe
https://www.zoho.com/de/survey/mobile.html	0%	Avira URL Cloud	safe
https://cdn.zoho.com.cn/sites/zweb/css/node/survey/2870-zh-hans.css	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/crm-integration.html	0%	Avira URL Cloud	safe
https://www.zoho.com/jp/survey/employee-opinions-survey.html	0%	Avira URL Cloud	safe
https://www.zoho.com/sites/zweb/images/zoho_general_pages/zh-one-poster.png	0%	Avira URL Cloud	safe
https://www.zoho.com/es-xl/survey/google-sheets-integration.html	0%	Avira URL Cloud	safe
https://www.zoho.com/survey/school-climate-survey.html	0%	Avira URL Cloud	safe
https://www.zoho.com.cn/survey/students-school-climate-survey.html	0%	Avira URL Cloud	safe
https://accounts.zoho.com/register/script?temp_redirect=true&service_language=th&load_country=false&servicename=ZohoSurvey&loadcss=false&serviceurl=https://survey.zoho.com/success_signup.do?from=zoho	0%	Avira URL Cloud	safe
https://www.zoho.com/de/survey/survey-response-collection.html	0%	Avira URL Cloud	safe
https://www.zoho.com/id/survey/campaigns-integration.html	0%	Avira URL Cloud	safe
https://www.zoho.com.cn/sites/zweb/js/common/zc-headerfooter.js	0%	Avira URL Cloud	safe
https://vts.zohopublic.com/watchws?version=v2&widget_code=90643b459b1adf9d5c8ba650d8418fb905f989e389e690323db70e8258ee79a1b38c0fc203bea6c01c22393458f46948&x-e=siq&x-s=siq&cpage=https%3A%2F%2Fwww.zoho.com%2Fsurvey%2F&ptitle=Zoho%20Survey%20%7C%20Create%20Free%20Online%20Surveys%2C%20Polls%2C%20Quizzes%20and%20Forms&localtime=GMT-0400%20(Eastern%20Daylight%20Time)&gmttime=GMT-0400&resolution=1280x1024&con_id=1727417676685&isgdpr=false&cdnuts=1&eventtime=1727417681694	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
accounts.zoho.com.cn	124.251.121.27	true	false	unknown
zs-jp1-lc2.zoho.jp	103.163.152.67	true	false	unknown
salesiq.zoho.com	136.143.183.67	true	false	unknown
salesiq.zoho.com.cn	124.251.121.57	true	false	unknown
zs-lc1-25-H2.zoho.com	204.141.43.104	true	false	unknown
h2-stratus.zohocdn.com	89.36.170.147	true	false	unknown
zoho.com.cn	124.251.121.25	true	false	unknown
h2-stratus.zohocdn.com.cn	185.20.209.147	true	false	unknown
hm.e.shifen.com	183.240.98.228	true	false	unknown
vts.zohopublic.com.cn	124.251.121.193	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
zpublic.zohopublic.com	136.143.182.97	true	false	unknown
zoho.sa	199.67.80.79	true	false	unknown
su.zoho.com.cn	124.251.121.121	true	false	unknown
d2yb1bkhdjcerk.cloudfront.net	13.35.58.28	true	false	unknown
zs-sa1-lc1.zoho.sa	199.67.80.71	true	false	unknown
zoho.com.au	103.138.128.98	true	false	unknown
us4-files.zohopublic.com	204.141.42.172	true	false	unknown
zs-us4-lczhost.zohohost.com	204.141.42.199	true	false	unknown
gsite.zohocdn.com	185.20.209.52	true	false	unknown
stratus-h2.zohostatic.com.cn	124.251.122.21	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
zoho.in	169.148.148.97	true	false	unknown
zs-lc1-25-h2.zoho.com	204.141.43.104	true	false	unknown
zs-in1-lc1.zoho.in	169.148.148.92	true	false	unknown
zs-cn2-lc2.zoho.com.cn	124.251.121.22	true	false	unknown
zohocloud.ca	199.67.85.73	true	false	unknown
vts.zohopublic.com	204.141.43.144	true	false	unknown
files.zohopublic.com.cn	124.251.122.11	true	false	unknown
drpb2zihpypdm.cloudfront.net	3.160.150.129	true	false	unknown
accounts.zoho.eu	185.230.212.11	true	false	unknown
zoho.eu	185.230.212.52	true	false	unknown
accounts.zoho.com	204.141.42.100	true	false	unknown
zs-au1-lc1-h2.zoho.com.au	103.138.128.66	true	false	unknown
zs-ca1-lc1.zohocloud.ca	199.67.85.65	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
zoho.jp	103.163.152.75	true	false	unknown
nimbuscdn.com.cn	124.251.121.163	true	false	unknown
zs-us4-lcinternal.zoho.com	204.141.42.180	true	false	unknown
zpublic.zohopublic.com.cn	124.251.121.189	true	false	unknown
pre-external-h2.zoho.com	204.141.43.190	true	false	unknown
d3prssb3z78snv.cloudfront.net	18.245.31.24	true	false	unknown
cdn.pagesense.io	unknown	unknown	false	unknown
accounts.zoho.jp	unknown	unknown	false	unknown
css.zohocdn.com	unknown	unknown	false	unknown
pagesense-collect.zoho.com.cn	unknown	unknown	false	unknown
www.zoho.in	unknown	unknown	false	unknown
accounts.zoho.com.au	unknown	unknown	false	unknown
widgets.zohosalesiq.com	unknown	unknown	false	unknown
accounts.zoho.sa	unknown	unknown	false	unknown
www.zoho.eu	unknown	unknown	false	unknown
cdn.pagesense.cn	unknown	unknown	false	unknown
accounts.zohocloud.ca	unknown	unknown	false	unknown
www.zoho.com.au	unknown	unknown	false	unknown
research.law.asia	unknown	unknown	false	unknown
static.zohocdn.com.cn	unknown	unknown	false	unknown
hm.baidu.com	unknown	unknown	false	unknown
static.zohocdn.com	unknown	unknown	false	unknown
www.zoho.com.cn	unknown	unknown	false	unknown
zohotagmanager.cdn.pagesense.io	unknown	unknown	false	unknown
js-stratus.zohostatic.com.cn	unknown	unknown	false	unknown
www.zoho.com	unknown	unknown	false	unknown
salesiq.zohopublic.com	unknown	unknown	false	unknown
www.zoho.jp	unknown	unknown	false	unknown
www.zohowebstatic.com	unknown	unknown	false	unknown
pagesense-collect.zoho.com	unknown	unknown	false	unknown
www.zohocloud.ca	unknown	unknown	false	unknown
js.zohocdn.com	unknown	unknown	false	unknown
salesiq.zohopublic.com.cn	unknown	unknown	false	unknown
www.zoho.sa	unknown	unknown	false	unknown
webfonts.zoho.com	unknown	unknown	false	unknown
pagesense.zoho.com	unknown	unknown	false	unknown
accounts.zoho.in	unknown	unknown	false	unknown
su.zoho.com	unknown	unknown	false	unknown
cdn.zoho.com.cn	unknown	unknown	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.zoho.com/nl/survey/plan-comparison.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/es-xl/survey/salesiq-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/vi/survey/research-panels.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/es-xl/survey/crm-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/de/survey/scoring-survey-results.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/confirmation-bias-survey-data.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/create.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/id/survey/crm-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/pt-br/survey/personalize.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/12-effective-ways-to-collect-feedback.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/templates.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/fr/survey/create.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/es-xl/survey/secure-surveys.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/th/survey/question-types.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/jp/survey/share-survey-and-reports.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/de/survey/online-opinion-polls.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/th/survey/survey-response-collection.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/vi/survey/share-survey-and-reports.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/ar/survey/integrations.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/de/survey/salesiq-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/surveygizmo-alternative.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/fr/survey/survey-response-collection.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/pt-br/survey/campaigns-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/th/survey/share-survey-and-reports.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com.cn/survey/buy-responses-terms.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/net-promoter-score-calculator.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/th/survey/free-poll-creator.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/es-xl/survey/plan-comparison.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/nl/survey/crm-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/vi/survey/online-opinion-polls.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/fr/survey/surveymonkey-alternatives.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/de/survey/plan-comparison.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/jp/survey/performance-appraisal-survey.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/th/survey/online-questionnaire.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/how-to-write-great-survey-questions.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/de/survey/secure-surveys.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/login.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/pt-br/survey/send-surveys.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/nl/survey/google-sheets-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/vi/survey/	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/vi/survey/google-sheets-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/success-story/katie-tucker.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com.cn/survey/common-survey-mistakes-to-avoid.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/pt-br/survey/share-survey-and-reports.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com.cn/survey/	chromecache_243.2.dr, chromecache_415.2.dr, chromecache_484.2.dr, chromecache_359.2.dr, chromecache_506.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/ar/survey/surveymonkey-alternatives.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/offline-surveys.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/es-xl/survey/send-surveys.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/ar/survey/mobile.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/pt-br/survey/research-panels.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/th/survey/	chromecache_243.2.dr, chromecache_297.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/fr/survey/inline-email-survey.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/jp/survey/client-service-feedback-survey.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/jp/survey/market-segmentation-survey.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/vi/survey/secure-surveys.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/fraudulent-data-and-what-to-do-about-it.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/de/survey/mobile.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/jp/survey/employee-opinions-survey.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/crm-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/es-xl/survey/google-sheets-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/survey/school-climate-survey.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com.cn/survey/students-school-climate-survey.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/de/survey/survey-response-collection.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown
https://www.zoho.com/id/survey/campaigns-integration.html	chromecache_243.2.dr, chromecache_359.2.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
136.143.182.97	zpublic.zohopublic.com	United States	2639	ZOHO-ASUS	false
136.143.183.67	salesiq.zoho.com	United States	2639	ZOHO-ASUS	false
124.251.121.193	vts.zohopublic.com.cn	China	9802	CHINA-ABITCOOLAbitcoolChinaIncCN	false
199.67.85.73	zohocloud.ca	United States	19142	UNASSIGNED	false
3.160.150.129	drpb2zihpypdm.cloudfront.net	United States	16509	AMAZON-02US	false
13.35.58.28	d2yb1bkhdjcerk.cloudfront.net	United States	16509	AMAZON-02US	false
3.160.150.73	unknown	United States	16509	AMAZON-02US	false
13.35.58.107	unknown	United States	16509	AMAZON-02US	false
13.35.58.67	unknown	United States	16509	AMAZON-02US	false
124.251.122.11	files.zohopublic.com.cn	China	9802	CHINA-ABITCOOLAbitcoolChinaIncCN	false
199.67.85.65	zs-ca1-lc1.zohocloud.ca	United States	19142	UNASSIGNED	false
204.141.42.172	us4-files.zohopublic.com	United States	2639	ZOHO-ASUS	false
14.215.183.79	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
204.141.43.104	zs-lc1-25-H2.zoho.com	United States	2639	ZOHO-ASUS	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
169.148.148.92	zs-in1-lc1.zoho.in	United States	158	ERI-ASUS	false
204.141.43.144	vts.zohopublic.com	United States	2639	ZOHO-ASUS	false
185.20.209.147	h2-stratus.zohocdn.com.cn	Switzerland	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	false
169.148.148.97	zoho.in	United States	158	ERI-ASUS	false
124.251.121.189	zpublic.zohopublic.com.cn	China	9802	CHINA-ABITCOOLAbitcoolChinaIncCN	false
89.36.170.147	h2-stratus.zohocdn.com	Switzerland	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	false
18.245.31.24	d3prssb3z78snv.cloudfront.net	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
204.141.42.100	accounts.zoho.com	United States	2639	ZOHO-ASUS	false
204.141.42.180	zs-us4-lcinternal.zoho.com	United States	2639	ZOHO-ASUS	false
103.163.152.67	zs-jp1-lc2.zoho.jp	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
103.138.128.98	zoho.com.au	Australia	139006	ZCPL-AS-APZohoCorporationPTYLTDAU	false
204.141.43.190	pre-external-h2.zoho.com	United States	2639	ZOHO-ASUS	false
124.251.121.22	zs-cn2-lc2.zoho.com.cn	China	9802	CHINA-ABITCOOLAbitcoolChinaIncCN	false
199.67.80.71	zs-sa1-lc1.zoho.sa	United States	19142	UNASSIGNED	false
124.251.121.25	zoho.com.cn	China	9802	CHINA-ABITCOOLAbitcoolChinaIncCN	false
13.35.58.85	unknown	United States	16509	AMAZON-02US	false
204.141.42.199	zs-us4-lczhost.zohohost.com	United States	2639	ZOHO-ASUS	false
124.251.121.27	accounts.zoho.com.cn	China	9802	CHINA-ABITCOOLAbitcoolChinaIncCN	false
18.245.31.112	unknown	United States	16509	AMAZON-02US	false
199.67.80.79	zoho.sa	United States	19142	UNASSIGNED	false
185.20.209.52	gsite.zohocdn.com	Switzerland	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	false
103.163.152.75	zoho.jp	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
124.251.121.163	nimbuscdn.com.cn	China	9802	CHINA-ABITCOOLAbitcoolChinaIncCN	false
103.138.128.66	zs-au1-lc1-h2.zoho.com.au	Australia	139006	ZCPL-AS-APZohoCorporationPTYLTDAU	false
124.251.121.121	su.zoho.com.cn	China	9802	CHINA-ABITCOOLAbitcoolChinaIncCN	false
3.160.150.41	unknown	United States	16509	AMAZON-02US	false
185.230.212.11	accounts.zoho.eu	Netherlands	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	false
124.251.121.57	salesiq.zoho.com.cn	China	9802	CHINA-ABITCOOLAbitcoolChinaIncCN	false
18.245.31.125	unknown	United States	16509	AMAZON-02US	false
183.240.98.228	hm.e.shifen.com	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
185.230.212.52	zoho.eu	Netherlands	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	false
124.251.122.21	stratus-h2.zohostatic.com.cn	China	9802	CHINA-ABITCOOLAbitcoolChinaIncCN	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520321
Start date and time:	2024-09-27 08:12:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://research.law.asia/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus23.phis.win@27/564@191/50
Cookbook Comments:	Browse: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown Browse: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown Browse: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown

Input	Output
URL: https://www.zoho.com/survey/ Model: jbxai	{ "brand":["Zoho Survey"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"SIGN UP FOR FREE", "text_input_field_labels":["Email", "Password", "Phone Number", "Texas"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.zoho.com/survey/ Model: jbxai	{ "brand":["zoho"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"SIGN UP FOR FREE", "text_input_field_labels":["Email", "Password", "Phone Number", "Texas"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.zoho.com/survey/ Model: jbxai	{ "phishing_score":1, "brands":"zoho", "legit_domain":"zoho.com", "classification":"known", "reasons":["The brand 'Zoho' is a known brand associated with the domain 'zoho.com'.", "The URL 'www.zoho.com' matches the legitimate domain name for Zoho.", "No suspicious elements such as misspellings, extra characters, or unusual domain extensions are present in the URL."], "brand_matches":[true], "url_match":true, "brand_input":"zoho", "input_fields":"Email, Password, Phone Number, Texas"}

URL: https://www.zoho.com/survey/ Model: jbxai	{ "brand":["Zoho"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"SIGN UP FOR FREE", "text_input_field_labels":["Email", "Password", "Phone Number", "Texas"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown Model: jbxai	{ "brand":["Zoho"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":["United States", "Country Code", "Phone Number"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.zoho.com/survey/ Model: jbxai	{ "phishing_score":1, "brands":"Zoho", "legit_domain":"zoho.com", "classification":"known", "reasons":["The URL matches the legitimate domain name associated with Zoho.", "Zoho is a known brand in the software and cloud services industry.", "No suspicious elements such as misspellings, extra characters, or unusual domain extensions are present in the URL."], "brand_matches":[true], "url_match":true, "brand_input":"Zoho", "input_fields":"Email, Password, Phone Number, Texas"}

URL: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown Model: jbxai	{ "phishing_score":2, "brands":"Zoho", "legit_domain":"zoho.com", "classification":"known", "reasons":["The brand 'Zoho' is a known brand.", "The URL 'zoho.com.cn' uses a country-specific domain extension (.cn) which is legitimate for Chinese users.", "The domain name 'zoho.com.cn' fully matches the legitimate domain name 'zoho.com' with a country-specific extension.", "No suspicious elements such as misspellings, extra characters, or unusual domain extensions were found in the URL."], "brand_matches":[false], "url_match":true, "brand_input":"Zoho", "input_fields":"United States, Country Code, Phone Number"}

URL: https://www.zoho.com.cn/survey/?zredirect=f&zsrc=langdropdown Model: jbxai	{ "brand":["Zoho.com", "CRM", "Zoho One", "Zoho Workplace", "Zoho CRM", "Bigin", "Desk", "Forms", "SalesIQ", "Bookings"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":["Globi"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown Model: jbxai	{ "brand":["Zoho"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":["", "", ""], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.zoho.com/th/survey/?zredirect=f&zsrc=langdropdown Model: jbxai	{ "brand":["Zoho"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":["", "", ""], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown Model: jbxai	{ "brand":["Zoho"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":["Texas", "US"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown Model: jbxai	{ "brand":["Zoho"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":["Email", "Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown Model: jbxai	{ "phishing_score":1, "brands":"Zoho", "legit_domain":"zoho.com", "classification":"known", "reasons":["The URL matches the legitimate domain name for Zoho.", "Zoho is a known brand associated with the domain zoho.com.", "No suspicious elements such as misspellings, extra characters, or unusual domain extensions are present in the URL."], "brand_matches":[true], "url_match":true, "brand_input":"Zoho", "input_fields":"Email, Password"}

URL: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown Model: jbxai	{ "brand":["Zoho"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":["Email", "Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.zoho.com/ar/survey/?zredirect=f&zsrc=langdropdown Model: jbxai	{ "phishing_score":1, "brands":"Zoho", "legit_domain":"zoho.com", "classification":"known", "reasons":["The URL matches the legitimate domain name associated with Zoho.", "Zoho is a known brand in the software and cloud services industry.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions."], "brand_matches":[true], "url_match":true, "brand_input":"Zoho", "input_fields":"Email, Password"}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	101115
Entropy (8bit):	5.382146715422556
Encrypted:	false
SSDEEP:	1536:acNQw38QxLHLr3+S58/dZ4nTspjnVeDNM2o48w5Fcjbqc13arQE:T4ktzdc1Kh
MD5:	17643C0DDB70E1EAC2290E676804E606
SHA1:	6C47C777712B41A1C299BB798070048FA28A6685
SHA-256:	DB97FC7BFE0D6E4CBA4F5C6D6FA79B1CC0FC1D9336B7363FE7FA5D608D0C15F6
SHA-512:	8D6FD41B3A8DC8B787234F65209151CE91DDE433229B1D7044032D4E114174D9E02A560D260D4776BB69E2396C2392D5924DBC4AF680E563F1BE06A18F969104
Malicious:	false
Reputation:	low
Preview:	function StringBuilder(_iv){var arr=_iv?[_iv]:[];this.append=function(v){return arr.push(v),this},this.toString=function(){return arr.join("")},this.isEmpty=function(){return this.length()<1},this.length=function(){return arr.length}}function getSubDomain(domain){for(var i=0,sdomain=domain,p=sdomain.split("."),s="_zagd"+(new Date).getTime();i<p.length-1&&-1==document.cookie.indexOf(s+"="+s);)sdomain=p.slice(-1-++i).join("."),document.cookie=s+"="+s+";domain="+sdomain+";";return document.cookie=s+"=;expires=Thu, 01 Jan 1970 00:00:01 GMT;domain="+sdomain+";",sdomain}function reloadCaptcha(idx,f,cdigest){if(f=f\|\|idx,!f.captcha.disabled){var captchaCallback=function(cdigest){var $captcha=$(f).find(".za-captcha").attr("src",ZAConstants.getAbsoluteURL(ZAConstants.contextpath+"/captcha?cdigest="+cdigest));f.cdigest\|\|$("<input type='hidden' name='cdigest' value='"+cdigest+"'>").insertAfter($captcha),f.cdigest.value=cdigest,f.captcha.value="",f.captcha.autocomplete="off"};if(cdigest)captchaCall

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 53 58 76 42 34 46 67 59 6b 32 4c 6f 43 53 70 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 36 38 33 66 31 37 31 37 62 35 34 33 66 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: NSXvB4FgYk2LoCSp.1Context: f6683f1717b543fd
2024-09-27 06:13:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 06:13:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 53 58 76 42 34 46 67 59 6b 32 4c 6f 43 53 70 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 36 38 33 66 31 37 31 37 62 35 34 33 66 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 52 49 52 58 74 33 61 38 38 77 39 75 4a 64 71 6f 78 75 70 36 58 58 36 4a 78 64 35 51 30 65 32 52 55 45 69 37 4b 6a 66 75 73 44 68 43 4e 65 4a 66 71 75 75 38 58 42 58 4e 64 4f 2b 47 76 2b 79 44 55 73 74 47 58 71 55 49 69 61 76 70 54 42 6e 74 46 4b 47 64 55 72 6e 42 67 4d 75 63 75 2b 6d 5a 30 4b 49 75 44 45 6f 61 30 6f 54 63 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: NSXvB4FgYk2LoCSp.2Context: f6683f1717b543fd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAARIRXt3a88w9uJdqoxup6XX6Jxd5Q0e2RUEi7KjfusDhCNeJfquu8XBXNdO+Gv+yDUstGXqUIiavpTBntFKGdUrnBgMucu+mZ0KIuDEoa0oTc5
2024-09-27 06:13:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 53 58 76 42 34 46 67 59 6b 32 4c 6f 43 53 70 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 36 36 38 33 66 31 37 31 37 62 35 34 33 66 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: NSXvB4FgYk2LoCSp.3Context: f6683f1717b543fd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 06:13:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 06:13:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 62 43 58 34 63 49 4c 32 55 47 68 43 38 70 79 6e 75 66 2b 75 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dbCX4cIL2UGhC8pynuf+ug.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:40 UTC	660	OUT	GET / HTTP/1.1 Host: research.law.asia Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 06:13:40 UTC	744	IN	HTTP/1.1 302 Server: ZGS Date: Fri, 27 Sep 2024 06:13:40 GMT Content-Length: 0 Connection: close Set-Cookie: zalb_53aac31ef0=7ef0edc4391d3e61f04f7de9622d671d; Path=/; Secure; HttpOnly X-Content-Type-Options: nosniff Set-Cookie: JSESSIONID=803EDF164B82960BE4E076A047FB8181; Path=/; Secure; HttpOnly Set-Cookie: aprmjrnpkcrkks=cd2bf361-1f63-4359-8a22-825c6ff636ba;path=/;SameSite=None;Secure;priority=high Set-Cookie: _zcsr_tmp=cd2bf361-1f63-4359-8a22-825c6ff636ba;path=/;SameSite=Strict;Secure;priority=high Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Location: https://research.law.asia/survey/login.do Strict-Transport-Security: max-age=63072000

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:40 UTC	879	OUT	GET /survey/login.do HTTP/1.1 Host: research.law.asia Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: zalb_53aac31ef0=7ef0edc4391d3e61f04f7de9622d671d; JSESSIONID=803EDF164B82960BE4E076A047FB8181; aprmjrnpkcrkks=cd2bf361-1f63-4359-8a22-825c6ff636ba; _zcsr_tmp=cd2bf361-1f63-4359-8a22-825c6ff636ba
2024-09-27 06:13:40 UTC	251	IN	HTTP/1.1 301 Server: ZGS Date: Fri, 27 Sep 2024 06:13:40 GMT Content-Length: 0 Connection: close X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Location: https://www.zoho.com/survey Strict-Transport-Security: max-age=63072000

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://research.law.asia/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Chrome Cache Entry: 252

Chrome Cache Entry: 253

Chrome Cache Entry: 254

Chrome Cache Entry: 255

Chrome Cache Entry: 256

Chrome Cache Entry: 257

Chrome Cache Entry: 258

Chrome Cache Entry: 259

Chrome Cache Entry: 260

Chrome Cache Entry: 261

Chrome Cache Entry: 262

Chrome Cache Entry: 263

Chrome Cache Entry: 264

Windows Analysis Report
https://research.law.asia/

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:41 UTC	661	OUT	GET /survey HTTP/1.1 Host: www.zoho.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 06:13:41 UTC	364	IN	HTTP/1.1 301 Moved Permanently Server: ZGS Date: Fri, 27 Sep 2024 06:13:41 GMT Content-Type: text/html Content-Length: 134 Location: https://www.zoho.com/survey/ Connection: close Expires: Sat, 27 Sep 2025 06:13:41 GMT Cache-Control: max-age=31536000 Cache-Control: no-cache Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=63072000
2024-09-27 06:13:41 UTC	134	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:42 UTC	662	OUT	GET /survey/ HTTP/1.1 Host: www.zoho.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 06:13:43 UTC	525	IN	HTTP/1.1 200 OK Server: ZGS Date: Fri, 27 Sep 2024 06:13:43 GMT Content-Type: text/html Content-Length: 14412 Last-Modified: Wed, 10 Jul 2024 06:28:37 GMT Connection: close Set-Cookie: zip=8.46.123.33\|US\|united_states\|Texas\|houston\|america\|-; Path=/; secure; Expires=Sat, 28-Sep-24 06:13:43 GMT ETag: "668e2a15-384c" Expires: Sat, 27 Sep 2025 06:13:43 GMT Cache-Control: max-age=31536000 Cache-Control: no-cache Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=63072000 Accept-Ranges: bytes
2024-09-27 06:13:43 UTC	14412	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 7a 6f 68 6f 77 65 62 73 74 61 74 69 63 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 7a 6f 68 6f 77 65 62 73 74 61 74 69 63 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link rel="preconnect" href="//www.zohowebstatic.com"><link rel="dns-prefetch" href="//www.zohowebstatic.com"><link rel="preco

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:43 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 06:13:43 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=37951 Date: Fri, 27 Sep 2024 06:13:43 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:43 UTC	585	OUT	GET /zohofonts/zohopuvi/4.0/Zoho_Puvi_Regular.woff2 HTTP/1.1 Host: static.zohocdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.zoho.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.zoho.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 06:13:44 UTC	715	IN	HTTP/1.1 200 Server: ZGS Date: Fri, 27 Sep 2024 06:13:44 GMT Content-Type: font/woff2 Content-Length: 59724 Connection: close X-Content-Type-Options: nosniff Cache-Control: public, max-age=7776000, immutable ETag: "053387ccb6ca9cf02cda61a83f5978a6" Content-Language: en-US Last-Modified: Mon, 22 Nov 2021 15:08:50 GMT Access-Control-Expose-Headers: * Access-Control-Allow-Origin: * Vary: Accept-Encoding strict-transport-security: max-age=15768000 Timing-Allow-Origin: * x-cache: HIT nb-request-id: af9e51f0eb12914ac4dd950c972d255f z-origin-id: ex1-1a6c3d3498954563b758ec40708d8871 Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=63072000 Accept-Ranges: bytes
2024-09-27 06:13:44 UTC	15669	IN	Data Raw: 77 4f 46 32 4f 54 54 4f 00 00 e9 4c 00 0c 00 00 00 01 c6 b0 00 00 e8 f8 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 83 cb 46 1a 81 20 1b 82 de 54 1c b0 2a 06 60 00 89 58 01 36 02 24 03 97 38 04 06 05 8d 08 07 20 5b db c5 71 24 da 86 f7 5a 01 d6 f6 4d ac 5a 06 30 cc 7e b2 0b e2 b6 9d d0 b4 ec 92 ed 18 2c ff 4d 55 55 1f 50 b6 ed 00 6a b9 6d 10 db 2d d2 cf 7e 9c ec ff ff ff f4 a5 22 c3 a5 99 9a b6 db 06 f0 c3 7f 50 bd 57 c8 03 89 ac d1 d2 78 d7 c8 34 31 79 a6 63 68 5e 6a 4d f4 a8 ee 99 81 b9 76 d4 8a c0 ba 8e 51 21 4c c2 08 37 f5 e2 a4 5d d7 5c 56 b7 a1 d1 ab cd 4c d3 b7 4b 62 87 27 1a 72 1b d7 8e 7a 5b ee 0f 1c d1 57 a7 d2 74 ad 7b ee 68 66 b3 ee 83 b9 5f 99 3b 95 30 88 17 ec 05 73 cc e7 67 b5 5f 95 b8 5c 11 76 cd 83 04 2a 13 Data Ascii: wOF2OTTOLF T`X6$8 [q$ZMZ0~,MUUPjm-~"PWx41ych^jMvQ!L7]\VLKb'rz[Wt{hf_;0sg_\v
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: 2f 81 e1 bf 71 78 cc 4b 7c 5a 65 97 27 b7 33 6e 5b 81 c5 02 cc f5 32 7b 49 71 bc cb 55 50 e0 72 c6 5d 76 b1 c5 59 04 f1 e3 5a bb a7 91 71 9a 8e 30 fa 64 aa 22 b5 9b 98 b6 22 33 d7 1f 2d c8 d7 3e 3c e9 98 76 5a 3e 7c fe 8c e3 92 06 ea 2b c8 00 9f 3a 8c b7 a7 66 da 35 b9 0c 5d c2 1d 68 90 c8 e4 9b 74 4e c3 a6 41 c8 c6 a1 f0 9e ea 68 ef ee 5d fa 6d e7 74 dc a0 f7 80 66 c1 25 c8 45 fc 58 56 af bd 77 6c e6 ac c3 f2 fe bc dc c9 c5 1a 88 f3 93 f8 29 bd 4f bb 65 4c e6 be d1 72 f2 a8 d4 7d c9 9a b0 c5 98 e5 71 d1 98 b5 50 76 f1 46 4f f5 41 a7 f9 21 35 7b 7f 0a 7c e4 02 e2 67 49 50 fe 4f 4d e1 04 3f f2 90 68 86 67 7a 7f 8d e8 c9 43 18 58 f7 00 fe ac aa 95 6d 0a 8b 9d 4a 4b ca 82 c7 de 00 73 f8 a5 04 97 8c 43 00 3e 75 3c 0d 83 b5 2f aa 8a e1 e4 5e ad 6f 93 c9 0c 81 Data Ascii: /qxK\|Ze'3n[2{IqUPr]vYZq0d""3-><vZ>\|+:f5]htNAh]mtf%EXVwl)OeLr}qPvFOA!5{\|gIPOM?hgzCXmJKsC>u</^o
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: e2 45 93 0c c2 2e fa 50 70 5e 9e 0a ec c9 5a 8c b3 b3 2a 76 c4 ef 8b d1 4a 76 b2 82 cf b7 65 d5 3a 66 20 d1 7d 5b 9a e9 f7 0d c9 5a c1 d7 c7 54 01 fb 19 1d 6e 03 9e 33 57 e4 0c 8a 86 f3 2f 3c 09 bc c9 e9 70 41 e4 f1 ba 34 51 50 9c 1d 51 03 40 fc 60 d5 b5 9c 92 eb b3 38 e0 24 45 e4 73 8e 21 19 29 d1 a9 c6 02 dd d4 53 5c 34 2e 5a 09 59 f1 36 43 34 f7 1a 20 78 96 c9 3c 3b d7 52 09 4a 11 88 1d da 10 d9 e0 57 6c 97 f1 17 5d 78 94 35 36 0e 00 fb df 5d 3e 97 0e df 1f 16 eb 93 4d 1f 18 42 a5 63 1d 2e cc bd cd 01 d3 30 cd 7e e5 8f 0e 8c ef 2e f9 01 25 d9 84 8b 94 46 ea 9b fe 38 aa 4f ae 27 98 e5 93 c0 09 0e 2a 85 1c e8 22 15 7b 38 d3 ba b4 7d 47 bf b3 06 d0 88 c2 3c ad a7 4c 08 34 64 13 03 17 1a 71 64 80 94 44 29 4a 12 12 20 fb 88 c7 39 70 18 13 66 23 97 3d 5b 24 Data Ascii: E.Pp^ZvJve:f }[ZTn3W/<pA4QPQ@`8$Es!)S\4.ZY6C4 x<;RJWl]x56]>MBc.0~.%F8O'"{8}G<L4dqdD)J 9pf#=[$
2024-09-27 06:13:44 UTC	11287	IN	Data Raw: e4 29 ed 2d 9e 79 9a 45 5a 70 f8 3a 3f 31 c1 e7 c0 8e fd f4 fe 68 d9 10 28 fc 38 d9 47 e3 8c e1 9a f9 d8 b3 a5 b8 d3 e9 86 d9 8d b0 d3 2d eb 2c 88 2a 24 12 89 44 22 b3 6c c9 3c 0a e5 aa 3c 2a db 0e f1 66 af 83 a2 a7 20 81 1f 3d 53 77 65 c9 ba 65 ec de 93 7b 88 5b 25 57 e5 56 76 d5 0f 89 9a 83 ed 15 b3 4c 3f 32 36 27 52 e7 81 00 42 ea cc 2a 7b 5a 08 57 00 bd da 2e 82 5c 2e 2d 38 e6 3b b0 e7 72 db a4 3e 97 13 da ec e7 43 3f f7 91 71 0a a7 31 84 9f e2 af f8 07 fe 85 ff e0 7f fb 95 f3 a3 a9 96 8f 23 fa 22 44 f5 63 8f 21 c4 b1 76 06 b4 0c 2e 9d 82 4d 55 f0 98 ff c8 8b 43 10 db 1c 13 3e 03 8e e2 6b f5 6e e7 72 d0 74 dc ee 39 97 62 4f 97 40 c8 8d 64 65 b2 93 b6 70 ed d5 3a 6c 08 9e d9 26 93 44 d9 cc 5e ae 71 43 f8 ee f9 3e 5a 33 1a ee e9 33 a3 60 69 fc 9b 64 9c Data Ascii: )-yEZp:?1h(8G-,$D"l<<f =Swee{[%WVvL?26'RB*{ZW.\.-8;r>C?q1#"Dc!v.MUC>knrt9bO@dep:l&D^qC>Z33`id

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:43 UTC	582	OUT	GET /zohofonts/zohopuvi/4.0/Zoho_Puvi_Bold.woff2 HTTP/1.1 Host: static.zohocdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.zoho.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.zoho.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 06:13:44 UTC	715	IN	HTTP/1.1 200 Server: ZGS Date: Fri, 27 Sep 2024 06:13:44 GMT Content-Type: font/woff2 Content-Length: 54808 Connection: close X-Content-Type-Options: nosniff Cache-Control: public, max-age=7776000, immutable ETag: "d8c606c6d26a0e7956c919a50e616499" Content-Language: en-US Last-Modified: Mon, 22 Nov 2021 15:08:55 GMT Access-Control-Expose-Headers: * Access-Control-Allow-Origin: * Vary: Accept-Encoding strict-transport-security: max-age=15768000 Timing-Allow-Origin: * x-cache: HIT nb-request-id: 70af389d2aae3809ece847c729e21e33 z-origin-id: ex1-5a8af321e75842e79cee50ec46ef1d62 Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=63072000 Accept-Ranges: bytes
2024-09-27 06:13:44 UTC	15669	IN	Data Raw: 77 4f 46 32 4f 54 54 4f 00 00 d6 18 00 0c 00 00 00 01 6c 64 00 00 d5 c6 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 83 f7 04 1a 81 68 1b fe 26 1c b0 2a 06 60 00 89 58 01 36 02 24 03 97 38 04 06 05 8c 64 07 20 5b 8f 6b 71 26 a4 31 f6 43 c1 6e 60 a5 9b 88 00 fb da bc b1 6a d4 99 b9 c0 9c 03 db 35 cb 6d a3 37 4e 1f 96 98 b7 97 28 b7 3d 12 77 ab 4c ab 10 18 4e f6 ff ff ff a7 27 93 18 db 6d c8 ed b6 e7 11 80 50 d3 b2 6a 00 19 0a 10 99 0a a2 9a 72 ea 6d 26 aa 54 ec bd 0a d7 a5 d6 d6 1a d6 6a 85 ea 6b 8f d6 90 5a b2 d3 6c 89 80 18 22 76 a1 23 13 87 13 1f 6a f6 4c e5 cd 66 66 4e fb 76 98 c5 6d 43 b6 e5 ec 1d 77 3c c6 b3 f9 9f 57 f3 34 81 59 98 f8 42 a6 ec 15 92 cc 9d 90 c2 b9 49 95 58 4d a6 bc f8 2a af 0f a8 6a b3 cd cc 4c ec a8 87 Data Ascii: wOF2OTTOldh&`X6$8d [kq&1Cn`j5m7N(=wLN'mPjrm&TjkZl"v#jLffNvmCw<W4YBIXMjL
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: ac 1e 22 e0 dc f4 21 5b 10 74 ec 1c fc 97 6d da 3e 1d b9 5b fa a5 be ac 56 70 66 ad 2a 29 85 a2 3b 40 b5 4e b7 79 e5 d5 77 df 79 c5 95 7f 99 eb 7f 43 0d f8 4f f0 c7 1f c4 14 52 25 bb 9d 44 a1 34 10 1c dd 64 6c 5f 8e c9 06 3d 52 28 f3 a1 97 4b 21 08 b5 bb bf b8 e5 6d bd 09 61 ba e7 76 1c 64 f4 17 4d b0 79 4e e6 e6 79 f3 57 6f 5c 68 a8 a4 05 2b 7e 39 f0 ba e1 2c 45 cf b2 d3 08 26 4b 61 3e de 9c 14 97 85 17 19 4f 09 d7 bb 31 86 03 87 57 7a 98 2e cd e3 a3 bc f8 3c 20 06 9b 6b 0b f9 4d 62 f5 44 7e 28 73 ec b7 31 97 72 a9 c6 aa 8a 15 f4 da fd 14 d6 cf ea cc 74 1a 4f fe d4 6a 0c 1e ab 21 59 9b 13 c7 4e 58 85 bf b2 a1 ac c7 19 51 62 14 61 15 93 34 f0 93 8e f4 e5 fb 0f c8 51 f4 5b 46 a5 c6 aa 60 0c a7 4d 59 b9 e4 5d 9a 74 49 c8 b5 9f 70 e3 02 2e c8 2e 55 27 fb 13 Data Ascii: "![tm>[Vpf*);@NywyCOR%D4dl_=R(K!mavdMyNyWo\h+~9,E&Ka>O1Wz.< kMbD~(s1rtOj!YNXQba4Q[F`MY]tIp..U'
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: 55 d9 dd 82 95 8e 23 2b 8d b4 74 d1 2c f3 79 74 b6 96 ee d7 27 c8 5b 18 4e fb 3f ff 9a f7 0b 49 08 7b b5 bc 6d 2f 72 8a 92 bb fd 5d 98 03 f0 dd 1d e8 c2 3d 80 cf 7e 7f 67 21 60 7d f3 53 8a ea 71 8f 65 3d 52 7f 20 75 08 07 e3 2a dd 0e 85 3d ae a8 db ab 78 b8 ae 48 ea 11 a5 46 79 b4 73 03 f1 3f 34 fc ce ff cf eb c3 6b 9f 55 93 27 9d f8 4a db f8 3f 8c e3 11 19 62 e8 82 bb 05 6b e2 f6 f1 b7 f3 b1 6e e7 6e 66 6c f1 ba 83 d8 0c 57 69 2b 7e cb 74 7e 56 ea 78 17 c7 fe 9d e5 bb d3 1b 39 b7 77 1e 6f 1e 59 4d 98 dd 6f 8a 3e 1a 72 13 38 05 ff 5a 63 4b 94 ed f8 e1 ff 32 df 62 8c 17 2a f0 d0 6f ba 3f 77 6b e1 b5 e5 53 d9 5e fe bf 9c 2f b1 00 78 50 ee 3e af 33 ba f3 0f 9c d9 f9 0d cb 40 9b bd 7a 94 13 b1 e1 06 58 90 03 70 47 20 89 50 c4 f4 01 0f 41 54 89 d6 87 38 90 36 Data Ascii: U#+t,yt'[N?I{m/r]=~g!`}Sqe=R u=xHFys?4kU'J?bknnflWi+~t~Vx9woYMo>r8ZcK2bo?wkS^/xP>3@zXpG PAT86
2024-09-27 06:13:44 UTC	6371	IN	Data Raw: 6c a5 a6 8c 72 2a a8 b4 ea e5 28 95 d5 58 83 e7 5e 86 e7 95 0b 47 eb bb 91 7a db cf db 95 b9 e5 d8 7a ba bd 91 7e 8a 0d ec de 1f b4 6d 43 18 1b 66 b5 11 a0 7d cb 62 63 c0 1b b7 0c 28 af bf ea 31 9a ba 30 30 b1 b4 31 57 37 9f 16 46 8a 96 a0 5c 55 13 57 b3 6e 9b bb d2 72 78 ed fd eb 8e 67 d6 15 36 f1 f6 a6 2e 6c 16 7d 6e f0 16 66 6f f9 32 fa d6 e8 ed ed de c1 1e df 26 4f c3 5c ef 79 dd e7 c5 2f 36 e1 db e7 e6 c2 5e cc ff 85 38 c8 fd 58 3c ae 87 7b 20 dd 86 8e e6 2f 1e ad bf 74 8a 77 e5 fc ff 45 e1 5b 39 ee 51 44 6c 7e 3c a8 0f 00 1a 27 28 60 f1 06 e7 e8 e1 31 81 77 24 15 d5 7b cc 49 cf 45 1a bd c8 35 6a 37 a8 13 00 b8 08 d0 00 da a3 31 2d 70 0a 51 c2 06 4a 4c 30 ff ca 4c 35 36 0b 0c b0 07 0a 62 75 4f 4d 18 24 35 95 77 f9 48 df e5 1a b5 3f 12 64 32 ef 92 f9 Data Ascii: lr*(X^Gzz~mCf}bc(1001W7F\UWnrxg6.l}nfo2&O\y/6^8X<{ /twE[9QDl~<'(`1w${IE5j71-pQJL0L56buOM$5wH?d2

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:43 UTC	586	OUT	GET /zohofonts/zohopuvi/4.0/Zoho_Puvi_Semibold.woff2 HTTP/1.1 Host: static.zohocdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.zoho.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.zoho.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 06:13:44 UTC	715	IN	HTTP/1.1 200 Server: ZGS Date: Fri, 27 Sep 2024 06:13:44 GMT Content-Type: font/woff2 Content-Length: 49928 Connection: close X-Content-Type-Options: nosniff Cache-Control: public, max-age=7776000, immutable ETag: "90eb520d38b05ea02ef7faff5fc32d52" Content-Language: en-US Last-Modified: Mon, 22 Nov 2021 15:08:52 GMT Access-Control-Expose-Headers: * Access-Control-Allow-Origin: * Vary: Accept-Encoding strict-transport-security: max-age=15768000 Timing-Allow-Origin: * x-cache: HIT nb-request-id: 190d4bfc55853d7cd0af09e509d9ad76 z-origin-id: ex1-2fbe0eaeb2f34ad892dd88ebcfb99a26 Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=63072000 Accept-Ranges: bytes
2024-09-27 06:13:44 UTC	15669	IN	Data Raw: 77 4f 46 32 4f 54 54 4f 00 00 c3 08 00 0c 00 00 00 01 43 a8 00 00 c2 b6 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 83 c8 6a 1a 81 68 1b da 06 1c b0 2a 06 60 00 89 58 01 36 02 24 03 97 38 04 06 05 8d 5d 07 20 5b ce 42 91 43 a4 32 76 5f 98 4a d2 c1 10 d5 6d 08 f0 4a 75 56 53 7b ac 1a e6 59 e3 a0 3b 61 ab 96 92 2e 2f 50 23 3b 9f 21 77 2b 91 9c 91 e0 ce fe ff ff ff ff 17 24 13 19 b3 4b c0 4b 92 16 0a 00 88 3a 9d 3f 7d 41 2a 46 a3 f4 08 27 c8 74 2b 22 2a 22 72 18 4b 9b 0a 26 8b 19 63 22 95 65 f5 79 93 cb de da 48 4e c7 9a 81 1c bc e5 70 dd cb 89 5b a2 29 56 fd ae cc ee 9a 99 61 43 c2 e7 a5 61 34 2c 78 a8 f5 9a 6b 45 11 25 62 78 4c 22 13 b5 59 45 a4 69 f6 63 9a b9 75 fd 79 e2 fa 94 eb d8 26 bb 63 4c b7 b0 1b 5a 7a c5 66 e7 9e 39 Data Ascii: wOF2OTTOCjh`X6$8] [BC2v_JmJuVS{Y;a./P#;!w+$KK:?}AF't+"*"rK&c"eyHNp[)VaCa4,xkE%bxL"YEicuy&cLZzf9
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: 3e 0b ef af f1 c2 70 b5 96 3a dc fe d8 fe 09 41 6b c4 ac 17 2b 37 e8 0f 3d c1 d7 b7 59 f2 99 2c 90 fa 73 b4 dd 30 2a 48 75 ad 75 da 20 bb c6 06 ad 23 64 d8 6e f3 ec 1d fa 70 d8 02 c0 0c d9 cb 2e 3a ca 51 24 a7 fa ce 80 48 67 ea 82 29 92 1a 04 80 9f fb a5 ed b4 d7 c6 09 68 4d a9 d0 6d 3f 1c 00 9f 75 bf e2 d9 48 c9 c3 99 a0 a6 f9 a6 a1 31 7f 6f e7 ee 7d 9b 4b 3b 6a fd 02 a8 cc f0 11 2d 1f ef 4b f5 c6 f6 31 ea cf c5 a9 b3 26 9d 36 9c 3c 18 0e 7e 30 60 06 68 06 eb 9d 14 19 92 07 5a 45 bb e7 f6 e4 d1 13 87 5b cd 79 9b 7b af 38 21 d7 8b 40 81 04 bc a2 37 0d 46 c8 0a c1 45 0a 1c 2c 74 41 83 5e b1 ef a8 96 fd e6 26 83 dd d2 ba ba b0 b0 b6 c4 af 89 13 87 8a 7b 48 e1 f8 03 5d 9a dc 5d da 7f 26 2a 3b da b8 da 5a 10 4f ef ff 51 f3 92 8e f5 ee 2f cf b8 34 f2 b8 db 79 Data Ascii: >p:Ak+7=Y,s0Huu #dnp.:Q$Hg)hMm?uH1o}K;j-K1&6<~0`hZE[y{8!@7FE,tA^&{H]]&;ZOQ/4y
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: 85 22 2f ad e2 8f 5c 89 82 c4 a0 2f f7 50 18 b8 50 73 3e f5 e5 60 ba ff c3 55 18 86 0b d8 64 a0 90 2d 28 d0 36 ea 18 e4 fb 0b ac 70 9f b6 ec 1a 70 a3 f5 92 4b 22 5c 61 38 05 cf c7 72 de b8 96 9b 89 6e a6 c6 15 d7 76 55 6b 3a 81 a7 88 1f 65 bb 7e 36 57 76 6d 2b fe 26 b5 ea 1d 61 90 11 dc a4 e8 6e 7b fc 18 62 51 e7 44 c2 8f bf 71 6c 7a ab 33 89 3b 53 13 97 fb f4 f7 16 03 3c 41 17 27 70 90 28 7b bb 48 e0 5b 49 1f ea b5 70 0d 3f 46 e0 b9 94 5a 17 7e e6 5b d6 de 95 23 52 42 75 6a 9b 0c d0 af b8 50 4a ad 23 bf d4 b7 c4 84 2d 16 79 eb f9 80 88 c6 2f 22 38 aa a5 7d cc 82 51 44 6f 96 df af 27 b8 96 df 79 9d 40 46 64 a3 e4 7c 3a a4 8c 9a 0a 40 1d 41 77 8e 15 7f a2 de 41 e6 a9 c6 97 88 07 86 da a8 c0 ab 68 4e 00 52 f4 54 1e 52 2f bc e8 b1 d6 c3 79 8c 3f 34 91 10 a7 Data Ascii: "/\/PPs>`Ud-(6ppK"\a8rnvUk:e~6Wvm+&an{bQDqlz3;S<A'p({H[Ip?FZ~[#RBujPJ#-y/"8}QDo'y@Fd\|:@AwAhNRTR/y?4
2024-09-27 06:13:44 UTC	1491	IN	Data Raw: c5 d6 bd b7 5c 6e 1f 5b 79 51 6e a9 2d dc 65 33 cd 96 84 cc 38 bf ef 8e f2 ff 25 49 aa 4c 38 ff 54 f6 54 7a 54 b6 54 3a 22 3e f4 39 bc 8b e8 04 80 b9 48 62 0f d5 5c 10 51 47 d0 1d 14 8d b6 05 f7 69 73 8f 57 1e c8 bf cb 64 e6 b4 7e 05 a0 be 66 74 f9 d1 ae 5b 60 70 aa a8 da 2b a5 7d 24 6c 26 e9 e4 6a 67 68 6b c5 7e 1c a9 3f e9 54 77 aa c1 4d 9d 5b e0 64 67 7e 33 af a3 aa 6e a2 d6 28 46 07 f9 21 b6 70 1b 9b aa e6 29 99 15 03 79 47 7b 1a 63 ea 09 7d 9f ff 51 a6 69 85 4a 05 a0 e6 4d 4f eb 55 30 2f 79 a4 b3 78 40 44 b5 43 f4 35 4c f1 d5 c6 7e 86 ab 9f 58 4d 7f 36 f8 fe 11 4a f1 69 03 3f 0b e4 27 98 43 e6 89 c9 1f f1 89 a7 dc 16 ca dc 60 96 83 12 d7 9b 19 91 d2 e5 6d 4b fb 9a 4c f5 59 ad 5f 25 c6 1e 71 6d bf 48 cc 05 ca 5a d8 14 95 c4 7d af 6f e6 18 74 e9 d2 33 Data Ascii: \n[yQn-e38%IL8TTzTT:">9Hb\QGisWd~ft[`p+}$l&jghk~?TwM[dg~3n(F!p)yG{c}QiJMOU0/yx@DC5L~XM6Ji?'C`mKLY_%qmHZ}ot3

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:43 UTC	567	OUT	GET /sites/zweb/css/common/zohocustom.css HTTP/1.1 Host: www.zohowebstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.zoho.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 06:13:44 UTC	604	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 126100 Connection: close Server: ZGS Last-Modified: Wed, 25 Sep 2024 06:51:31 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=63072000 Accept-Ranges: bytes Date: Fri, 27 Sep 2024 06:13:44 GMT Expires: Fri, 04 Oct 2024 06:13:44 GMT Cache-Control: max-age=604800 Cache-Control: no-cache ETag: "66f3b2f3-1ec94" X-Cache: RefreshHit from cloudfront Via: 1.1 6f4aa26c09fb9bb4d152519f44256a4c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P7 X-Amz-Cf-Id: dRSGwfqlUMXGp2YpW5ZIUHbZ7NJ6TTsy6TtjgNbpcdNJqFDCDLmm1Q==
2024-09-27 06:13:44 UTC	15780	IN	Data Raw: 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 2f 2f 77 77 77 2e 7a 6f 68 6f 77 65 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 7a 77 65 62 2f 63 73 73 2f 63 6f 6d 6d 6f 6e 2f 7a 63 2d 68 65 61 64 65 72 66 6f 6f 74 65 72 2d 76 32 2e 63 73 73 22 29 3b 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 2f 2f 77 77 77 2e 7a 6f 68 6f 77 65 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 7a 77 65 62 2f 63 73 73 2f 63 6f 6d 6d 6f 6e 2f 7a 63 2d 66 6f 6f 74 65 72 2d 76 31 2e 63 73 73 22 29 3b 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 2f 2f 77 77 77 2e 7a 6f 68 6f 77 65 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 7a 77 65 62 2f 63 73 73 2f 63 6f 6d 6d 6f 6e 2f 7a 63 2d 66 6f 6f 74 65 72 2e 63 73 73 22 29 3b 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 Data Ascii: @import url("//www.zohowebstatic.com/sites/zweb/css/common/zc-headerfooter-v2.css");@import url("//www.zohowebstatic.com/sites/zweb/css/common/zc-footer-v1.css");@import url("//www.zohowebstatic.com/sites/zweb/css/common/zc-footer.css");@font-face{font-fa
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: 6d 61 74 28 22 74 72 75 65 74 79 70 65 22 29 2c 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 7a 6f 68 6f 63 64 6e 2e 63 6f 6d 2f 77 65 62 66 6f 6e 74 73 2f 72 6f 62 6f 74 6f 6c 69 67 68 74 2f 66 6f 6e 74 2e 73 76 67 23 52 6f 62 6f 74 6f 2d 4c 69 67 68 74 29 20 66 6f 72 6d 61 74 28 22 73 76 67 22 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 73 77 61 70 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 52 6f 62 6f 74 6f 22 3b 73 72 63 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 7a 6f 68 6f 63 64 6e 2e 63 6f 6d 2f 77 65 62 66 6f 6e 74 73 2f 72 6f 62 6f 74 6f 6c 69 67 68 74 69 74 61 6c 69 63 2f 66 6f 6e 74 Data Ascii: mat("truetype"),url(https://static.zohocdn.com/webfonts/robotolight/font.svg#Roboto-Light) format("svg");font-weight:300;font-style:normal;font-display:swap}@font-face{font-family:"Roboto";src:url(https://static.zohocdn.com/webfonts/robotolightitalic/font
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: 63 6f 6d 2f 73 69 74 65 73 2f 7a 77 65 62 2f 69 6d 61 67 65 73 2f 70 72 6f 64 75 63 74 6c 6f 67 6f 73 2f 6c 61 6e 64 69 6e 67 70 61 67 65 2e 73 76 67 29 3b 2d 2d 7a 70 2d 6c 65 61 72 6e 3a 75 72 6c 28 2f 2f 77 77 77 2e 7a 6f 68 6f 77 65 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 7a 77 65 62 2f 69 6d 61 67 65 73 2f 70 72 6f 64 75 63 74 6c 6f 67 6f 73 2f 6c 65 61 72 6e 2e 73 76 67 29 3b 2d 2d 7a 70 2d 6c 65 6e 73 3a 75 72 6c 28 2f 2f 77 77 77 2e 7a 6f 68 6f 77 65 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 7a 77 65 62 2f 69 6d 61 67 65 73 2f 70 72 6f 64 75 63 74 6c 6f 67 6f 73 2f 6c 65 6e 73 2e 73 76 67 29 3b 2d 2d 7a 70 2d 6c 6f 67 73 3a 75 72 6c 28 2f 2f 77 77 77 2e 7a 6f 68 6f 77 65 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 Data Ascii: com/sites/zweb/images/productlogos/landingpage.svg);--zp-learn:url(//www.zohowebstatic.com/sites/zweb/images/productlogos/learn.svg);--zp-lens:url(//www.zohowebstatic.com/sites/zweb/images/productlogos/lens.svg);--zp-logs:url(//www.zohowebstatic.com/sites
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: 64 20 2e 7a 68 2d 61 63 63 65 73 73 2e 7a 68 2d 62 74 6e 2c 2e 72 65 67 69 6f 6e 2d 73 61 6e 63 74 69 6f 6e 65 64 20 2e 7a 68 2d 73 69 67 6e 2e 7a 68 2d 62 74 6e 2c 2e 72 65 67 69 6f 6e 2d 73 61 6e 63 74 69 6f 6e 65 64 20 2e 7a 68 2d 68 6f 6d 65 2d 62 74 6e 2c 2e 72 65 67 69 6f 6e 2d 73 61 6e 63 74 69 6f 6e 65 64 2e 7a 68 2d 6d 61 69 6e 20 2e 62 61 6e 6e 65 72 2d 70 72 6f 64 75 63 74 73 20 2e 6c 65 61 72 6e 4d 6f 72 65 62 74 6e 2c 2e 72 65 67 69 6f 6e 2d 73 61 6e 63 74 69 6f 6e 65 64 20 61 2e 6c 6f 67 67 65 64 6f 75 74 2c 2e 72 65 67 69 6f 6e 2d 73 61 6e 63 74 69 6f 6e 65 64 20 61 2e 6c 6f 67 67 65 64 69 6e 2c 2e 72 65 67 69 6f 6e 2d 73 61 6e 63 74 69 6f 6e 65 64 20 2e 61 63 74 2d 62 74 6e 2e 63 74 61 2d 62 74 6e 2c 2e 72 65 67 69 6f 6e 2d 73 61 6e 63 74 Data Ascii: d .zh-access.zh-btn,.region-sanctioned .zh-sign.zh-btn,.region-sanctioned .zh-home-btn,.region-sanctioned.zh-main .banner-products .learnMorebtn,.region-sanctioned a.loggedout,.region-sanctioned a.loggedin,.region-sanctioned .act-btn.cta-btn,.region-sanct
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: 74 6f 6d 3a 30 3b 72 69 67 68 74 3a 31 30 70 78 7d 2e 73 6c 69 63 6b 2d 70 72 65 76 3a 62 65 66 6f 72 65 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 34 35 64 65 67 29 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 31 30 70 78 7d 2e 73 6c 69 63 6b 2d 70 72 65 76 3a 61 66 74 65 72 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 33 35 64 65 67 29 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 31 30 70 78 7d 2e 73 6c 69 63 6b 2d 6e 65 78 74 2e 73 6c 69 63 6b 2d 64 69 73 61 62 6c 65 64 2c 2e 73 6c 69 63 6b 2d 70 72 65 76 2e 73 6c 69 63 6b 2d 64 69 73 61 62 6c 65 64 7b 6f 70 61 63 69 74 79 3a 2e 32 35 7d 2e 73 6c 69 63 6b 2d 70 72 65 76 7b 6c 65 66 74 3a 30 7d 2e 73 6c 69 63 6b 2d 6e 65 78 74 7b 72 69 67 68 74 3a 30 7d 2e 73 6c 69 63 6b 2d 64 6f 74 74 65 Data Ascii: tom:0;right:10px}.slick-prev:before{transform:rotate(45deg);top:0;left:10px}.slick-prev:after{transform:rotate(135deg);bottom:0;left:10px}.slick-next.slick-disabled,.slick-prev.slick-disabled{opacity:.25}.slick-prev{left:0}.slick-next{right:0}.slick-dotte
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: 2d 69 6e 70 75 74 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 7d 2e 73 69 67 6e 75 70 2d 62 6f 78 20 2e 74 77 6f 2d 63 6f 6c 2d 69 6e 70 75 74 20 2e 73 67 66 72 6d 7b 77 69 64 74 68 3a 35 30 25 7d 2e 73 69 67 6e 75 70 2d 62 6f 78 20 2e 74 77 6f 2d 63 6f 6c 2d 69 6e 70 75 74 20 2e 73 67 66 72 6d 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 31 30 70 78 7d 2e 73 69 67 6e 75 70 2d 62 6f 78 20 2e 66 69 65 6c 64 2d 65 72 72 6f 72 20 2e 66 69 65 6c 64 2d 6d 73 67 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 67 6e 75 70 2d 62 6f 78 20 2e 73 69 67 6e 5f 61 67 72 65 65 2e 66 69 65 6c 64 2d 65 72 72 6f 72 7b 6d 61 72 67 69 6e 2d 62 6f Data Ascii: -input{display:flex;flex-wrap:wrap}.signup-box .two-col-input .sgfrm{width:50%}.signup-box .two-col-input .sgfrm:first-child{padding-right:10px}.signup-box .field-error .field-msg{display:block;text-align:left}.signup-box .sign_agree.field-error{margin-bo
2024-09-27 06:13:44 UTC	16384	IN	Data Raw: 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 31 35 38 39 70 78 20 2d 37 31 70 78 7d 2e 7a 61 2d 70 61 73 73 77 6f 72 64 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 67 65 6e 74 65 78 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 7a 61 2d 70 61 73 73 77 6f 72 64 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 67 65 6e 74 65 78 74 20 61 7b 63 6f 6c 6f 72 3a 23 33 39 34 32 66 66 7d 2e 7a 61 2d 70 61 73 73 77 6f 72 64 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 67 65 6e 74 65 78 74 20 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 7a 61 2d 70 61 73 73 77 6f Data Ascii: fore{background-position:-1589px -71px}.za-password-container .gentext{font-size:11px;line-height:1.5;display:none;margin-top:10px}.za-password-container .gentext a{color:#3942ff}.za-password-container .gentext a:hover{text-decoration:underline}.za-passwo
2024-09-27 06:13:44 UTC	12016	IN	Data Raw: 6c 69 20 61 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 6d 65 6e 75 20 2e 65 78 70 61 6e 64 65 64 2e 61 63 74 69 76 65 20 2e 73 75 62 2d 64 72 6f 70 64 6f 77 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 37 66 37 66 37 7d 2e 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 20 2e 73 75 62 2d 64 72 6f 70 64 6f 77 6e 7b 70 6f 73 69 74 69 6f 6e 3a 73 74 61 74 69 63 3b 6f 70 61 63 69 74 79 3a 31 3b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 70 61 64 64 69 6e 67 3a 30 20 30 20 30 20 33 30 70 78 3b 6d 61 72 67 69 6e 3a 30 7d 2e 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 3e 2e 73 75 62 2d 6c 65 76 65 6c 3e 61 7b 70 61 64 64 Data Ascii: li a{display:block}.menu .expanded.active .sub-dropdown{background:#f7f7f7}.dropdown-menu .sub-dropdown{position:static;opacity:1;visibility:visible;box-shadow:none;border-left:0;border-radius:0;padding:0 0 0 30px;margin:0}.dropdown-menu>.sub-level>a{padd

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:43 UTC	564	OUT	GET /sites/zweb/css/product/survey.css HTTP/1.1 Host: www.zohowebstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.zoho.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 06:13:44 UTC	596	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 12858 Connection: close Server: ZGS Date: Fri, 27 Sep 2024 06:13:44 GMT Last-Modified: Thu, 09 Nov 2023 08:25:32 GMT ETag: "654c977c-323a" Expires: Fri, 04 Oct 2024 06:13:44 GMT Cache-Control: max-age=604800 Access-Control-Allow-Origin: * Cache-Control: no-cache Strict-Transport-Security: max-age=63072000 Accept-Ranges: bytes X-Cache: Miss from cloudfront Via: 1.1 f14a77f80eb66aa455bd94a07a2a0c64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P7 X-Amz-Cf-Id: LZNvbDx-DMq3J9ntFAsOjRMKd1_a5pmC3_Wq9_rXzmjmnugcNsKPlA==
2024-09-27 06:13:44 UTC	12858	IN	Data Raw: 2e 69 73 69 70 68 6f 6e 65 20 2e 7a 6c 6f 67 69 6e 2d 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 62 61 6e 6e 65 72 2d 69 6c 6c 75 73 20 2e 72 6d 6f 62 69 6c 65 64 69 73 61 62 6c 65 64 20 23 72 6d 6f 62 69 6c 65 7b 6d 61 78 2d 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 38 35 70 78 29 3b 6c 65 66 74 3a 38 35 70 78 7d 2e 73 69 67 6e 75 70 2d 66 6f 72 6d 20 2e 6c 6f 67 67 65 64 69 6e 2d 75 73 65 72 69 6e 66 6f 20 61 2e 61 63 63 65 73 73 2d 61 70 70 73 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 7a 66 2d 70 72 69 6d 61 72 79 2d 73 65 6d 69 62 6f 6c 64 29 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 33 33 33 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 Data Ascii: .isiphone .zlogin-menu{display:none}.banner-illus .rmobiledisabled #rmobile{max-width:calc(100% - 85px);left:85px}.signup-form .loggedin-userinfo a.access-apps{display:inline-block;font-family:var(--zf-primary-semibold);margin:0;color:#333;border:1px soli

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:43 UTC	573	OUT	GET /sites/zweb/css/translation/survey/2870.css HTTP/1.1 Host: www.zohowebstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.zoho.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 06:13:44 UTC	596	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 16222 Connection: close Server: ZGS Date: Fri, 27 Sep 2024 06:13:44 GMT Last-Modified: Wed, 22 May 2024 06:29:21 GMT ETag: "664d90c1-3f5e" Expires: Fri, 04 Oct 2024 06:13:44 GMT Cache-Control: max-age=604800 Access-Control-Allow-Origin: * Cache-Control: no-cache Strict-Transport-Security: max-age=63072000 Accept-Ranges: bytes X-Cache: Miss from cloudfront Via: 1.1 6dcc6937cfa978a65f9d5d75296b24a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P7 X-Amz-Cf-Id: Qw0odC0FtKWIzyQmVlqcy_PxFN4xPsmr5lnjZLFn4M92Oh2XEO-78w==
2024-09-27 06:13:44 UTC	15788	IN	Data Raw: 73 70 61 6e 2e 7a 6f 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 27 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 66 20 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 7a 6f 68 6f 77 65 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 7a 77 65 62 2f 69 6d 61 67 65 73 2f 73 75 72 76 65 79 2f 74 65 6e 2d 79 65 61 72 73 2f 73 75 72 76 65 79 2d 63 65 6c 65 62 72 61 74 65 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 32 35 70 78 3b 74 6f 70 3a 2d 35 70 78 3b 6c 65 66 74 3a 2d 33 30 70 78 3b 77 69 64 74 68 3a 35 30 70 78 3b 68 65 69 67 68 74 3a 35 30 70 78 7d 73 70 61 6e 2e 7a 6f 6e 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 31 38 6e 2d 61 72 20 Data Ascii: span.zone:before{content:'';position:absolute;f background:url(//www.zohowebstatic.com/sites/zweb/images/survey/ten-years/survey-celebrate.png) no-repeat;background-size:25px;top:-5px;left:-30px;width:50px;height:50px}span.zone{position:relative}.i18n-ar
2024-09-27 06:13:44 UTC	434	IN	Data Raw: 25 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6c 6f 61 74 3a 6e 6f 6e 65 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 74 72 75 73 74 2d 62 72 61 6e 64 73 2d 77 72 61 70 20 75 6c 20 6c 69 20 73 70 61 6e 7b 6d 61 72 67 69 6e 3a 38 70 78 20 31 38 70 78 7d 2e 7a 2d 74 65 73 74 69 6d 6f 6e 69 61 6c 2d 73 6c 69 64 65 2d 77 72 61 70 20 2e 63 6f 6e 74 65 6e 74 2d 77 72 61 70 7b 70 61 64 64 69 6e 67 3a 38 30 70 78 20 30 20 31 30 70 78 7d 7d 2e 69 31 38 6e 2d 61 72 20 2e 7a 70 2d 68 69 67 68 6c 69 67 68 74 65 64 2d 66 65 61 74 75 72 65 73 2d 77 72 61 70 20 68 32 2c 2e 69 31 38 6e 2d 61 72 20 2e 7a 70 2d 68 69 67 68 6c 69 67 68 74 65 64 2d 66 65 61 74 75 72 65 73 2d 77 72 61 70 20 2e 63 6f 6e 74 65 6e 74 2d 77 72 61 70 20 68 32 2b 70 Data Ascii: %;display:inline-block;float:none;max-width:100%}.trust-brands-wrap ul li span{margin:8px 18px}.z-testimonial-slide-wrap .content-wrap{padding:80px 0 10px}}.i18n-ar .zp-highlighted-features-wrap h2,.i18n-ar .zp-highlighted-features-wrap .content-wrap h2+p

Timestamp	Bytes transferred	Direction	Data
2024-09-27 06:13:43 UTC	549	OUT	GET /sites/zweb/js/common/var_init.js HTTP/1.1 Host: www.zohowebstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.zoho.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 06:13:44 UTC	615	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 4654 Connection: close Server: ZGS Last-Modified: Thu, 23 May 2024 10:00:00 GMT Accept-Ranges: bytes Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=63072000 Date: Fri, 27 Sep 2024 06:13:44 GMT Expires: Fri, 04 Oct 2024 06:13:44 GMT Cache-Control: max-age=604800 Cache-Control: no-cache ETag: "664f13a0-122e" X-Cache: RefreshHit from cloudfront Via: 1.1 1903071a927324e2fb28199ee96c4bb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P7 X-Amz-Cf-Id: ZOz4-qali0E_k9z0FIt9_lzaf2Ct4NfdQOHrWX9_RepfEWQbxm9Zog==
2024-09-27 06:13:44 UTC	4654	IN	Data Raw: 76 61 72 20 5f 6c 68 72 65 66 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 43 75 72 72 65 6e 74 64 61 74 65 3d 6e 65 77 20 44 61 74 65 28 29 3b 43 75 72 72 65 6e 74 64 61 74 65 2e 73 65 74 54 69 6d 65 28 43 75 72 72 65 6e 74 64 61 74 65 2e 67 65 74 54 69 6d 65 28 29 2b 28 31 38 30 2a 32 34 2a 36 30 2a 36 30 2a 31 30 30 30 29 29 3b 76 61 72 20 63 68 65 63 6b 75 72 6c 3d 28 5f 6c 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 22 27 22 29 3e 2d 31 7c 7c 5f 6c 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 22 3c 22 29 3e 2d 31 7c 7c 5f 6c 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 22 3e 22 29 3e 2d 31 7c 7c 5f 6c 68 72 65 66 2e 69 6e 64 65 78 4f 66 28 27 22 27 29 3e 2d 31 29 3b 69 66 28 63 68 65 63 6b 75 72 6c 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f Data Ascii: var _lhref=window.location.href;Currentdate=new Date();Currentdate.setTime(Currentdate.getTime()+(1802460601000));var checkurl=(_lhref.indexOf("'")>-1\|\|_lhref.indexOf("<")>-1\|\|_lhref.indexOf(">")>-1\|\|_lhref.indexOf('"')>-1);if(checkurl){window.locatio