Windows Analysis Report
https://equipstudy.net/iwxaj

Overview

General Information

Sample URL:	https://equipstudy.net/iwxaj
Analysis ID:	1431458
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /iwxaj HTTP/1.1Host: equipstudy.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5 HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/bootstrap/css/bootstrap.min.css HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/bootstrap/font-awesome-4.2.0/css/font-awesome.css HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/css/global.css HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/css/textobj.css HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/js/formvalidation/formValidation.css HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/js/jquery/jquery-1.9.1.js HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/js/jquery/jquery-ui-1.11.4.min.js HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/bootstrap/js/bootstrap.min.js HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/assets/header_bgr.jpg HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/assets/fonts/museo-slab-500italic.woff2 HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://surveys.equip-surveys.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://surveys.equip-surveys.com/fieldlinknavi/css/global.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/assets/fonts/museosans-300-webfont.woff2 HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://surveys.equip-surveys.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://surveys.equip-surveys.com/fieldlinknavi/css/global.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/assets/header_bgr.jpg HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: equipstudy.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: surveys.equip-surveys.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Apr 2024 06:01:02 GMTServer: Apache/2.4.56 (Debian)Content-Length: 273Content-Type: text/html; charset=iso-8859-1Connection: close

Source: chromecache_58.2.dr	String found in binary or memory: http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_58.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12282#comment:15
Source: chromecache_58.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12359
Source: chromecache_58.2.dr	String found in binary or memory: http://dev.w3.org/csswg/cssom/#resolved-values
Source: chromecache_58.2.dr	String found in binary or memory: http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291
Source: chromecache_58.2.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chromecache_61.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_61.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_63.2.dr	String found in binary or memory: http://formvalidation.io)
Source: chromecache_63.2.dr	String found in binary or memory: http://formvalidation.io/license/
Source: chromecache_51.2.dr, chromecache_62.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_58.2.dr	String found in binary or memory: http://helpful.knobs-dials.com/index.php/Component_returned_failure_code:_0x80040111_(NS_ERROR_NOT_A
Source: chromecache_57.2.dr	String found in binary or memory: http://html5shim.googlecode.com/svn/trunk/html5.js
Source: chromecache_58.2.dr	String found in binary or memory: http://javascript.nwbox.com/IEContentLoaded/
Source: chromecache_58.2.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_58.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_54.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_58.2.dr	String found in binary or memory: http://json.org/json2.js
Source: chromecache_58.2.dr	String found in binary or memory: http://jsperf.com/getall-vs-sizzle/2
Source: chromecache_58.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_58.2.dr	String found in binary or memory: http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context
Source: chromecache_58.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_58.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
Source: chromecache_58.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
Source: chromecache_58.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_58.2.dr	String found in binary or memory: https://developer.mozilla.org/en/Security/CSP)
Source: chromecache_58.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/764
Source: chromecache_51.2.dr, chromecache_62.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_57.2.dr	String found in binary or memory: https://surveys.equip-surveys.com/8011ed467fc88baf8e08cf29c20cc9a9
Source: chromecache_63.2.dr	String found in binary or memory: https://twitter.com/formvalidation

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@17/29@8/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2280,i,7619782800502618050,10566268962405110305,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://equipstudy.net/iwxaj"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2280,i,7619782800502618050,10566268962405110305,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
212.6.184.245	surveys.equip-surveys.com	Germany	8426	CLARANET-ASClaraNETLTDGB	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.215.104	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.5

Contacted Domains

Name	IP	Active
surveys.equip-surveys.com	212.6.184.245	true
equipstudy.net	212.6.184.245	true
bg.microsoft.map.fastly.net	199.232.214.172	true
www.google.com	172.217.215.104	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true

Contacted URLs

Name	Malicious	Reputation
https://surveys.equip-surveys.com/fieldlinknavi/bootstrap/font-awesome-4.2.0/css/font-awesome.css	false	high
https://surveys.equip-surveys.com/favicon.ico	false	high
https://equipstudy.net/iwxaj	false	unknown
https://surveys.equip-surveys.com/fieldlinknavi/assets/header_bgr.jpg	false	high
https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5	false	high
https://surveys.equip-surveys.com/fieldlinknavi/css/global.css	false	high
https://surveys.equip-surveys.com/fieldlinknavi/js/formvalidation/formValidation.css	false	high
https://surveys.equip-surveys.com/fieldlinknavi/bootstrap/js/bootstrap.min.js	false	high
https://surveys.equip-surveys.com/fieldlinknavi/bootstrap/css/bootstrap.min.css	false	high
https://surveys.equip-surveys.com/fieldlinknavi/assets/fonts/museo-slab-500italic.woff2	false	high
https://surveys.equip-surveys.com/fieldlinknavi/js/jquery/jquery-1.9.1.js	false	high
https://surveys.equip-surveys.com/fieldlinknavi/assets/fonts/museosans-300-webfont.woff2	false	high
https://surveys.equip-surveys.com/fieldlinknavi/css/textobj.css	false	high
https://surveys.equip-surveys.com/fieldlinknavi/js/jquery/jquery-ui-1.11.4.min.js	false	high

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 50	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x50, components 3	88E49E7ADD86227BDDD3AE9489DFCC35	F6D897B0898665A9B1925426AE5B05ABAA22E7F4	6FF32D94670676D2FB91745663B67E83A7AC1B7F452EB33397AF1B80CFB30DFA
Chrome Cache Entry: 51	ASCII text, with very long lines (65367), with CRLF line terminators	3CC6CD53F8219E9DE64DDB055F78C7BF	ED523F650925AA655F7BBE82871D7D189502F2F9	29A15CE48CEC440F2745DA88F96E6E59174CAB6127D9F26E981BDA384B8676A0
Chrome Cache Entry: 52	HTML document, ASCII text	40A496BB78869177D51B9A6CAD8177A4	A4C1F3A3F98C623D3D5CE5ED1B9E8B53E8422760	CF390C2ACA4DB9D9670E0AC8EBB880074C67B613F54135736CAC3741B58A0DA7
Chrome Cache Entry: 53	ASCII text, with no line terminators	EF030DE9918635BE108D3FE853274E3A	D3211539FC94293988D893F1FF99EF99A48C6FB9	1CA9A44B45101EA8E33C0B29C3527736BC664745FA7A5C00E762CB6548BEC2AE
Chrome Cache Entry: 54	ASCII text, with very long lines (32035), with CRLF line terminators	6A8D2AD2B8A68C521FA71D81DFEA6142	73F6A5F546E8EC56EC6CBBF4A37749D165D04B66	C4D069BEFFF8B641042BAF92C240F4915D376E80F70A5D1B24D1F3182A6CB443
Chrome Cache Entry: 55	Web Open Font Format (Version 2), CFF, length 25444, version 1.0	F69AB53411DED3AEA35EA26774C77B99	365C576EDFE0B8AB90AA95F5AFC797E341FA02DF	B840A83BCD35C1AA4096EA24FF72B90BFC9EDBF82C300A78FE6289AC9A498402
Chrome Cache Entry: 56	Unicode text, UTF-8 (with BOM) text, with very long lines (416), with CRLF line terminators	A7FF23D74FB4F7866EC44E20B645F22D	A3F79761CEFC9EEB1AAC2F5252896123DD32AB47	7DE69205D53F2261EC9833E3736D9781C8B9473B9A64629F2EB611E0FD126B67
Chrome Cache Entry: 57	HTML document, Unicode text, UTF-8 text, with very long lines (349), with CRLF line terminators	4A9EFB43886AB044D0CB01BBEC6FFA85	372F830303E8C4CCB0D2AA3443D255C1004816A2	C96DA5245D5231B83BCD5AF87D4710DDB9B1CFD29000798E02D4C80DC7E772F6
Chrome Cache Entry: 58	ASCII text, with CRLF line terminators	A6A93EAD857E8B01F2C6294949B4062F	5EC3938685E3084324D706A5390B7D7EF6D94C61	EB6C63DA87C0CBE25A1EE49F9D501AA0B362D4AA5A73416925393E5A50C27B05
Chrome Cache Entry: 59	Web Open Font Format (Version 2), TrueType, length 20860, version 1.0	E68DEFEB9B609A3B2723124F254BD39E	25B05B146FF91F14FA8E7C022EDC705ACCA417DB	5EC8E7426415B29985BE43A193116292E9B2B3B83143EE0BBF2B1003E495137A
Chrome Cache Entry: 60	ASCII text, with CRLF line terminators	A7BC18AA75737B793C15B277F874F223	DEE0125084C76915E7145C4CFDA7B66E420AA856	113497B9D2BE46BAAAD150609A6E4F948B9A63CB446A76B8C1AD83CB38C72D0A
Chrome Cache Entry: 61	troff or preprocessor input, ASCII text, with very long lines (305), with CRLF line terminators	D747D5B755B138AF0A6D94AF2D894169	EDF2017CCE9BD3DAC2D9936BC4BD909471893733	7C0A80A79D8D22F8FB6B46A81DF22BB799C7E34E5040D030BE11317CC342D612
Chrome Cache Entry: 62	ASCII text, with very long lines (32087), with CRLF line terminators	5DCB19DBDB18D04B1007BE864A85CD13	7509C1DED1D9562A4CF99DD63539A08D6A9A7C02	6D0C489D9AB712D6670A54B4E665A39072926D309B001E179CCD721102B558DF
Chrome Cache Entry: 63	ASCII text, with CRLF line terminators	3EEABA411238DA6670CC87F4C72834BC	133A65D9CD1F2C9C9501E0C1ACE32A6D7588D711	C41F13CF5541DA2C3B9418A947E86C28B342104A6FD60130232D84D24937E217
Chrome Cache Entry: 64	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x50, components 3	88E49E7ADD86227BDDD3AE9489DFCC35	F6D897B0898665A9B1925426AE5B05ABAA22E7F4	6FF32D94670676D2FB91745663B67E83A7AC1B7F452EB33397AF1B80CFB30DFA

There are no high impact signatures.

Source: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /iwxaj HTTP/1.1Host: equipstudy.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5 HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/bootstrap/css/bootstrap.min.css HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/bootstrap/font-awesome-4.2.0/css/font-awesome.css HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/css/global.css HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/css/textobj.css HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/js/formvalidation/formValidation.css HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/js/jquery/jquery-1.9.1.js HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/js/jquery/jquery-ui-1.11.4.min.js HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/bootstrap/js/bootstrap.min.js HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/assets/header_bgr.jpg HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/assets/fonts/museo-slab-500italic.woff2 HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://surveys.equip-surveys.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://surveys.equip-surveys.com/fieldlinknavi/css/global.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/assets/fonts/museosans-300-webfont.woff2 HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://surveys.equip-surveys.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://surveys.equip-surveys.com/fieldlinknavi/css/global.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fieldlinknavi/assets/header_bgr.jpg HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: surveys.equip-surveys.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://surveys.equip-surveys.com/fieldlinknavi/navigations/navigation_de.php?slink=aHR0cHM6Ly9zdXJ2ZXlzLmVxdWlwLXN1cnZleXMuY29tLzgwMTFlZDQ2N2ZjODhiYWY4ZTA4Y2YyOWMyMGNjOWE5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: equipstudy.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: surveys.equip-surveys.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Apr 2024 06:01:02 GMTServer: Apache/2.4.56 (Debian)Content-Length: 273Content-Type: text/html; charset=iso-8859-1Connection: close

Source: chromecache_58.2.dr	String found in binary or memory: http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_58.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12282#comment:15
Source: chromecache_58.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12359
Source: chromecache_58.2.dr	String found in binary or memory: http://dev.w3.org/csswg/cssom/#resolved-values
Source: chromecache_58.2.dr	String found in binary or memory: http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291
Source: chromecache_58.2.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chromecache_61.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_61.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_63.2.dr	String found in binary or memory: http://formvalidation.io)
Source: chromecache_63.2.dr	String found in binary or memory: http://formvalidation.io/license/
Source: chromecache_51.2.dr, chromecache_62.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_58.2.dr	String found in binary or memory: http://helpful.knobs-dials.com/index.php/Component_returned_failure_code:_0x80040111_(NS_ERROR_NOT_A
Source: chromecache_57.2.dr	String found in binary or memory: http://html5shim.googlecode.com/svn/trunk/html5.js
Source: chromecache_58.2.dr	String found in binary or memory: http://javascript.nwbox.com/IEContentLoaded/
Source: chromecache_58.2.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_58.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_54.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_58.2.dr	String found in binary or memory: http://json.org/json2.js
Source: chromecache_58.2.dr	String found in binary or memory: http://jsperf.com/getall-vs-sizzle/2
Source: chromecache_58.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_58.2.dr	String found in binary or memory: http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context
Source: chromecache_58.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_58.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
Source: chromecache_58.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
Source: chromecache_58.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_58.2.dr	String found in binary or memory: https://developer.mozilla.org/en/Security/CSP)
Source: chromecache_58.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/764
Source: chromecache_51.2.dr, chromecache_62.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_57.2.dr	String found in binary or memory: https://surveys.equip-surveys.com/8011ed467fc88baf8e08cf29c20cc9a9
Source: chromecache_63.2.dr	String found in binary or memory: https://twitter.com/formvalidation

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@17/29@8/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2280,i,7619782800502618050,10566268962405110305,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://equipstudy.net/iwxaj"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2280,i,7619782800502618050,10566268962405110305,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1431458
Product:	CloudBasic
Start time:	08:00:00
Start date:	25.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://equipstudy.net/iwxaj

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://equipstudy.net/iwxaj

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://equipstudy.net/iwxaj