Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAUDwspAy7QD502hzyLJ-SpwR93P4-0eg6vJM0VREGnzXDSBC2EmgJ8Ke7lx4i8Fs1P_-XwgT4dkJc1NSUtHiaYWpksON0WEUEjoNtLceqGZiHSKnGrgJcEvOmnS6jvBWT&

Overview

General Information

Sample URL:https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAUDwspAy7QD502hzyLJ-SpwR93P4-0eg6vJM0VREGnzXDSBC2EmgJ8Ke7lx4i8Fs1P_-XwgT4dkJc1NSUtHiaYWpksON0WEUEjoNtLceqGZiHSKnGrgJcEvOmn
Analysis ID:1431776
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

No high impact signatures.

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 2840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 3992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1976,i,4856322800474458559,14778597667407768629,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAUDwspAy7QD502hzyLJ-SpwR93P4-0eg6vJM0VREGnzXDSBC2EmgJ8Ke7lx4i8Fs1P_-XwgT4dkJc1NSUtHiaYWpksON0WEUEjoNtLceqGZiHSKnGrgJcEvOmnS6jvBWT&" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownHTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.46.200.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.205.26
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.205.9
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.205.26
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.205.9
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: secure.na4.echocdn.com
Source: global trafficDNS traffic detected: DNS query: use.typekit.net
Source: chromecache_51.1.drString found in binary or memory: http://api.jqueryui.com/position/
Source: chromecache_51.1.drString found in binary or memory: http://eightmedia.github.com/hammer.js
Source: chromecache_51.1.drString found in binary or memory: http://flesler.blogspot.com
Source: chromecache_51.1.drString found in binary or memory: http://flesler.blogspot.com/2007/10/jqueryscrollto.html
Source: chromecache_50.1.drString found in binary or memory: http://github.com/wyuenho/backgrid
Source: chromecache_51.1.drString found in binary or memory: http://jquery.org/license
Source: chromecache_51.1.drString found in binary or memory: http://jqueryui.com
Source: chromecache_48.1.drString found in binary or memory: http://typekit.com/eulas/0000000000000000000149e7
Source: chromecache_48.1.drString found in binary or memory: http://typekit.com/eulas/0000000000000000000176ff
Source: chromecache_48.1.drString found in binary or memory: http://typekit.com/eulas/000000000000000000017701
Source: chromecache_48.1.drString found in binary or memory: http://typekit.com/eulas/000000000000000000017703
Source: chromecache_50.1.drString found in binary or memory: http://www.mozilla.org/MPL/
Source: chromecache_51.1.drString found in binary or memory: https://getbootstrap.com/)
Source: chromecache_51.1.drString found in binary or memory: https://github.com/gabceb
Source: chromecache_51.1.drString found in binary or memory: https://github.com/gabceb/jquery-browser-plugin
Source: chromecache_51.1.drString found in binary or memory: https://github.com/hgoebl/mobile-detect.js
Source: chromecache_50.1.drString found in binary or memory: https://github.com/imakewebthings/waypoints/blob/master/licenses.txt
Source: chromecache_51.1.drString found in binary or memory: https://github.com/jquery/jquery-color
Source: chromecache_51.1.drString found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_51.1.drString found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_51.1.drString found in binary or memory: https://github.com/websanova/mousestop
Source: chromecache_51.1.drString found in binary or memory: https://jquery.com/
Source: chromecache_51.1.drString found in binary or memory: https://jquery.org/license
Source: chromecache_51.1.drString found in binary or memory: https://js.foundation/
Source: chromecache_48.1.drString found in binary or memory: https://p.typekit.net/p.gif
Source: chromecache_51.1.drString found in binary or memory: https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
Source: chromecache_51.1.drString found in binary or memory: https://sizzlejs.com/
Source: chromecache_48.1.drString found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/
Source: chromecache_48.1.drString found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/
Source: chromecache_48.1.drString found in binary or memory: https://use.typekit.net/af/e301c6/0000000000000000000149e7/27/
Source: chromecache_48.1.drString found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownHTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: classification engineClassification label: clean0.win@16/16@6/3
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1976,i,4856322800474458559,14778597667407768629,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAUDwspAy7QD502hzyLJ-SpwR93P4-0eg6vJM0VREGnzXDSBC2EmgJ8Ke7lx4i8Fs1P_-XwgT4dkJc1NSUtHiaYWpksON0WEUEjoNtLceqGZiHSKnGrgJcEvOmnS6jvBWT&"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1976,i,4856322800474458559,14778597667407768629,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAUDwspAy7QD502hzyLJ-SpwR93P4-0eg6vJM0VREGnzXDSBC2EmgJ8Ke7lx4i8Fs1P_-XwgT4dkJc1NSUtHiaYWpksON0WEUEjoNtLceqGZiHSKnGrgJcEvOmnS6jvBWT&0%Avira URL Cloudsafe
https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAUDwspAy7QD502hzyLJ-SpwR93P4-0eg6vJM0VREGnzXDSBC2EmgJ8Ke7lx4i8Fs1P_-XwgT4dkJc1NSUtHiaYWpksON0WEUEjoNtLceqGZiHSKnGrgJcEvOmnS6jvBWT&1%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
fp2e7a.wpc.phicdn.net0%VirustotalBrowse
bg.microsoft.map.fastly.net0%VirustotalBrowse
secure.na4.echocdn.com0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://js.foundation/0%URL Reputationsafe
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE0%Avira URL Cloudsafe
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE0%VirustotalBrowse

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.214.172
truefalseunknown
www.google.com
64.233.177.106
truefalse
    		high
    secure.na4dc2.echosign.com
    		44.234.124.131
    		truefalse
      		high
      fp2e7a.wpc.phicdn.net
      		192.229.211.108
      		truefalseunknown
      use.typekit.net
      		unknown
      		unknownfalse
        		high
        secure.na4.echocdn.com
        		unknown
        		unknownfalseunknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://jquery.org/licensechromecache_51.1.drfalse
          		high
          https://github.com/imakewebthings/waypoints/blob/master/licenses.txtchromecache_50.1.drfalse
            		high
            https://github.com/twbs/bootstrap/blob/main/LICENSE)chromecache_51.1.drfalse
              		high
              https://use.typekit.net/af/eaf09c/000000000000000000017703/27/chromecache_48.1.drfalse
                		high
                http://jqueryui.comchromecache_51.1.drfalse
                  		high
                  http://api.jqueryui.com/position/chromecache_51.1.drfalse
                    		high
                    https://use.typekit.net/af/e301c6/0000000000000000000149e7/27/chromecache_48.1.drfalse
                      		high
                      https://getbootstrap.com/)chromecache_51.1.drfalse
                        		high
                        https://github.com/jquery/jquery-colorchromecache_51.1.drfalse
                          		high
                          http://typekit.com/eulas/0000000000000000000149e7chromecache_48.1.drfalse
                            		high
                            https://use.typekit.net/af/cb695f/000000000000000000017701/27/chromecache_48.1.drfalse
                              		high
                              http://eightmedia.github.com/hammer.jschromecache_51.1.drfalse
                                		high
                                https://jquery.org/licensechromecache_51.1.drfalse
                                  		high
                                  https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSEchromecache_51.1.drfalse
                                  • 0%, Virustotal, Browse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://github.com/twbs/bootstrap/graphs/contributors)chromecache_51.1.drfalse
                                    		high
                                    https://github.com/gabceb/jquery-browser-pluginchromecache_51.1.drfalse
                                      		high
                                      https://jquery.com/chromecache_51.1.drfalse
                                        		high
                                        https://p.typekit.net/p.gifchromecache_48.1.drfalse
                                          		high
                                          http://typekit.com/eulas/0000000000000000000176ffchromecache_48.1.drfalse
                                            		high
                                            https://github.com/gabcebchromecache_51.1.drfalse
                                              		high
                                              http://typekit.com/eulas/000000000000000000017701chromecache_48.1.drfalse
                                                		high
                                                http://flesler.blogspot.comchromecache_51.1.drfalse
                                                  		high
                                                  http://typekit.com/eulas/000000000000000000017703chromecache_48.1.drfalse
                                                    		high
                                                    https://use.typekit.net/af/40207f/0000000000000000000176ff/27/chromecache_48.1.drfalse
                                                      		high
                                                      https://github.com/hgoebl/mobile-detect.jschromecache_51.1.drfalse
                                                        		high
                                                        http://github.com/wyuenho/backgridchromecache_50.1.drfalse
                                                          		high
                                                          http://flesler.blogspot.com/2007/10/jqueryscrollto.htmlchromecache_51.1.drfalse
                                                            		high
                                                            https://github.com/websanova/mousestopchromecache_51.1.drfalse
                                                              		high
                                                              https://sizzlejs.com/chromecache_51.1.drfalse
                                                                		high
                                                                https://js.foundation/chromecache_51.1.drfalse
                                                                • URL Reputation: safe
                                                                		unknown

                                                                World Map of Contacted IPs

                                                                • No. of IPs < 25%
                                                                • 25% < No. of IPs < 50%
                                                                • 50% < No. of IPs < 75%
                                                                • 75% < No. of IPs

                                                                Public IPs

                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                64.233.177.106
                                                                		www.google.comUnited States
                                                                		15169GOOGLEUSfalse
                                                                239.255.255.250
                                                                		unknownReserved
                                                                		unknownunknownfalse

                                                                Private

                                                                IP
                                                                192.168.2.4

                                                                General Information

                                                                Joe Sandbox version:40.0.0 Tourmaline
                                                                Analysis ID:1431776
                                                                Start date and time:2024-04-25 18:59:15 +02:00
                                                                Joe Sandbox product:CloudBasic
                                                                Overall analysis duration:0h 3m 5s
                                                                Hypervisor based Inspection enabled:false
                                                                Report type:full
                                                                Cookbook file name:browseurl.jbs
                                                                Sample URL:https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAUDwspAy7QD502hzyLJ-SpwR93P4-0eg6vJM0VREGnzXDSBC2EmgJ8Ke7lx4i8Fs1P_-XwgT4dkJc1NSUtHiaYWpksON0WEUEjoNtLceqGZiHSKnGrgJcEvOmnS6jvBWT&
                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                Number of analysed new started processes analysed:7
                                                                Number of new started drivers analysed:0
                                                                Number of existing processes analysed:0
                                                                Number of existing drivers analysed:0
                                                                Number of injected processes analysed:0
                                                                Technologies:
                                                                • HCA enabled
                                                                • EGA enabled
                                                                • AMSI enabled
                                                                Analysis Mode:default
                                                                Analysis stop reason:Timeout
                                                                Detection:CLEAN
                                                                Classification:clean0.win@16/16@6/3
                                                                EGA Information:Failed
                                                                HCA Information:
                                                                • Successful, ratio: 100%
                                                                • Number of executed functions: 0
                                                                • Number of non-executed functions: 0

                                                                Warnings

                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                • Excluded IPs from analysis (whitelisted): 74.125.138.94, 64.233.177.101, 64.233.177.102, 64.233.177.113, 64.233.177.139, 64.233.177.100, 64.233.177.138, 108.177.122.84, 34.104.35.123, 44.234.124.133, 44.234.124.132, 44.234.124.131, 96.7.225.18, 96.7.225.11, 20.114.59.183, 23.40.205.73, 23.40.205.40, 199.232.214.172, 192.229.211.108, 20.242.39.171, 20.3.187.198, 172.253.124.94
                                                                • Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, stls.adobe.com-cn.edgesuite.net.globalredir.akadns.net, slscr.update.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, stls.adobe.com-cn.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, na4.documents.adobe.com, use-stls.adobe.com.edgesuite.net, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, a1815.dscr.akamai.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, www.adobe.com, a1988.dscg1.akamai.net, glb.sls.prod.dcat.dsp.trafficmanager.net
                                                                • Not all processes where analyzed, report is missing behavior information
                                                                • Report size getting too big, too many NtSetInformationFile calls found.

                                                                Simulations

                                                                Behavior and APIs

                                                                ⊘No simulations

                                                                Joe Sandbox View / Context

                                                                IPs

                                                                ⊘No context

                                                                Domains

                                                                ⊘No context

                                                                ASNs

                                                                ⊘No context

                                                                JA3 Fingerprints

                                                                ⊘No context

                                                                Dropped Files

                                                                ⊘No context

                                                                Created / dropped Files

                                                                Chrome Cache Entry: 46

                                                                Download File
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:ASCII text, with very long lines (5632), with no line terminators
                                                                Category:downloaded
                                                                Size (bytes):5632
                                                                Entropy (8bit):5.320327818450802
                                                                Encrypted:false
                                                                SSDEEP:48:4uTVQW0Q/tCkJquYzg55551T5lU6wVAnq1pDlIVKynCFfludpYmCSJFfeuEtMVuJ:LT6g/ZuWx1t+VAnq1pDlKCXpSJ+WkaAF
                                                                MD5:4B3C669E1B6B635DE4B64BE0A1157D42
                                                                SHA1:65DE7AB428CC08DF3DF028181ACDC53E10014AC7
                                                                SHA-256:0AFA57E1DD77793527F83DD90004CA5E09647B5B5B08FF7D02A723C9468BFE4C
                                                                SHA-512:80A40B7B46D9491ADC8C3CCF8F2B72EA89FFC00A465F07ED2526F3C1B1063805F0C0A0B3AC43664B538732E9DA415DD87F07A36BD264A5B20DB848849FA1FA88
                                                                Malicious:false
                                                                Reputation:low
                                                                URL:https://secure.na4.echocdn.com/resource/1730650309/bundles/toast-message.css
                                                                Preview:#toast-container{display:flex;position:fixed;right:0;z-index:100050;-ms-flex-direction:column;flex-direction:column;-ms-flex-align:center;align-items:flex-end;}#toast-main-view{display:none;-webkit-animation:fadein 0.3s, fadeout 1s 6.5s;animation:fadein 0.5s, fadeout 1s 6.5s;}.toast{box-sizing:border-box;line-height:1.5;display:inline-flex;-ms-flex-direction:row;flex-direction:row;-ms-flex-align:stretch;align-items:stretch;border-radius:4px;padding:8px 8px 8px 16px;font-size:14px;font-weight:700;-webkit-font-smoothing:antialiased;margin:8px;}.toast--success{background-color:rgb(18, 128, 92);color:rgb(18, 128, 92);}.toast--error{background-color:rgb(232, 9, 28);color:rgb(232, 9, 28);}.toast--info{background-color:rgb(9, 90, 186);color:rgb(9, 90, 186);max-width:415px;}.toast--top-right{right:0;}.toast--top-middle{right:40% !important;top:66px;}.toast--button-secondary{border-color:white !important;}.toast--button-primary{}.toast--button-secondary-center{border-color:white !important;floa

                                                                Chrome Cache Entry: 47

                                                                Download File
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:ASCII text, with very long lines (4938)
                                                                Category:downloaded
                                                                Size (bytes):77493
                                                                Entropy (8bit):5.781608461985365
                                                                Encrypted:false
                                                                SSDEEP:768:fKF2+CV2Ub5meb+m88sbxeQ6gdKV7FaeCvVstAliVNgdKV7Uf3GhvdYFhvdYwhvZ:fK3CX8plkFWkFUv
                                                                MD5:DC8D34966443C527E00358DFF0772799
                                                                SHA1:34ACCA8C275A61A80350038A6F0C92C6489692E7
                                                                SHA-256:9BEB3A18B34136438721D95B3FCB843BAA524B9031B5E770028E93DE9C9ACC7B
                                                                SHA-512:808A65C7A124695A6D5A94C438AF051F0993ADBA4A74F9675ACE704F02DDD46130D14533BD848166878EE49F3D8D9533CEF1031177281010E23D9FCC2EB1230E
                                                                Malicious:false
                                                                Reputation:low
                                                                URL:https://secure.na4.echocdn.com/resource/1715228063/bundles/esignResponsive.css
                                                                Preview:.disabled-opacity {. opacity: 0.5;. -ms-filter: "progid:DXImageTransform.Microsoft.Alpha(Opacity=50)";.}..no-box-shadow {. box-shadow: none;. -webkit-box-shadow: none;.}./****** MODALS *******/.html.mobile #contentSubHeader .agreement-header .dark-mode {. background: #2d2d2d !important;.}.html.mobile #contentSubHeader .agreement-header .dark-mode .agreement-container {. align-items: center;. display: flex;. height: 56px;.}.html.mobile #contentSubHeader .agreement-header .dark-mode .agreement-container .lastsave .lastsave-info-icon {. margin: -11px 0 0 0;.}.html.mobile #contentSubHeader .agreement-header .dark-mode.agreement-band.navbar {. height: 56px;. border: 0;.}.html.mobile #contentSubHeader .agreement-header .dark-mode.agreement-band.navbar .agreement-req-info {. padding-top: 8px;. padding-left: 0;.}.html.mobile #contentSubHeader .agreement-header .dark-mode.agreement-band.navbar .agreement-req-info .completed-info {. margin-top: -6px;. float: right;. margin-right:

                                                                Chrome Cache Entry: 48

                                                                Download File
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:Unicode text, UTF-8 text, with very long lines (2258)
                                                                Category:downloaded
                                                                Size (bytes):17476
                                                                Entropy (8bit):5.5562021281521154
                                                                Encrypted:false
                                                                SSDEEP:384:mIHI2hpIgIVsUGiRm4lIeU4iDFeFs2NdFJsQF+i:mIHg7GiRm4X0JqsG7Ui
                                                                MD5:80AA1425E8422CAEF6A4DEFFDA2F5A38
                                                                SHA1:BCADA77A87D8F10F1CA4ADE8D393B2AD9988AD13
                                                                SHA-256:1B3329DED46F847B991CE76CBD6252FC0322BED2ADA2535143B58543109E271D
                                                                SHA-512:9DD29547A084858ACD7ADA9E451185983F8BD1B5C1D35DDA15A6BB52CA7D3B65DD8A604BDAE580B000748481DC71A224A0EAE7006C576F50F5EE8087C3B1DF2D
                                                                Malicious:false
                                                                Reputation:low
                                                                URL:https://use.typekit.net/fqg8osp.js
                                                                Preview:/*. * The Typekit service used to deliver this font or fonts for use on websites. * is provided by Adobe and is subject to these Terms of Use. * http://www.adobe.com/products/eulas/tou_typekit. For font license. * information, see the list below.. *. * adobe-clean:. * - http://typekit.com/eulas/000000000000000000017701. * - http://typekit.com/eulas/000000000000000000017703. * - http://typekit.com/eulas/0000000000000000000176ff. * adobe-hand-b:. * - http://typekit.com/eulas/0000000000000000000149e7. *. * . 2009-2024 Adobe Systems Incorporated. All Rights Reserved.. */.if(!window.Typekit)window.Typekit={};window.Typekit.config={"a":"717200","c":[".tk-adobe-clean","\"adobe-clean\",sans-serif",".tk-adobe-hand-b","\"adobe-hand-b\",sans-serif"],"fi":[7180,7182,7184,22766],"fc":[{"id":7180,"family":"adobe-clean","src":"https://use.typekit.net/af/cb695f/000000000000000000017701/27/{format}{?primer,subset_id,fvd,v}","descriptors":{"weight":"400","style":"normal","stretch":"normal","dis

                                                                Chrome Cache Entry: 49

                                                                Download File
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                Category:downloaded
                                                                Size (bytes):135602
                                                                Entropy (8bit):5.052432544669672
                                                                Encrypted:false
                                                                SSDEEP:1536:Po36puuzWBlflZQspIfqPQ3ZiRFjBRvxm+DRarYf2LI2IlIRIIIwWEQ1lePh:Po36putBlflRPRXRH2LI2IlIRIIIwWy
                                                                MD5:2356B03B907A7EC07D8116FB0A2050B0
                                                                SHA1:0B22F9D97B5DA8501FF22FC42EFE203883625BDF
                                                                SHA-256:524F0F5D0AE32D1DDFFBA2C0AB8D530D8EE634CD5259AF326FBF6B6557F7372B
                                                                SHA-512:16C9A9E6E2469A2398BD5C62BF6EBEDB1DCCC19A9BAD4FBF3A4EBCD8094619A9964FDB727703D521097E5C2817881D52997EAB8A6A1AFF313EF800D20A56BA17
                                                                Malicious:false
                                                                Reputation:low
                                                                URL:https://secure.na4.echocdn.com/resource/1097130768/bundles/esignJS.css
                                                                Preview:.disabled-opacity{opacity:0.5;-ms-filter:"progid:DXImageTransform.Microsoft.Alpha(Opacity=50)";}.no-box-shadow{box-shadow:none;-webkit-box-shadow:none;}.wrapLongText{white-space:pre;white-space:pre-wrap;white-space:pre-line;white-space:-pre-wrap;white-space:-o-pre-wrap;white-space:-moz-pre-wrap;white-space:-hp-pre-wrap;word-wrap:break-word;}.has-error-color{color:#D83742;}.has-error-border{border:1px solid #D83742;}.has-error-background{background-color:#ffffff;}.has-error-common{border:1px solid #D83742;color:#D83742;box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);-o-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);-moz-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);-webkit-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);}.has-error-font{font-size:16px;font-weight:normal;}.has-error-token-background{background-color:#ffffff;}.has-error-token-background:hover{background-color:#fae3e0;}.has-error-token-background:active, .has-error-token-background:focus{background-color:#fccdc7;}.disab

                                                                Chrome Cache Entry: 50

                                                                Download File
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:Unicode text, UTF-8 text, with very long lines (39221)
                                                                Category:downloaded
                                                                Size (bytes):1210636
                                                                Entropy (8bit):5.4368448012650505
                                                                Encrypted:false
                                                                SSDEEP:24576:nhqsx5yEH5i+1EaCGRTK16Asebc1hPhYtVOSr0/9CyHmz0CK:hqIHH5i+1EaCGRTK16Asebc1hPhYtVOD
                                                                MD5:F9480B84F852C3B321A77E46310AF086
                                                                SHA1:7D9C2D3988D665979EE7A361B2F7596CBA6A34C4
                                                                SHA-256:F4A70684164143E8EA469C2E1C6CABA92501BCE9B243B5FD047CC677DF9DD340
                                                                SHA-512:B6B4A9DB89D19F933174B45685D3585C9AC6B1D13ECD93E3E4C1450718EF914DDBD3766E09080CCF3216827AE6E05935CF9D330601A3FD581A0C0522AC4EF2F0
                                                                Malicious:false
                                                                Reputation:low
                                                                URL:https://secure.na4.echocdn.com/resource/1248589626.en_US/bundles/app-esign.js
                                                                Preview:/*!. backgrid. http://github.com/wyuenho/backgrid.. Copyright (c) 2014 Jimmy Yuen Ho Wong and contributors <wyuenho@gmail.com>. Licensed under the MIT license..*/.(function(a){if(typeof exports=="object"){module.exports=a(module.exports,require("underscore"),require("backbone"))}else{a(this,this._,this.Backbone)}}(function(v,Q,E){var P="\x09\x0A\x0B\x0C\x0D\x20\xA0\u1680\u180E\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200A\u202F\u205F\u3000\u2028\u2029\uFEFF";if(!String.prototype.trim||P.trim()){P="["+P+"]";var x=new RegExp("^"+P+P+"*"),p=new RegExp(P+P+"*$");String.prototype.trim=function a(){if(this===undefined||this===null){throw new TypeError("can't convert "+this+" to object")}return String(this).replace(x,"").replace(p,"")}}function F(X,U,T){var W=U-(X+"").length;W=W<0?0:W;var V="";for(var S=0;S<W;S++){V=V+T}return V+X}var C=E.$;var R=v.Backgrid={Extension:{},resolveNameToClass:function(T,V){if(Q.isString(T)){var U=Q.map(T.split("-"),function(W){return W.sl

                                                                Chrome Cache Entry: 51

                                                                Download File
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:ASCII text, with very long lines (60557)
                                                                Category:downloaded
                                                                Size (bytes):936918
                                                                Entropy (8bit):5.519080124550211
                                                                Encrypted:false
                                                                SSDEEP:12288:50jTWVt3qz0Kcl42KOusstfuqr0VHbz0JPHihkUgxC:50mHqz0JlvusstfuqoVHbz0JPHiKNs
                                                                MD5:D5BC5F9EFA5502DB137917C2393A6235
                                                                SHA1:A15AB65C8DA9B29B25AFE6C5AEDB6F33093B5760
                                                                SHA-256:063BD760F04093F287BB7CD04EAF06E4C649F80D5C09F3BEA8E37858E39FB79C
                                                                SHA-512:7FA94257090FC1C95AB03F4689664BFDABA78AC05B5BB9C08FDADBFCABBA7C22192CCD4619D4D351323CFA647EED61FB7F50B59843052453D230B7CEE7174ED5
                                                                Malicious:false
                                                                Reputation:low
                                                                URL:https://secure.na4.echocdn.com/resource/372557605.en_US/bundles/app-main.js
                                                                Preview:/*!. * jQuery JavaScript Library v3.5.1. * https://jquery.com/. *. * Includes Sizzle.js. * https://sizzlejs.com/. *. * Copyright JS Foundation and other contributors. * Released under the MIT license. * https://jquery.org/license. *. * Date: 2020-05-04T22:49Z. */.(function(b,a){if(typeof module==="object"&&typeof module.exports==="object"){module.exports=b.document?a(b,true):function(c){if(!c.document){throw new Error("jQuery requires a window with a document")}return a(c)}}else{a(b)}})(typeof window!=="undefined"?window:this,function(a1,ay){var m=[];var aP=Object.getPrototypeOf;var aa=m.slice;var bV=m.flat?function(b1){return m.flat.call(b1)}:function(b1){return m.concat.apply([],b1)};var x=m.push;var bR=m.indexOf;var aj={};var z=aj.toString;var U=aj.hasOwnProperty;var aB=U.toString;var bk=aB.call(Object);var J={};var y=function y(b1){return typeof b1==="function"&&typeof b1.nodeType!=="number"};var aE=function aE(b1){return b1!=null&&b1===b1.window};var l=a1.document;var be={type:tru

                                                                Chrome Cache Entry: 52

                                                                Download File
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:Unicode text, UTF-8 text, with very long lines (65533), with no line terminators
                                                                Category:downloaded
                                                                Size (bytes):369897
                                                                Entropy (8bit):5.444028530568237
                                                                Encrypted:false
                                                                SSDEEP:3072:ZXKElkD8gK1C8lizh3ODBvOkBBO/mCs4QAEf2tEfVfs2i8:ZXI8gK1C8lizh3ODBvOkBBOOCh+h9i8
                                                                MD5:D2836BB701B215B7F6CC1A65F7137FFD
                                                                SHA1:5A0C8062616E2B4E2DC55B54AD7BA333F56EA19B
                                                                SHA-256:EE1EEF26F4071F30477DBA5B1BDD77D90B3B1A8EAEF85AA55E2317C9F26982DB
                                                                SHA-512:8381426D335EBB379145E85093CF2D7D854B288083AE86CCE52AFA84E4CD1AE6C8D4166A7F93816EEFCE769EE20B0FEC1644D343B83F431FA57766BFA84064E4
                                                                Malicious:false
                                                                Reputation:low
                                                                URL:https://secure.na4.echocdn.com/resource/N1614084111/bundles/app-theme.css
                                                                Preview:.slider{display:inline-block;vertical-align:middle;position:relative;}.slider.slider-horizontal{width:210px;height:20px;}.slider.slider-horizontal .slider-track{height:10px;width:100%;margin-top:-5px;top:50%;left:0;}.slider.slider-horizontal .slider-selection{height:100%;top:0;bottom:0;}.slider.slider-horizontal .slider-handle{margin-left:-10px;margin-top:-5px;}.slider.slider-horizontal .slider-handle.triangle{border-width:0 10px 10px 10px;width:0;height:0;border-bottom-color:#0480be;margin-top:0;}.slider.slider-vertical{height:210px;width:20px;}.slider.slider-vertical .slider-track{width:10px;height:100%;margin-left:-5px;left:50%;top:0;}.slider.slider-vertical .slider-selection{width:100%;left:0;top:0;bottom:0;}.slider.slider-vertical .slider-handle{margin-left:-5px;margin-top:-10px;}.slider.slider-vertical .slider-handle.triangle{border-width:10px 0 10px 10px;width:1px;height:1px;border-left-color:#0480be;margin-left:0;}.slider input{display:none;}.slider .tooltip-inner{white-space:n

                                                                Chrome Cache Entry: 53

                                                                Download File
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:Unicode text, UTF-8 text, with very long lines (65533), with no line terminators
                                                                Category:downloaded
                                                                Size (bytes):488483
                                                                Entropy (8bit):5.103272772215297
                                                                Encrypted:false
                                                                SSDEEP:3072:bivxgPYrcTjVqodlvK3tfg6NtOJPGUdF4PHmTvFfERO8OA:Wvh6jVqSvEtfgWIJPVdF4vqvFf+OA
                                                                MD5:26E29F0C91622E83BD33DEDF2C7FF0CA
                                                                SHA1:645A266B9979279786BD273F6084166736A1FF10
                                                                SHA-256:3567438FF892CE3947216B7648C506926CFCD080E577F1C46CBE1D87DF41040B
                                                                SHA-512:741E1F978D6CCD3302D1710133B36880D7FD3DFBCE300AD004BC2274C0BEB8152B1816472EB3D8474655BBCF5DBDC06ED1EE3E581750B9DA75247AA917B485FC
                                                                Malicious:false
                                                                Reputation:low
                                                                URL:https://secure.na4.echocdn.com/resource/N2068235899.en_US/bundles/translations.js
                                                                Preview:(function(){function a(e,d){for(var c=0;c<d.length;c++){e=e.replace("{"+c+"}",d[c])}return e}function b(){var f=arguments[0];var e;if(f.indexOf("{0}")!=-1){e=function(){return a(f,arguments)}}else{e=function(){return f}}for(var c=1;c<arguments.length;c++){for(var d in arguments[c]){e[d]=arguments[c][d]}}return e}window.i18n=({country:{PS:b("Palestinian Territory"),PT:b("Portugal"),PY:b("Paraguay"),QA:b("Qatar"),AD:b("Andorra"),AE:b("United Arab Emirates"),AF:b("Afghanistan"),AG:b("Antigua and Barbuda"),AI:b("Anguilla"),AL:b("Albania"),AM:b("Armenia"),AN:b("Netherlands Antilles"),AO:b("Angola"),AQ:b("Antarctica"),AR:b("Argentina"),RE:b("R.union"),AT:b("Austria"),AU:b("Australia"),AW:b("Aruba"),AZ:b("Azerbaijan"),RO:b("Romania"),BA:b("Bosnia and Herzegovina"),BB:b("Barbados"),RS:b("Serbia"),BD:b("Bangladesh"),RU:b("Russia"),BE:b("Belgium"),BF:b("Burkina Faso"),RW:b("Rwanda"),BG:b("Bulgaria"),BH:b("Bahrain"),BI:b("Burundi"),BJ:b("Benin"),BM:b("Bermuda"),BN:b("Brunei"),BO:b("Bolivia"),SA:

                                                                Static File Info

                                                                ⊘No static file info

                                                                Network Behavior

                                                                Network Port Distribution

                                                                TCP Packets

                                                                TimestampSource PortDest PortSource IPDest IP
                                                                Apr 25, 2024 18:59:57.174248934 CEST49675443192.168.2.4173.222.162.32
                                                                Apr 25, 2024 18:59:57.955497980 CEST49678443192.168.2.4104.46.162.224
                                                                Apr 25, 2024 19:00:06.784132957 CEST49675443192.168.2.4173.222.162.32
                                                                Apr 25, 2024 19:00:07.933562994 CEST49739443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:00:07.933598042 CEST4434973964.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:00:07.933671951 CEST49739443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:00:07.934094906 CEST49739443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:00:07.934103966 CEST4434973964.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:00:08.166290045 CEST4434973964.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:00:08.166729927 CEST49739443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:00:08.166757107 CEST4434973964.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:00:08.168237925 CEST4434973964.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:00:08.168294907 CEST49739443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:00:08.170380116 CEST49739443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:00:08.170459986 CEST4434973964.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:00:08.210500956 CEST49739443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:00:08.210540056 CEST4434973964.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:00:08.250727892 CEST49739443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:00:09.518237114 CEST49740443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:09.518287897 CEST4434974023.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:09.518486023 CEST49740443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:09.532835007 CEST49740443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:09.532867908 CEST4434974023.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:09.764673948 CEST4434974023.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:09.764818907 CEST49740443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:09.772903919 CEST49740443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:09.772922993 CEST4434974023.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:09.773422956 CEST4434974023.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:09.815562963 CEST49740443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:09.845079899 CEST49740443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:09.888132095 CEST4434974023.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:09.979526997 CEST4434974023.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:09.979675055 CEST4434974023.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:09.979724884 CEST49740443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:09.979865074 CEST49740443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:09.979887009 CEST4434974023.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:09.979923010 CEST49740443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:09.979928017 CEST4434974023.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:10.028811932 CEST49741443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:10.028877974 CEST4434974123.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:10.028945923 CEST49741443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:10.029448986 CEST49741443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:10.029468060 CEST4434974123.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:10.259649038 CEST4434974123.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:10.259758949 CEST49741443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:10.284864902 CEST49741443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:10.284913063 CEST4434974123.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:10.285257101 CEST4434974123.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:10.288852930 CEST49741443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:10.332123995 CEST4434974123.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:10.498723984 CEST4434974123.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:10.498820066 CEST4434974123.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:10.498995066 CEST49741443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:10.499655962 CEST49741443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:10.499705076 CEST4434974123.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:10.499735117 CEST49741443192.168.2.423.46.200.91
                                                                Apr 25, 2024 19:00:10.499749899 CEST4434974123.46.200.91192.168.2.4
                                                                Apr 25, 2024 19:00:18.158098936 CEST4434973964.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:00:18.158281088 CEST4434973964.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:00:18.158324003 CEST49739443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:00:19.070549965 CEST49739443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:00:19.070581913 CEST4434973964.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:01:07.877715111 CEST49760443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:01:07.877758980 CEST4434976064.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:01:07.878058910 CEST49760443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:01:07.878058910 CEST49760443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:01:07.878101110 CEST4434976064.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:01:08.108359098 CEST4434976064.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:01:08.108648062 CEST49760443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:01:08.108669996 CEST4434976064.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:01:08.109754086 CEST4434976064.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:01:08.110285997 CEST49760443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:01:08.110459089 CEST4434976064.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:01:08.162797928 CEST49760443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:01:16.878746033 CEST4972380192.168.2.423.40.205.26
                                                                Apr 25, 2024 19:01:16.878866911 CEST4972480192.168.2.423.40.205.9
                                                                Apr 25, 2024 19:01:16.988619089 CEST804972323.40.205.26192.168.2.4
                                                                Apr 25, 2024 19:01:16.989617109 CEST4972380192.168.2.423.40.205.26
                                                                Apr 25, 2024 19:01:17.030107021 CEST804972423.40.205.9192.168.2.4
                                                                Apr 25, 2024 19:01:17.034759045 CEST804972423.40.205.9192.168.2.4
                                                                Apr 25, 2024 19:01:17.035051107 CEST4972480192.168.2.423.40.205.9
                                                                Apr 25, 2024 19:01:18.119491100 CEST4434976064.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:01:18.119662046 CEST4434976064.233.177.106192.168.2.4
                                                                Apr 25, 2024 19:01:18.119724035 CEST49760443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:01:19.229090929 CEST49760443192.168.2.464.233.177.106
                                                                Apr 25, 2024 19:01:19.229130983 CEST4434976064.233.177.106192.168.2.4

                                                                UDP Packets

                                                                TimestampSource PortDest PortSource IPDest IP
                                                                Apr 25, 2024 19:00:04.856197119 CEST53535761.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:00:05.020534039 CEST53548321.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:00:05.646405935 CEST53644721.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:00:06.762111902 CEST53569141.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:00:07.821460962 CEST5094853192.168.2.41.1.1.1
                                                                Apr 25, 2024 19:00:07.821710110 CEST5710153192.168.2.41.1.1.1
                                                                Apr 25, 2024 19:00:07.931924105 CEST53509481.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:00:07.931984901 CEST53571011.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:00:12.431725025 CEST6036053192.168.2.41.1.1.1
                                                                Apr 25, 2024 19:00:12.431971073 CEST6158353192.168.2.41.1.1.1
                                                                Apr 25, 2024 19:00:12.542994976 CEST53603601.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:00:12.546530962 CEST53615831.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:00:20.008121967 CEST5572353192.168.2.41.1.1.1
                                                                Apr 25, 2024 19:00:20.009077072 CEST5454953192.168.2.41.1.1.1
                                                                Apr 25, 2024 19:00:22.680861950 CEST53558351.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:00:28.485220909 CEST138138192.168.2.4192.168.2.255
                                                                Apr 25, 2024 19:00:41.566273928 CEST53522891.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:01:04.037058115 CEST53636961.1.1.1192.168.2.4
                                                                Apr 25, 2024 19:01:04.702665091 CEST53508281.1.1.1192.168.2.4

                                                                DNS Queries

                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                Apr 25, 2024 19:00:07.821460962 CEST192.168.2.41.1.1.10xadd4Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:07.821710110 CEST192.168.2.41.1.1.10xf481Standard query (0)www.google.com65IN (0x0001)false
                                                                Apr 25, 2024 19:00:12.431725025 CEST192.168.2.41.1.1.10xf118Standard query (0)secure.na4.echocdn.comA (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:12.431971073 CEST192.168.2.41.1.1.10x18d1Standard query (0)secure.na4.echocdn.com65IN (0x0001)false
                                                                Apr 25, 2024 19:00:20.008121967 CEST192.168.2.41.1.1.10xc84aStandard query (0)use.typekit.netA (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:20.009077072 CEST192.168.2.41.1.1.10xc37cStandard query (0)use.typekit.net65IN (0x0001)false

                                                                DNS Answers

                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                Apr 25, 2024 19:00:07.931924105 CEST1.1.1.1192.168.2.40xadd4No error (0)www.google.com64.233.177.106A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:07.931924105 CEST1.1.1.1192.168.2.40xadd4No error (0)www.google.com64.233.177.103A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:07.931924105 CEST1.1.1.1192.168.2.40xadd4No error (0)www.google.com64.233.177.105A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:07.931924105 CEST1.1.1.1192.168.2.40xadd4No error (0)www.google.com64.233.177.104A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:07.931924105 CEST1.1.1.1192.168.2.40xadd4No error (0)www.google.com64.233.177.147A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:07.931924105 CEST1.1.1.1192.168.2.40xadd4No error (0)www.google.com64.233.177.99A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:07.931984901 CEST1.1.1.1192.168.2.40xf481No error (0)www.google.com65IN (0x0001)false
                                                                Apr 25, 2024 19:00:12.542994976 CEST1.1.1.1192.168.2.40xf118No error (0)secure.na4.echocdn.comsecure.na4dc2.echosign.comCNAME (Canonical name)IN (0x0001)false
                                                                Apr 25, 2024 19:00:12.542994976 CEST1.1.1.1192.168.2.40xf118No error (0)secure.na4dc2.echosign.com44.234.124.131A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:12.542994976 CEST1.1.1.1192.168.2.40xf118No error (0)secure.na4dc2.echosign.com44.234.124.133A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:12.542994976 CEST1.1.1.1192.168.2.40xf118No error (0)secure.na4dc2.echosign.com44.234.124.132A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:12.546530962 CEST1.1.1.1192.168.2.40x18d1No error (0)secure.na4.echocdn.comsecure.na4dc2.echosign.comCNAME (Canonical name)IN (0x0001)false
                                                                Apr 25, 2024 19:00:20.118344069 CEST1.1.1.1192.168.2.40xc84aNo error (0)use.typekit.netuse-stls.adobe.com.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                                Apr 25, 2024 19:00:20.119587898 CEST1.1.1.1192.168.2.40xc37cNo error (0)use.typekit.netuse-stls.adobe.com.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                                Apr 25, 2024 19:00:21.061959982 CEST1.1.1.1192.168.2.40x43beNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:21.061959982 CEST1.1.1.1192.168.2.40x43beNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:21.484317064 CEST1.1.1.1192.168.2.40xe467No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                Apr 25, 2024 19:00:21.484317064 CEST1.1.1.1192.168.2.40xe467No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:34.474406958 CEST1.1.1.1192.168.2.40x101aNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                Apr 25, 2024 19:00:34.474406958 CEST1.1.1.1192.168.2.40x101aNo error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:00:56.685425997 CEST1.1.1.1192.168.2.40xbd1No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                Apr 25, 2024 19:00:56.685425997 CEST1.1.1.1192.168.2.40xbd1No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                                                Apr 25, 2024 19:01:17.768954992 CEST1.1.1.1192.168.2.40xf452No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                Apr 25, 2024 19:01:17.768954992 CEST1.1.1.1192.168.2.40xf452No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false

                                                                HTTP Request Dependency Graph

                                                                • fs.microsoft.com

                                                                HTTPS Proxied Packets

                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                0192.168.2.44974023.46.200.91443
                                                                TimestampBytes transferredDirectionData
                                                                2024-04-25 17:00:09 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                                                Connection: Keep-Alive
                                                                Accept: */*
                                                                Accept-Encoding: identity
                                                                User-Agent: Microsoft BITS/7.8
                                                                Host: fs.microsoft.com
                                                                2024-04-25 17:00:09 UTC467INHTTP/1.1 200 OK
                                                                Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                                Content-Type: application/octet-stream
                                                                ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                                Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                                Server: ECAcc (chd/073D)
                                                                X-CID: 11
                                                                X-Ms-ApiVersion: Distribute 1.2
                                                                X-Ms-Region: prod-eus-z1
                                                                Cache-Control: public, max-age=137025
                                                                Date: Thu, 25 Apr 2024 17:00:09 GMT
                                                                Connection: close
                                                                X-CID: 2


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                1192.168.2.44974123.46.200.91443
                                                                TimestampBytes transferredDirectionData
                                                                2024-04-25 17:00:10 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                                                Connection: Keep-Alive
                                                                Accept: */*
                                                                Accept-Encoding: identity
                                                                If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                                                Range: bytes=0-2147483646
                                                                User-Agent: Microsoft BITS/7.8
                                                                Host: fs.microsoft.com
                                                                2024-04-25 17:00:10 UTC531INHTTP/1.1 200 OK
                                                                Content-Type: application/octet-stream
                                                                Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                                ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                                ApiVersion: Distribute 1.1
                                                                Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                                X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm
                                                                Cache-Control: public, max-age=137037
                                                                Date: Thu, 25 Apr 2024 17:00:10 GMT
                                                                Content-Length: 55
                                                                Connection: close
                                                                X-CID: 2
                                                                2024-04-25 17:00:10 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                                                Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                                                Statistics

                                                                CPU Usage

                                                                Click to jump to process

                                                                Memory Usage

                                                                Click to jump to process

                                                                Behavior

                                                                Click to jump to process

                                                                System Behavior

                                                                General

                                                                Target ID:0
                                                                Start time:18:59:59
                                                                Start date:25/04/2024
                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
                                                                Imagebase:0x7ff76e190000
                                                                File size:3'242'272 bytes
                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:low
                                                                Has exited:false

                                                                General

                                                                Target ID:1
                                                                Start time:19:00:01
                                                                Start date:25/04/2024
                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1976,i,4856322800474458559,14778597667407768629,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                Imagebase:0x7ff76e190000
                                                                File size:3'242'272 bytes
                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:low
                                                                Has exited:false

                                                                General

                                                                Target ID:3
                                                                Start time:19:00:05
                                                                Start date:25/04/2024
                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAUDwspAy7QD502hzyLJ-SpwR93P4-0eg6vJM0VREGnzXDSBC2EmgJ8Ke7lx4i8Fs1P_-XwgT4dkJc1NSUtHiaYWpksON0WEUEjoNtLceqGZiHSKnGrgJcEvOmnS6jvBWT&"
                                                                Imagebase:0x7ff76e190000
                                                                File size:3'242'272 bytes
                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:low
                                                                Has exited:true

                                                                Disassembly

                                                                ⊘No disassembly