Edit tour

Windows Analysis Report
https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAApdgKMIBGYD1qMedXlZL2nkNs8tWuKcBT-G7J0emGHRNTlTK60TYJxsCRza2bn6wk8i8xhZn-yeSEPTcS58kRhpB9Nxo9qVvvJSoDhuBUBhe9jZLu35-mAx1R09CNHIlC&

Overview

General Information

Sample URL:	https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAApdgKMIBGYD1qMedXlZL2nkNs8tWuKcBT-G7J0emGHRNTlTK60TYJxsCRza2bn6wk8i8xhZn-yeSEPTcS58kRhpB9Nxo9qVvvJSoDhuBUBhe9jZLu35-mAx1R0
Analysis ID:	1431877
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=2444,i,3560548629565244613,1717576787167524557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAApdgKMIBGYD1qMedXlZL2nkNs8tWuKcBT-G7J0emGHRNTlTK60TYJxsCRza2bn6wk8i8xhZn-yeSEPTcS58kRhpB9Nxo9qVvvJSoDhuBUBhe9jZLu35-mAx1R09CNHIlC&" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: secure.na4.echocdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714076974021&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: chromecache_65.2.dr	String found in binary or memory: http://api.jqueryui.com/position/
Source: chromecache_65.2.dr	String found in binary or memory: http://eightmedia.github.com/hammer.js
Source: chromecache_65.2.dr	String found in binary or memory: http://flesler.blogspot.com
Source: chromecache_65.2.dr	String found in binary or memory: http://flesler.blogspot.com/2007/10/jqueryscrollto.html
Source: chromecache_69.2.dr	String found in binary or memory: http://github.com/wyuenho/backgrid
Source: chromecache_65.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_65.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_67.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000149e7
Source: chromecache_67.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000176ff
Source: chromecache_67.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017701
Source: chromecache_67.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017703
Source: chromecache_69.2.dr	String found in binary or memory: http://www.mozilla.org/MPL/
Source: chromecache_65.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_65.2.dr	String found in binary or memory: https://github.com/gabceb
Source: chromecache_65.2.dr	String found in binary or memory: https://github.com/gabceb/jquery-browser-plugin
Source: chromecache_65.2.dr	String found in binary or memory: https://github.com/hgoebl/mobile-detect.js
Source: chromecache_69.2.dr	String found in binary or memory: https://github.com/imakewebthings/waypoints/blob/master/licenses.txt
Source: chromecache_65.2.dr	String found in binary or memory: https://github.com/jquery/jquery-color
Source: chromecache_65.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_65.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_65.2.dr	String found in binary or memory: https://github.com/websanova/mousestop
Source: chromecache_65.2.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_65.2.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_65.2.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_67.2.dr	String found in binary or memory: https://p.typekit.net/p.gif
Source: chromecache_65.2.dr	String found in binary or memory: https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
Source: chromecache_65.2.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_67.2.dr	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/
Source: chromecache_67.2.dr	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/
Source: chromecache_67.2.dr	String found in binary or memory: https://use.typekit.net/af/e301c6/0000000000000000000149e7/27/
Source: chromecache_67.2.dr	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: unknown	HTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.200.130:443 -> 192.168.2.5:49722 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/22@6/3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=2444,i,3560548629565244613,1717576787167524557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAApdgKMIBGYD1qMedXlZL2nkNs8tWuKcBT-G7J0emGHRNTlTK60TYJxsCRza2bn6wk8i8xhZn-yeSEPTcS58kRhpB9Nxo9qVvvJSoDhuBUBhe9jZLu35-mAx1R09CNHIlC&"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=2444,i,3560548629565244613,1717576787167524557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAApdgKMIBGYD1qMedXlZL2nkNs8tWuKcBT-G7J0emGHRNTlTK60TYJxsCRza2bn6wk8i8xhZn-yeSEPTcS58kRhpB9Nxo9qVvvJSoDhuBUBhe9jZLu35-mAx1R09CNHIlC&	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
https://js.foundation/	0%	URL Reputation	safe
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
www.google.com	64.233.185.106	true	false	high
secure.na4dc2.echosign.com	44.234.124.133	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
use.typekit.net	unknown	unknown	false	high
secure.na4.echocdn.com	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://jquery.org/license	chromecache_65.2.dr	false		high
https://github.com/imakewebthings/waypoints/blob/master/licenses.txt	chromecache_69.2.dr	false		high
https://github.com/twbs/bootstrap/blob/main/LICENSE)	chromecache_65.2.dr	false		high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/	chromecache_67.2.dr	false		high
http://jqueryui.com	chromecache_65.2.dr	false		high
http://api.jqueryui.com/position/	chromecache_65.2.dr	false		high
https://use.typekit.net/af/e301c6/0000000000000000000149e7/27/	chromecache_67.2.dr	false		high
https://getbootstrap.com/)	chromecache_65.2.dr	false		high
https://github.com/jquery/jquery-color	chromecache_65.2.dr	false		high
http://typekit.com/eulas/0000000000000000000149e7	chromecache_67.2.dr	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/	chromecache_67.2.dr	false		high
http://eightmedia.github.com/hammer.js	chromecache_65.2.dr	false		high
https://jquery.org/license	chromecache_65.2.dr	false		high
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE	chromecache_65.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_65.2.dr	false		high
https://github.com/gabceb/jquery-browser-plugin	chromecache_65.2.dr	false		high
https://jquery.com/	chromecache_65.2.dr	false		high
https://p.typekit.net/p.gif	chromecache_67.2.dr	false		high
http://typekit.com/eulas/0000000000000000000176ff	chromecache_67.2.dr	false		high
https://github.com/gabceb	chromecache_65.2.dr	false		high
http://typekit.com/eulas/000000000000000000017701	chromecache_67.2.dr	false		high
http://flesler.blogspot.com	chromecache_65.2.dr	false		high
http://typekit.com/eulas/000000000000000000017703	chromecache_67.2.dr	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/	chromecache_67.2.dr	false		high
https://github.com/hgoebl/mobile-detect.js	chromecache_65.2.dr	false		high
http://github.com/wyuenho/backgrid	chromecache_69.2.dr	false		high
http://flesler.blogspot.com/2007/10/jqueryscrollto.html	chromecache_65.2.dr	false		high
https://github.com/websanova/mousestop	chromecache_65.2.dr	false		high
https://sizzlejs.com/	chromecache_65.2.dr	false		high
https://js.foundation/	chromecache_65.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
64.233.185.106	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431877
Start date and time:	2024-04-25 22:28:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAApdgKMIBGYD1qMedXlZL2nkNs8tWuKcBT-G7J0emGHRNTlTK60TYJxsCRza2bn6wk8i8xhZn-yeSEPTcS58kRhpB9Nxo9qVvvJSoDhuBUBhe9jZLu35-mAx1R09CNHIlC&
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/22@6/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 64.233.176.94, 74.125.136.138, 74.125.136.113, 74.125.136.100, 74.125.136.101, 74.125.136.139, 74.125.136.102, 108.177.122.84, 34.104.35.123, 44.234.124.132, 44.234.124.133, 44.234.124.131, 96.7.225.25, 96.7.225.33, 23.40.205.40, 23.40.205.73, 13.85.23.86, 199.232.210.172, 192.229.211.108, 199.232.214.172, 13.85.23.206, 20.166.126.56, 72.21.81.240, 142.250.105.94, 23.40.205.8, 23.40.205.65, 23.40.205.49, 23.40.205.74, 23.40.205.83, 23.40.205.17, 23.40.205.59, 23.40.205.67, 23.40.205.26
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAApdgKMIBGYD1qMedXlZL2nkNs8tWuKcBT-G7J0emGHRNTlTK60TYJxsCRza2bn6wk8i8xhZn-yeSEPTcS58kRhpB9Nxo9qVvvJSoDhuBUBhe9jZLu35-mAx1R09CNHIlC&

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:29:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9865827647980727
Encrypted:	false
SSDEEP:	48:8IdmTCmhXwHzidAKZdA19ehwiZUklqehr1ny+3:8xnhX4S5y
MD5:	F95FD466A410F79D280022508FE962ED
SHA1:	935E3B6443F5BE7B7D6B6E49752D7F05D8EC02A7
SHA-256:	96EF7C8E6A026B6636A9DE4EBBD502655C3952416254E11EFD4926A63CB8738D
SHA-512:	C66A167A72596BBED05B9F29360A5F12C7DA381B1B91C3478AEC6FD7BCECE3820A6AD6E9351B1D9BAE744EF3726E81BBE0099D172523859FCD542883D5760A8F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......QO...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D.q-.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:29:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9982838242196945
Encrypted:	false
SSDEEP:	48:80dmTCmhXwHzidAKZdA1weh/iZUkAQkqehC1ny+2:8VnhXS9Ql5y
MD5:	B8E26DB90FF3FA97E58F2DD418CB9A5B
SHA1:	D82230191FEAC58D859092316887A331DF52B0C5
SHA-256:	6DA38377EBBA80C11E9DF60BE096AF235152132ACFD6E1CBBDB3AF2FF2D1098D
SHA-512:	4E6B89F93F2FBB2D3A5B451E930E5D84C3BF4C1BE5A68886BD43D642E9BB34FEA73226A112BE085A9CB68F98B6B4B3E20498C7BB3EA23EC1878FD6EE851434DF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......QO...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D.q-.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.009021849930103
Encrypted:	false
SSDEEP:	48:8xHdmTCmsHzidAKZdA14tseh7sFiZUkmgqeh7sc1ny+BX:8xInmnW5y
MD5:	55E49F91C25A64E7C8D2083BB66CB88A
SHA1:	3ED84756E8D18E52F178C90EECA2AC1DEE44FA00
SHA-256:	B2E0F5A31FD9488065576A374701A7FC7F77498ADB12196C8E4F698EC7E9922D
SHA-512:	45093B858B9612E26735CFD4EB9144D13602190E8AF7362DCBC6C7195896FAAAA93C98BD7042BC9DE9DA6F7C78F0AB146D903CCE3906795B1347D6E64A7CF84C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D.q-.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:29:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9972569277895564
Encrypted:	false
SSDEEP:	48:8WdmTCmhXwHzidAKZdA1vehDiZUkwqeh+1ny+R:8/nhX5E5y
MD5:	5EE123092C0F0079B71F8EC556D366B3
SHA1:	181321C62078E01C62B36FABD1B3BF39D38D6E07
SHA-256:	97221C1C334B6444203079A1EE4F30E605F6E0C574506A7F00CD6EFAE3C3447D
SHA-512:	B381C600478BCA67E7A1A31459865CC0596CD870443CE90C91076712B45B2C7FF7A01FD18EF26289A27EE5FBA03E8102E672C6B425A745677A7FFE4857BA1C0B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....%..QO...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D.q-.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:29:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.987377654551447
Encrypted:	false
SSDEEP:	48:8/dmTCmhXwHzidAKZdA1hehBiZUk1W1qehw1ny+C:8wnhXJ9Q5y
MD5:	8D50EF1D340F48D4E5F3A04561FF0BCD
SHA1:	8C70FF3BD46B24063D48D1D3DC211E140B16AD42
SHA-256:	2A0E8CB22BFB00AF83CA6D4203EF2A59AE0AD84946CCAC6E374F28AC418DB18B
SHA-512:	A86521D377B8B672BA663CD497E2795BDABFDF4D5A5BA75919B10DEBA0549E2A767B2C6CECF65BBE322883CF6BB1FD475806859B67C9CCAEE468BA32DB9B2884
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....}V.QO...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D.q-.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:29:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.998684423700414
Encrypted:	false
SSDEEP:	48:8YdmTCmhXwHzidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbW1ny+yT+:8hnhXVT/TbxWOvTbW5y7T
MD5:	141F2ADE83B0C590F423F03931C8E788
SHA1:	B1256674CAB95AAF93CDEF372C1ED8EDB803C2E1
SHA-256:	EA94FB9E99EB89C57CED03A7E87C415FC2945FBA61A38322A12EB174F2C68B84
SHA-512:	E3A034849C81F0CE269DFF464455AF1608EE6379DB3DC0E111F6DFF30D5BD4E072CD268F363E86439B27F866837EC1B6046BFE34E374BF9B374FCC70B61F07A6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......QO...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D.q-.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5632), with no line terminators
Category:	downloaded
Size (bytes):	5632
Entropy (8bit):	5.320327818450802
Encrypted:	false
SSDEEP:	48:4uTVQW0Q/tCkJquYzg55551T5lU6wVAnq1pDlIVKynCFfludpYmCSJFfeuEtMVuJ:LT6g/ZuWx1t+VAnq1pDlKCXpSJ+WkaAF
MD5:	4B3C669E1B6B635DE4B64BE0A1157D42
SHA1:	65DE7AB428CC08DF3DF028181ACDC53E10014AC7
SHA-256:	0AFA57E1DD77793527F83DD90004CA5E09647B5B5B08FF7D02A723C9468BFE4C
SHA-512:	80A40B7B46D9491ADC8C3CCF8F2B72EA89FFC00A465F07ED2526F3C1B1063805F0C0A0B3AC43664B538732E9DA415DD87F07A36BD264A5B20DB848849FA1FA88
Malicious:	false
Reputation:	low
URL:	https://secure.na4.echocdn.com/resource/1730650309/bundles/toast-message.css
Preview:	#toast-container{display:flex;position:fixed;right:0;z-index:100050;-ms-flex-direction:column;flex-direction:column;-ms-flex-align:center;align-items:flex-end;}#toast-main-view{display:none;-webkit-animation:fadein 0.3s, fadeout 1s 6.5s;animation:fadein 0.5s, fadeout 1s 6.5s;}.toast{box-sizing:border-box;line-height:1.5;display:inline-flex;-ms-flex-direction:row;flex-direction:row;-ms-flex-align:stretch;align-items:stretch;border-radius:4px;padding:8px 8px 8px 16px;font-size:14px;font-weight:700;-webkit-font-smoothing:antialiased;margin:8px;}.toast--success{background-color:rgb(18, 128, 92);color:rgb(18, 128, 92);}.toast--error{background-color:rgb(232, 9, 28);color:rgb(232, 9, 28);}.toast--info{background-color:rgb(9, 90, 186);color:rgb(9, 90, 186);max-width:415px;}.toast--top-right{right:0;}.toast--top-middle{right:40% !important;top:66px;}.toast--button-secondary{border-color:white !important;}.toast--button-primary{}.toast--button-secondary-center{border-color:white !important;floa

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (60557)
Category:	downloaded
Size (bytes):	936918
Entropy (8bit):	5.519080124550211
Encrypted:	false
SSDEEP:	12288:50jTWVt3qz0Kcl42KOusstfuUr0VHbz0JPHihkUgxC:50mHqz0JlvusstfuUoVHbz0JPHiKNs
MD5:	C183FDE7C6203CEB846358AD3D3AF16B
SHA1:	189F0274DC5E629E593DA1A09270BEB4BDD4CFA6
SHA-256:	A8781541B990C82B79904A4BAF39C4B8D1F4D6E73337207C9C80BCDDF3A09FDD
SHA-512:	4E3C54C95F9EC89002CF41B5CC6905832E148C6211C7675915E2C764794416DB10FFFB2D2F76FBA55176E34A7F93192E5D4AA474C76E06E28177148E53CAAC41
Malicious:	false
Reputation:	low
URL:	https://secure.na4.echocdn.com/resource/1856245629.en_US/bundles/app-main.js
Preview:	/!. jQuery JavaScript Library v3.5.1. * https://jquery.com/. . Includes Sizzle.js. * https://sizzlejs.com/. . Copyright JS Foundation and other contributors. * Released under the MIT license. * https://jquery.org/license. . Date: 2020-05-04T22:49Z. */.(function(b,a){if(typeof module==="object"&&typeof module.exports==="object"){module.exports=b.document?a(b,true):function(c){if(!c.document){throw new Error("jQuery requires a window with a document")}return a(c)}}else{a(b)}})(typeof window!=="undefined"?window:this,function(a1,ay){var m=[];var aP=Object.getPrototypeOf;var aa=m.slice;var bV=m.flat?function(b1){return m.flat.call(b1)}:function(b1){return m.concat.apply([],b1)};var x=m.push;var bR=m.indexOf;var aj={};var z=aj.toString;var U=aj.hasOwnProperty;var aB=U.toString;var bk=aB.call(Object);var J={};var y=function y(b1){return typeof b1==="function"&&typeof b1.nodeType!=="number"};var aE=function aE(b1){return b1!=null&&b1===b1.window};var l=a1.document;var be={type:tru

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4938)
Category:	downloaded
Size (bytes):	77493
Entropy (8bit):	5.781608461985365
Encrypted:	false
SSDEEP:	768:fKF2+CV2Ub5meb+m88sbxeQ6gdKV7FaeCvVstAliVNgdKV7Uf3GhvdYFhvdYwhvZ:fK3CX8plkFWkFUv
MD5:	DC8D34966443C527E00358DFF0772799
SHA1:	34ACCA8C275A61A80350038A6F0C92C6489692E7
SHA-256:	9BEB3A18B34136438721D95B3FCB843BAA524B9031B5E770028E93DE9C9ACC7B
SHA-512:	808A65C7A124695A6D5A94C438AF051F0993ADBA4A74F9675ACE704F02DDD46130D14533BD848166878EE49F3D8D9533CEF1031177281010E23D9FCC2EB1230E
Malicious:	false
Reputation:	low
URL:	https://secure.na4.echocdn.com/resource/1715228063/bundles/esignResponsive.css
Preview:	.disabled-opacity {. opacity: 0.5;. -ms-filter: "progid:DXImageTransform.Microsoft.Alpha(Opacity=50)";.}..no-box-shadow {. box-shadow: none;. -webkit-box-shadow: none;.}./**** MODALS *****/.html.mobile #contentSubHeader .agreement-header .dark-mode {. background: #2d2d2d !important;.}.html.mobile #contentSubHeader .agreement-header .dark-mode .agreement-container {. align-items: center;. display: flex;. height: 56px;.}.html.mobile #contentSubHeader .agreement-header .dark-mode .agreement-container .lastsave .lastsave-info-icon {. margin: -11px 0 0 0;.}.html.mobile #contentSubHeader .agreement-header .dark-mode.agreement-band.navbar {. height: 56px;. border: 0;.}.html.mobile #contentSubHeader .agreement-header .dark-mode.agreement-band.navbar .agreement-req-info {. padding-top: 8px;. padding-left: 0;.}.html.mobile #contentSubHeader .agreement-header .dark-mode.agreement-band.navbar .agreement-req-info .completed-info {. margin-top: -6px;. float: right;. margin-right:

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2258)
Category:	downloaded
Size (bytes):	17476
Entropy (8bit):	5.5562021281521154
Encrypted:	false
SSDEEP:	384:mIHI2hpIgIVsUGiRm4lIeU4iDFeFs2NdFJsQF+i:mIHg7GiRm4X0JqsG7Ui
MD5:	80AA1425E8422CAEF6A4DEFFDA2F5A38
SHA1:	BCADA77A87D8F10F1CA4ADE8D393B2AD9988AD13
SHA-256:	1B3329DED46F847B991CE76CBD6252FC0322BED2ADA2535143B58543109E271D
SHA-512:	9DD29547A084858ACD7ADA9E451185983F8BD1B5C1D35DDA15A6BB52CA7D3B65DD8A604BDAE580B000748481DC71A224A0EAE7006C576F50F5EE8087C3B1DF2D
Malicious:	false
Reputation:	low
URL:	https://use.typekit.net/fqg8osp.js
Preview:	/. The Typekit service used to deliver this font or fonts for use on websites. * is provided by Adobe and is subject to these Terms of Use. * http://www.adobe.com/products/eulas/tou_typekit. For font license. * information, see the list below.. . adobe-clean:. * - http://typekit.com/eulas/000000000000000000017701. * - http://typekit.com/eulas/000000000000000000017703. * - http://typekit.com/eulas/0000000000000000000176ff. * adobe-hand-b:. * - http://typekit.com/eulas/0000000000000000000149e7. . . 2009-2024 Adobe Systems Incorporated. All Rights Reserved.. */.if(!window.Typekit)window.Typekit={};window.Typekit.config={"a":"717200","c":[".tk-adobe-clean","\"adobe-clean\",sans-serif",".tk-adobe-hand-b","\"adobe-hand-b\",sans-serif"],"fi":[7180,7182,7184,22766],"fc":[{"id":7180,"family":"adobe-clean","src":"https://use.typekit.net/af/cb695f/000000000000000000017701/27/{format}{?primer,subset_id,fvd,v}","descriptors":{"weight":"400","style":"normal","stretch":"normal","dis

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	135602
Entropy (8bit):	5.052432544669672
Encrypted:	false
SSDEEP:	1536:Po36puuzWBlflZQspIfqPQ3ZiRFjBRvxm+DRarYf2LI2IlIRIIIwWEQ1lePh:Po36putBlflRPRXRH2LI2IlIRIIIwWy
MD5:	2356B03B907A7EC07D8116FB0A2050B0
SHA1:	0B22F9D97B5DA8501FF22FC42EFE203883625BDF
SHA-256:	524F0F5D0AE32D1DDFFBA2C0AB8D530D8EE634CD5259AF326FBF6B6557F7372B
SHA-512:	16C9A9E6E2469A2398BD5C62BF6EBEDB1DCCC19A9BAD4FBF3A4EBCD8094619A9964FDB727703D521097E5C2817881D52997EAB8A6A1AFF313EF800D20A56BA17
Malicious:	false
Reputation:	low
URL:	https://secure.na4.echocdn.com/resource/1097130768/bundles/esignJS.css
Preview:	.disabled-opacity{opacity:0.5;-ms-filter:"progid:DXImageTransform.Microsoft.Alpha(Opacity=50)";}.no-box-shadow{box-shadow:none;-webkit-box-shadow:none;}.wrapLongText{white-space:pre;white-space:pre-wrap;white-space:pre-line;white-space:-pre-wrap;white-space:-o-pre-wrap;white-space:-moz-pre-wrap;white-space:-hp-pre-wrap;word-wrap:break-word;}.has-error-color{color:#D83742;}.has-error-border{border:1px solid #D83742;}.has-error-background{background-color:#ffffff;}.has-error-common{border:1px solid #D83742;color:#D83742;box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);-o-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);-moz-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);-webkit-box-shadow:inset 0 1px 1px rgba(0, 0, 0, 0.075);}.has-error-font{font-size:16px;font-weight:normal;}.has-error-token-background{background-color:#ffffff;}.has-error-token-background:hover{background-color:#fae3e0;}.has-error-token-background:active, .has-error-token-background:focus{background-color:#fccdc7;}.disab

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (39221)
Category:	downloaded
Size (bytes):	1210636
Entropy (8bit):	5.4368448012650505
Encrypted:	false
SSDEEP:	24576:nhqsx5yEH5i+1EaCGRTK16Asebc1hPhYtVOSr0/9CyHmz0CK:hqIHH5i+1EaCGRTK16Asebc1hPhYtVOD
MD5:	F9480B84F852C3B321A77E46310AF086
SHA1:	7D9C2D3988D665979EE7A361B2F7596CBA6A34C4
SHA-256:	F4A70684164143E8EA469C2E1C6CABA92501BCE9B243B5FD047CC677DF9DD340
SHA-512:	B6B4A9DB89D19F933174B45685D3585C9AC6B1D13ECD93E3E4C1450718EF914DDBD3766E09080CCF3216827AE6E05935CF9D330601A3FD581A0C0522AC4EF2F0
Malicious:	false
Reputation:	low
URL:	https://secure.na4.echocdn.com/resource/1248589626.en_US/bundles/app-esign.js
Preview:	/!. backgrid. http://github.com/wyuenho/backgrid.. Copyright (c) 2014 Jimmy Yuen Ho Wong and contributors <wyuenho@gmail.com>. Licensed under the MIT license../.(function(a){if(typeof exports=="object"){module.exports=a(module.exports,require("underscore"),require("backbone"))}else{a(this,this._,this.Backbone)}}(function(v,Q,E){var P="\x09\x0A\x0B\x0C\x0D\x20\xA0\u1680\u180E\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200A\u202F\u205F\u3000\u2028\u2029\uFEFF";if(!String.prototype.trim\|\|P.trim()){P="["+P+"]";var x=new RegExp("^"+P+P+""),p=new RegExp(P+P+"$");String.prototype.trim=function a(){if(this===undefined\|\|this===null){throw new TypeError("can't convert "+this+" to object")}return String(this).replace(x,"").replace(p,"")}}function F(X,U,T){var W=U-(X+"").length;W=W<0?0:W;var V="";for(var S=0;S<W;S++){V=V+T}return V+X}var C=E.$;var R=v.Backgrid={Extension:{},resolveNameToClass:function(T,V){if(Q.isString(T)){var U=Q.map(T.split("-"),function(W){return W.sl

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65533), with no line terminators
Category:	downloaded
Size (bytes):	369897
Entropy (8bit):	5.444028530568237
Encrypted:	false
SSDEEP:	3072:ZXKElkD8gK1C8lizh3ODBvOkBBO/mCs4QAEf2tEfVfs2i8:ZXI8gK1C8lizh3ODBvOkBBOOCh+h9i8
MD5:	D2836BB701B215B7F6CC1A65F7137FFD
SHA1:	5A0C8062616E2B4E2DC55B54AD7BA333F56EA19B
SHA-256:	EE1EEF26F4071F30477DBA5B1BDD77D90B3B1A8EAEF85AA55E2317C9F26982DB
SHA-512:	8381426D335EBB379145E85093CF2D7D854B288083AE86CCE52AFA84E4CD1AE6C8D4166A7F93816EEFCE769EE20B0FEC1644D343B83F431FA57766BFA84064E4
Malicious:	false
Reputation:	low
URL:	https://secure.na4.echocdn.com/resource/N1614084111/bundles/app-theme.css
Preview:	.slider{display:inline-block;vertical-align:middle;position:relative;}.slider.slider-horizontal{width:210px;height:20px;}.slider.slider-horizontal .slider-track{height:10px;width:100%;margin-top:-5px;top:50%;left:0;}.slider.slider-horizontal .slider-selection{height:100%;top:0;bottom:0;}.slider.slider-horizontal .slider-handle{margin-left:-10px;margin-top:-5px;}.slider.slider-horizontal .slider-handle.triangle{border-width:0 10px 10px 10px;width:0;height:0;border-bottom-color:#0480be;margin-top:0;}.slider.slider-vertical{height:210px;width:20px;}.slider.slider-vertical .slider-track{width:10px;height:100%;margin-left:-5px;left:50%;top:0;}.slider.slider-vertical .slider-selection{width:100%;left:0;top:0;bottom:0;}.slider.slider-vertical .slider-handle{margin-left:-5px;margin-top:-10px;}.slider.slider-vertical .slider-handle.triangle{border-width:10px 0 10px 10px;width:1px;height:1px;border-left-color:#0480be;margin-left:0;}.slider input{display:none;}.slider .tooltip-inner{white-space:n

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65533), with no line terminators
Category:	downloaded
Size (bytes):	488483
Entropy (8bit):	5.103272772215297
Encrypted:	false
SSDEEP:	3072:bivxgPYrcTjVqodlvK3tfg6NtOJPGUdF4PHmTvFfERO8OA:Wvh6jVqSvEtfgWIJPVdF4vqvFf+OA
MD5:	26E29F0C91622E83BD33DEDF2C7FF0CA
SHA1:	645A266B9979279786BD273F6084166736A1FF10
SHA-256:	3567438FF892CE3947216B7648C506926CFCD080E577F1C46CBE1D87DF41040B
SHA-512:	741E1F978D6CCD3302D1710133B36880D7FD3DFBCE300AD004BC2274C0BEB8152B1816472EB3D8474655BBCF5DBDC06ED1EE3E581750B9DA75247AA917B485FC
Malicious:	false
Reputation:	low
URL:	https://secure.na4.echocdn.com/resource/N2068235899.en_US/bundles/translations.js
Preview:	(function(){function a(e,d){for(var c=0;c<d.length;c++){e=e.replace("{"+c+"}",d[c])}return e}function b(){var f=arguments[0];var e;if(f.indexOf("{0}")!=-1){e=function(){return a(f,arguments)}}else{e=function(){return f}}for(var c=1;c<arguments.length;c++){for(var d in arguments[c]){e[d]=arguments[c][d]}}return e}window.i18n=({country:{PS:b("Palestinian Territory"),PT:b("Portugal"),PY:b("Paraguay"),QA:b("Qatar"),AD:b("Andorra"),AE:b("United Arab Emirates"),AF:b("Afghanistan"),AG:b("Antigua and Barbuda"),AI:b("Anguilla"),AL:b("Albania"),AM:b("Armenia"),AN:b("Netherlands Antilles"),AO:b("Angola"),AQ:b("Antarctica"),AR:b("Argentina"),RE:b("R.union"),AT:b("Austria"),AU:b("Australia"),AW:b("Aruba"),AZ:b("Azerbaijan"),RO:b("Romania"),BA:b("Bosnia and Herzegovina"),BB:b("Barbados"),RS:b("Serbia"),BD:b("Bangladesh"),RU:b("Russia"),BE:b("Belgium"),BF:b("Burkina Faso"),RW:b("Rwanda"),BG:b("Bulgaria"),BH:b("Bahrain"),BI:b("Burundi"),BJ:b("Benin"),BM:b("Bermuda"),BN:b("Brunei"),BO:b("Bolivia"),SA:

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 22:29:43.878829002 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:29:43.878844976 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:29:43.988322020 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:29:51.964487076 CEST	49720	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:29:51.964574099 CEST	443	49720	64.233.185.106	192.168.2.5
Apr 25, 2024 22:29:51.964656115 CEST	49720	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:29:51.966697931 CEST	49720	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:29:51.966736078 CEST	443	49720	64.233.185.106	192.168.2.5
Apr 25, 2024 22:29:52.194438934 CEST	443	49720	64.233.185.106	192.168.2.5
Apr 25, 2024 22:29:52.195647955 CEST	49720	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:29:52.195707083 CEST	443	49720	64.233.185.106	192.168.2.5
Apr 25, 2024 22:29:52.196641922 CEST	443	49720	64.233.185.106	192.168.2.5
Apr 25, 2024 22:29:52.196711063 CEST	49720	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:29:52.197711945 CEST	49720	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:29:52.197777033 CEST	443	49720	64.233.185.106	192.168.2.5
Apr 25, 2024 22:29:52.248563051 CEST	49720	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:29:52.248619080 CEST	443	49720	64.233.185.106	192.168.2.5
Apr 25, 2024 22:29:52.292078018 CEST	49720	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:29:52.412007093 CEST	49721	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:52.412026882 CEST	443	49721	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:52.412117004 CEST	49721	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:52.416079998 CEST	49721	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:52.416089058 CEST	443	49721	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:52.648648024 CEST	443	49721	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:52.648745060 CEST	49721	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:52.656059980 CEST	49721	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:52.656075001 CEST	443	49721	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:52.656491041 CEST	443	49721	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:52.702169895 CEST	49721	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:52.857043982 CEST	49721	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:52.900125027 CEST	443	49721	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:52.971764088 CEST	443	49721	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:52.971942902 CEST	443	49721	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:52.971999884 CEST	49721	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:52.972116947 CEST	49721	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:52.972132921 CEST	443	49721	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:52.972146988 CEST	49721	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:52.972151995 CEST	443	49721	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.050209045 CEST	49722	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:53.050244093 CEST	443	49722	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.050316095 CEST	49722	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:53.051975012 CEST	49722	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:53.051991940 CEST	443	49722	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.284044027 CEST	443	49722	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.284147978 CEST	49722	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:53.285698891 CEST	49722	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:53.285706997 CEST	443	49722	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.286273956 CEST	443	49722	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.287357092 CEST	49722	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:53.332123041 CEST	443	49722	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.480628967 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:29:53.480638981 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:29:53.499454975 CEST	443	49722	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.499692917 CEST	443	49722	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.499747992 CEST	49722	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:53.500477076 CEST	49722	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:53.500489950 CEST	443	49722	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.500502110 CEST	49722	443	192.168.2.5	23.54.200.130
Apr 25, 2024 22:29:53.500507116 CEST	443	49722	23.54.200.130	192.168.2.5
Apr 25, 2024 22:29:53.589459896 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:29:54.983113050 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 25, 2024 22:29:54.983206034 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:02.260523081 CEST	443	49720	64.233.185.106	192.168.2.5
Apr 25, 2024 22:30:02.260592937 CEST	443	49720	64.233.185.106	192.168.2.5
Apr 25, 2024 22:30:02.260696888 CEST	49720	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:30:03.650696039 CEST	49720	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:30:03.650741100 CEST	443	49720	64.233.185.106	192.168.2.5
Apr 25, 2024 22:30:05.427741051 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:05.427824020 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:05.428366899 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:05.428450108 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:05.428525925 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:05.429100037 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:05.429121017 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:05.586399078 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:05.586419106 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:05.754606009 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:05.754713058 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:05.803800106 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:05.803844929 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:05.804238081 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:05.804297924 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:05.804893970 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:05.804923058 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:05.805072069 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:05.805083990 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:06.112070084 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:06.112169027 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:06.112548113 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:06.112621069 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:06.112673044 CEST	443	49731	23.1.237.91	192.168.2.5
Apr 25, 2024 22:30:06.112730980 CEST	49731	443	192.168.2.5	23.1.237.91
Apr 25, 2024 22:30:51.903433084 CEST	49736	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:30:51.903515100 CEST	443	49736	64.233.185.106	192.168.2.5
Apr 25, 2024 22:30:51.903592110 CEST	49736	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:30:51.903913975 CEST	49736	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:30:51.903934956 CEST	443	49736	64.233.185.106	192.168.2.5
Apr 25, 2024 22:30:52.135214090 CEST	443	49736	64.233.185.106	192.168.2.5
Apr 25, 2024 22:30:52.135570049 CEST	49736	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:30:52.135603905 CEST	443	49736	64.233.185.106	192.168.2.5
Apr 25, 2024 22:30:52.136713028 CEST	443	49736	64.233.185.106	192.168.2.5
Apr 25, 2024 22:30:52.137264013 CEST	49736	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:30:52.137429953 CEST	443	49736	64.233.185.106	192.168.2.5
Apr 25, 2024 22:30:52.185623884 CEST	49736	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:31:02.162009954 CEST	443	49736	64.233.185.106	192.168.2.5
Apr 25, 2024 22:31:02.162098885 CEST	443	49736	64.233.185.106	192.168.2.5
Apr 25, 2024 22:31:02.162168980 CEST	49736	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:31:03.621985912 CEST	49736	443	192.168.2.5	64.233.185.106
Apr 25, 2024 22:31:03.622061968 CEST	443	49736	64.233.185.106	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 22:29:47.323971987 CEST	53	56312	1.1.1.1	192.168.2.5
Apr 25, 2024 22:29:47.368299961 CEST	53	56644	1.1.1.1	192.168.2.5
Apr 25, 2024 22:29:48.036744118 CEST	53	49257	1.1.1.1	192.168.2.5
Apr 25, 2024 22:29:48.653342962 CEST	53	52284	1.1.1.1	192.168.2.5
Apr 25, 2024 22:29:50.056751013 CEST	58950	53	192.168.2.5	1.1.1.1
Apr 25, 2024 22:29:50.057038069 CEST	57368	53	192.168.2.5	1.1.1.1
Apr 25, 2024 22:29:50.167839050 CEST	53	58950	1.1.1.1	192.168.2.5
Apr 25, 2024 22:29:50.168020964 CEST	53	57368	1.1.1.1	192.168.2.5
Apr 25, 2024 22:29:51.851357937 CEST	50323	53	192.168.2.5	1.1.1.1
Apr 25, 2024 22:29:51.851577997 CEST	53363	53	192.168.2.5	1.1.1.1
Apr 25, 2024 22:29:51.961464882 CEST	53	50323	1.1.1.1	192.168.2.5
Apr 25, 2024 22:29:51.962263107 CEST	53	53363	1.1.1.1	192.168.2.5
Apr 25, 2024 22:29:55.522325039 CEST	56918	53	192.168.2.5	1.1.1.1
Apr 25, 2024 22:29:55.522463083 CEST	64820	53	192.168.2.5	1.1.1.1
Apr 25, 2024 22:30:05.501369953 CEST	53	65064	1.1.1.1	192.168.2.5
Apr 25, 2024 22:30:24.280891895 CEST	53	51469	1.1.1.1	192.168.2.5
Apr 25, 2024 22:30:47.217489004 CEST	53	62226	1.1.1.1	192.168.2.5
Apr 25, 2024 22:30:47.514059067 CEST	53	60187	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 22:29:50.056751013 CEST	192.168.2.5	1.1.1.1	0xb9fe	Standard query (0)	secure.na4.echocdn.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:50.057038069 CEST	192.168.2.5	1.1.1.1	0x77ed	Standard query (0)	secure.na4.echocdn.com	65	IN (0x0001)	false
Apr 25, 2024 22:29:51.851357937 CEST	192.168.2.5	1.1.1.1	0x3a95	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:51.851577997 CEST	192.168.2.5	1.1.1.1	0xe438	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 25, 2024 22:29:55.522325039 CEST	192.168.2.5	1.1.1.1	0xcf7c	Standard query (0)	use.typekit.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:55.522463083 CEST	192.168.2.5	1.1.1.1	0x279c	Standard query (0)	use.typekit.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 22:29:50.167839050 CEST	1.1.1.1	192.168.2.5	0xb9fe	No error (0)	secure.na4.echocdn.com	secure.na4dc2.echosign.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:29:50.167839050 CEST	1.1.1.1	192.168.2.5	0xb9fe	No error (0)	secure.na4dc2.echosign.com		44.234.124.133	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:50.167839050 CEST	1.1.1.1	192.168.2.5	0xb9fe	No error (0)	secure.na4dc2.echosign.com		44.234.124.131	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:50.167839050 CEST	1.1.1.1	192.168.2.5	0xb9fe	No error (0)	secure.na4dc2.echosign.com		44.234.124.132	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:50.168020964 CEST	1.1.1.1	192.168.2.5	0x77ed	No error (0)	secure.na4.echocdn.com	secure.na4dc2.echosign.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:29:51.961464882 CEST	1.1.1.1	192.168.2.5	0x3a95	No error (0)	www.google.com		64.233.185.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:51.961464882 CEST	1.1.1.1	192.168.2.5	0x3a95	No error (0)	www.google.com		64.233.185.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:51.961464882 CEST	1.1.1.1	192.168.2.5	0x3a95	No error (0)	www.google.com		64.233.185.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:51.961464882 CEST	1.1.1.1	192.168.2.5	0x3a95	No error (0)	www.google.com		64.233.185.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:51.961464882 CEST	1.1.1.1	192.168.2.5	0x3a95	No error (0)	www.google.com		64.233.185.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:51.961464882 CEST	1.1.1.1	192.168.2.5	0x3a95	No error (0)	www.google.com		64.233.185.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:29:51.962263107 CEST	1.1.1.1	192.168.2.5	0xe438	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 22:29:55.632430077 CEST	1.1.1.1	192.168.2.5	0xcf7c	No error (0)	use.typekit.net	use-stls.adobe.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:29:55.632457972 CEST	1.1.1.1	192.168.2.5	0x279c	No error (0)	use.typekit.net	use-stls.adobe.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:30:04.759996891 CEST	1.1.1.1	192.168.2.5	0xe06c	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:30:04.759996891 CEST	1.1.1.1	192.168.2.5	0xe06c	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:30:04.992944956 CEST	1.1.1.1	192.168.2.5	0x17e3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:30:04.992944956 CEST	1.1.1.1	192.168.2.5	0x17e3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:30:18.378007889 CEST	1.1.1.1	192.168.2.5	0x7bbf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:30:18.378007889 CEST	1.1.1.1	192.168.2.5	0x7bbf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

https:

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49721	23.54.200.130	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:29:52 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 20:29:52 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=124403 Date: Thu, 25 Apr 2024 20:29:52 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49722	23.54.200.130	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:29:53 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 20:29:53 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=124390 Date: Thu, 25 Apr 2024 20:29:53 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-25 20:29:53 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49731	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:30:05 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714076974021&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-25 20:30:05 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-25 20:30:05 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-25 20:30:06 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C4C4C56194CD4166A91480FC7E7EFF8C Ref B: LAX311000112023 Ref C: 2024-04-25T20:30:05Z Date: Thu, 25 Apr 2024 20:30:06 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1714077005.cf78c08

Target ID:	0
Start time:	22:29:44
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	22:29:46
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=2444,i,3560548629565244613,1717576787167524557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	22:29:47
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAApdgKMIBGYD1qMedXlZL2nkNs8tWuKcBT-G7J0emGHRNTlTK60TYJxsCRza2bn6wk8i8xhZn-yeSEPTcS58kRhpB9Nxo9qVvvJSoDhuBUBhe9jZLu35-mAx1R09CNHIlC&"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAApdgKMIBGYD1qMedXlZL2nkNs8tWuKcBT-G7J0emGHRNTlTK60TYJxsCRza2bn6wk8i8xhZn-yeSEPTcS58kRhpB9Nxo9qVvvJSoDhuBUBhe9jZLu35-mAx1R09CNHIlC&

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6776, Parent PID: 5748

General

Windows Analysis Report
https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAApdgKMIBGYD1qMedXlZL2nkNs8tWuKcBT-G7J0emGHRNTlTK60TYJxsCRza2bn6wk8i8xhZn-yeSEPTcS58kRhpB9Nxo9qVvvJSoDhuBUBhe9jZLu35-mAx1R09CNHIlC&