Edit tour

Windows Analysis Report
https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6Ikxza3JpcEBoYWlncm91cC5jb20iLCJyZXF1ZXN0SWQiOiIwYjZhYWRmNS0wZjFhLTQ2YmUtNThkMC01MWJiYjc0MGI1N2UiLCJsaW5rIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmN

Overview

General Information

Sample URL:	https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6Ikxza3JpcEBoYWlncm91cC5jb20iLCJyZXF1ZXN
Analysis ID:	1546695
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Drops files with a non-matching file extension (content does not match file extension)

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 4796 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1928,i,1697272281459918872,6439475264855140221,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6Ikxza3JpcEBoYWlncm91cC5jb20iLCJyZXF1ZXN0SWQiOiIwYjZhYWRmNS0wZjFhLTQ2YmUtNThkMC01MWJiYjc0MGI1N2UiLCJsaW5rIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9pZC91cm46YWFpZDpzYzpWQTZDMjoyOGMzZjVjYS00ZWQzLTRhNTEtYWZiMC1hZjIxOTM0OTdlNTkiLCJsYWJlbCI6IjEyIiwibG9jYWxlIjoiZW5fVVMifQ._8FMpgIlJaL8t_oFi82d6XGNnzc2WfW_TfYxKziFaR71h8ZGtJ7PBv8KBam5pa7ud8u9KZnD4KW90UZjwVvtBg" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:43:42.353883+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.16	49793	TCP
2024-11-01T13:44:20.186274+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.16	49906	TCP

HTTP traffic detected: POST /api/4507022599913472/envelope/?sentry_key=a70bff58cd4048f9e05163230edfd1bd&sentry_version=7 HTTP/1.1Host: o4505393339695104.ingest.us.sentry.ioConnection: keep-aliveContent-Length: 578sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://acrobat.adobe.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://acrobat.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49906 version: TLS 1.2

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.16:49793
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.16:49906

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /rendition/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59;page=0;size=1200;type=image%2Fjpeg?access_token=1730507971_urn%3Aaaid%3Asc%3AVA6C2%3A28c3f5ca-4ed3-4a51-afb0-af2193497e59%3Bpublic_383ea3def3b3eb5568608beed4754fb9decbd811&api_key=dc_sendtrack HTTP/1.1Host: cdn-sharing.adobecc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://acrobat.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rendition/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59;page=1;size=1200;type=image%2Fjpeg?access_token=1730507971_urn%3Aaaid%3Asc%3AVA6C2%3A28c3f5ca-4ed3-4a51-afb0-af2193497e59%3Bpublic_383ea3def3b3eb5568608beed4754fb9decbd811&api_key=dc_sendtrack HTTP/1.1Host: cdn-sharing.adobecc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://acrobat.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rendition/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59;page=0;size=1200;type=image%2Fjpeg?access_token=1730507971_urn%3Aaaid%3Asc%3AVA6C2%3A28c3f5ca-4ed3-4a51-afb0-af2193497e59%3Bpublic_383ea3def3b3eb5568608beed4754fb9decbd811&api_key=dc_sendtrack HTTP/1.1Host: cdn-sharing.adobecc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tDT+9cW5VnA4gau&MD=Utt+Rz3o HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rendition/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59;page=1;size=1200;type=image%2Fjpeg?access_token=1730507971_urn%3Aaaid%3Asc%3AVA6C2%3A28c3f5ca-4ed3-4a51-afb0-af2193497e59%3Bpublic_383ea3def3b3eb5568608beed4754fb9decbd811&api_key=dc_sendtrack HTTP/1.1Host: cdn-sharing.adobecc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /api/4507022599913472/envelope/?sentry_key=a70bff58cd4048f9e05163230edfd1bd&sentry_version=7 HTTP/1.1Host: o4505393339695104.ingest.us.sentry.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tDT+9cW5VnA4gau&MD=Utt+Rz3o HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /api/4507022599913472/envelope/?sentry_key=a70bff58cd4048f9e05163230edfd1bd&sentry_version=7 HTTP/1.1Host: o4505393339695104.ingest.us.sentry.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: adobe.tt.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: widget.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: static.adobelogin.com
Source: global traffic	DNS traffic detected: DNS query: prod.adobeccstatic.com
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net
Source: global traffic	DNS traffic detected: DNS query: l.betrad.com
Source: global traffic	DNS traffic detected: DNS query: ims-na1.adobelogin.com
Source: global traffic	DNS traffic detected: DNS query: files-download2.acrocomcontent.com
Source: global traffic	DNS traffic detected: DNS query: dc-api-v2.adobecontent.io
Source: global traffic	DNS traffic detected: DNS query: dc-api.adobecontent.io
Source: global traffic	DNS traffic detected: DNS query: c.evidon.com
Source: global traffic	DNS traffic detected: DNS query: by2.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: api.echosign.com
Source: global traffic	DNS traffic detected: DNS query: cdn-sharing.adobecc.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: o4505393339695104.ingest.us.sentry.io

Source: chromecache_233.1.dr, chromecache_273.1.dr	String found in binary or memory: http://iso.org/pdf/ssn
Source: chromecache_233.1.dr, chromecache_273.1.dr	String found in binary or memory: http://iso.org/pdf2/ssn
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000176ff
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017701
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017702
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017703
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017704
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017706
Source: chromecache_265.1.dr, chromecache_172.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_254.1.dr	String found in binary or memory: https://ims-na1.adobelogin.com/
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: https://p.typekit.net/p.gif
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/
Source: chromecache_286.1.dr, chromecache_173.1.dr	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1928,i,1697272281459918872,6439475264855140221,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6Ikxza3JpcEBoYWlncm91cC5jb20iLCJyZXF1ZXN0SWQiOiIwYjZhYWRmNS0wZjFhLTQ2YmUtNThkMC01MWJiYjc0MGI1N2UiLCJsaW5rIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9pZC91cm46YWFpZDpzYzpWQTZDMjoyOGMzZjVjYS00ZWQzLTRhNTEtYWZiMC1hZjIxOTM0OTdlNTkiLCJsYWJlbCI6IjEyIiwibG9jYWxlIjoiZW5fVVMifQ._8FMpgIlJaL8t_oFi82d6XGNnzc2WfW_TfYxKziFaR71h8ZGtJ7PBv8KBam5pa7ud8u9KZnD4KW90UZjwVvtBg"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1928,i,1697272281459918872,6439475264855140221,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 178
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 192	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 178	Jump to dropped file

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	Malicious	Reputation
https://cdn-sharing.adobecc.com/rendition/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59;page=1;size=1200;type=image%2Fjpeg?access_token=1730507971_urn%3Aaaid%3Asc%3AVA6C2%3A28c3f5ca-4ed3-4a51-afb0-af2193497e59%3Bpublic_383ea3def3b3eb5568608beed4754fb9decbd811&api_key=dc_sendtrack	false	unknown
https://cdn-sharing.adobecc.com/rendition/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59;page=0;size=1200;type=image%2Fjpeg?access_token=1730507971_urn%3Aaaid%3Asc%3AVA6C2%3A28c3f5ca-4ed3-4a51-afb0-af2193497e59%3Bpublic_383ea3def3b3eb5568608beed4754fb9decbd811&api_key=dc_sendtrack	false	unknown
https://o4505393339695104.ingest.us.sentry.io/api/4507022599913472/envelope/?sentry_key=a70bff58cd4048f9e05163230edfd1bd&sentry_version=7	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
3.236.206.95	api.echosign.com	United States	14618	AMAZON-AESUS	false
151.101.1.138	unknown	United States	54113	FASTLYUS	false
18.239.18.63	prod.adobeccstatic.com	United States	16509	AMAZON-02US	false
66.235.152.225	adobetarget.data.adobedc.net	United States	15224	OMNITUREUS	false
63.140.62.222	adobe.com.ssl.d1.sc.omtrdc.net	United States	15224	OMNITUREUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
151.101.193.138	cdn-sharing.adobecc.map.fastly.net	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.222.214.49	dd20fzx9mj46f.cloudfront.net	United States	16509	AMAZON-02US	false
34.120.195.249	o4505393339695104.ingest.us.sentry.io	United States	15169	GOOGLEUS	false

IP
192.168.2.16
192.168.2.6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Name	IP	Active	Malicious	Reputation
dd20fzx9mj46f.cloudfront.net	52.222.214.49	true	false	unknown
adobetarget.data.adobedc.net	66.235.152.225	true	false	unknown
privacycollector-production-457481513.us-east-1.elb.amazonaws.com	3.216.226.106	true	false	unknown
widget.uservoice.com	104.18.21.58	true	false	unknown
api.echosign.com	3.236.206.95	true	false	unknown
o4505393339695104.ingest.us.sentry.io	34.120.195.249	true	false	unknown
adobe.com.ssl.d1.sc.omtrdc.net	63.140.62.222	true	false	unknown
www.google.com	142.250.186.132	true	false	unknown
by2.uservoice.com	104.18.20.58	true	false	unknown
prod.adobeccstatic.com	18.239.18.63	true	false	unknown
cdn-sharing.adobecc.map.fastly.net	151.101.193.138	true	false	unknown
use.typekit.net	unknown	unknown	false	unknown
c.evidon.com	unknown	unknown	false	unknown
ims-na1.adobelogin.com	unknown	unknown	false	unknown
assets.adobedtm.com	unknown	unknown	false	unknown
l.betrad.com	unknown	unknown	false	unknown
dc-api-v2.adobecontent.io	unknown	unknown	false	unknown
p.typekit.net	unknown	unknown	false	unknown
dc-api.adobecontent.io	unknown	unknown	false	unknown
adobe.tt.omtrdc.net	unknown	unknown	false	unknown
cdn-sharing.adobecc.com	unknown	unknown	false	unknown
static.adobelogin.com	unknown	unknown	false	unknown
files-download2.acrocomcontent.com	unknown	unknown	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://typekit.com/eulas/000000000000000000017704	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
http://typekit.com/eulas/000000000000000000017706	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	chromecache_265.1.dr, chromecache_172.1.dr	false		unknown
https://p.typekit.net/p.gif	chromecache_286.1.dr, chromecache_173.1.dr	false	URL Reputation: safe	unknown
http://typekit.com/eulas/0000000000000000000176ff	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
http://typekit.com/eulas/000000000000000000017701	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
http://typekit.com/eulas/000000000000000000017702	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
http://typekit.com/eulas/000000000000000000017703	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
https://use.typekit.net/af/a2527e/000000000000000000017704/27/	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
http://iso.org/pdf2/ssn	chromecache_233.1.dr, chromecache_273.1.dr	false		unknown
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
https://ims-na1.adobelogin.com/	chromecache_254.1.dr	false		unknown
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown
http://iso.org/pdf/ssn	chromecache_233.1.dr, chromecache_273.1.dr	false		unknown
https://use.typekit.net/af/cb695f/000000000000000000017701/27/	chromecache_286.1.dr, chromecache_173.1.dr	false		unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546695
Start date and time:	2024-11-01 13:43:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6Ikxza3JpcEBoYWlncm91cC5jb20iLCJyZXF1ZXN0SWQiOiIwYjZhYWRmNS0wZjFhLTQ2YmUtNThkMC01MWJiYjc0MGI1N2UiLCJsaW5rIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9pZC91cm46YWFpZDpzYzpWQTZDMjoyOGMzZjVjYS00ZWQzLTRhNTEtYWZiMC1hZjIxOTM0OTdlNTkiLCJsYWJlbCI6IjEyIiwibG9jYWxlIjoiZW5fVVMifQ._8FMpgIlJaL8t_oFi82d6XGNnzc2WfW_TfYxKziFaR71h8ZGtJ7PBv8KBam5pa7ud8u9KZnD4KW90UZjwVvtBg
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/217@42/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:43:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9687057920743123
Encrypted:	false
SSDEEP:	48:8tdlTtNuHuidAKZdA1FehwiZUklqehSy+3:8FXj1y
MD5:	80C0CF06AB5B8745E0A8AA40122FEFEF
SHA1:	0055A1C8FBA8C53E3EBB165325B3D08562A258F8
SHA-256:	CB162D810678C72820FC8DAD92E889AF9D16938E0E4D990F497D2041727050A1
SHA-512:	A3D7978ED6B26943F277A07558C1C3D62CAC0DE9B632CC176528ECBEE9D8E570744E7E1DB7DAE60F1D79E1D783DF8E62B6CADB918FBAC6BA5DB9F9588EC2AA49
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......Z.[,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYfe....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaYoe....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaYoe....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaYoe..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaYpe...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........~.j].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 13:43:30.525242090 CET	53	49592	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:30.584916115 CET	53	59845	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:31.431632996 CET	53	53429	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:31.826067924 CET	53	59749	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.164246082 CET	53003	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.164527893 CET	51424	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.170995951 CET	53	53003	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.174633980 CET	53	51424	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.177004099 CET	56354	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.177160978 CET	62035	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.180330992 CET	53	53367	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.182804108 CET	50603	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.182950974 CET	51011	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.183912992 CET	53	56354	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.184067011 CET	53	62035	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.184792042 CET	63402	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.184909105 CET	65311	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.190968990 CET	49896	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.191123009 CET	64585	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.191821098 CET	53	63402	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.198086023 CET	53	64585	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.198669910 CET	63992	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.198796988 CET	52222	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.199186087 CET	53	49896	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.202085972 CET	53	58892	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.207046986 CET	53	56397	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.207462072 CET	58882	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.207566977 CET	49206	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.207873106 CET	61069	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.207971096 CET	63660	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.210185051 CET	53	64129	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.210719109 CET	52133	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.210828066 CET	53816	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.216152906 CET	55558	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.216253996 CET	58043	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.223228931 CET	53	58043	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.225905895 CET	53	49206	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.229973078 CET	53	58882	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.230674982 CET	56169	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.230796099 CET	51926	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.243458986 CET	53	65311	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.249530077 CET	53	51926	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.251318932 CET	53	57665	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.257874012 CET	53	57941	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.258960009 CET	53	63862	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.259710073 CET	56980	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.259829044 CET	65016	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.259969950 CET	51670	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.260065079 CET	49226	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.267410994 CET	53	51670	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.267529011 CET	64815	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.267673016 CET	54233	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.268512964 CET	53	49226	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.268738031 CET	61262	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.268865108 CET	53287	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.275943995 CET	59721	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.276072979 CET	64420	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:34.276520014 CET	53	53287	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.276717901 CET	53	61262	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.283508062 CET	53	59721	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:34.284157038 CET	53	64420	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:35.328404903 CET	64814	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:35.328502893 CET	52478	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:35.335033894 CET	53	52478	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:35.335133076 CET	53	64814	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:37.837976933 CET	53	52327	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:38.254947901 CET	53	49337	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:39.902800083 CET	57058	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:39.902983904 CET	55193	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:39.912933111 CET	53	57058	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:39.913218021 CET	53	55193	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:40.090888977 CET	53	64269	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:42.634303093 CET	52533	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:42.634464979 CET	54104	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:42.641510963 CET	53	52533	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:42.641592979 CET	53	54104	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:43.479415894 CET	54906	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:43.479931116 CET	63633	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:43.487740993 CET	53	63633	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:43.501940966 CET	53	54906	1.1.1.1	192.168.2.16
Nov 1, 2024 13:43:44.890090942 CET	54500	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:44.890223980 CET	52623	53	192.168.2.16	1.1.1.1
Nov 1, 2024 13:43:48.794758081 CET	53	60979	1.1.1.1	192.168.2.16
Nov 1, 2024 13:44:07.510799885 CET	53	50544	1.1.1.1	192.168.2.16
Nov 1, 2024 13:44:30.324565887 CET	53	58891	1.1.1.1	192.168.2.16
Nov 1, 2024 13:44:30.450634003 CET	53	62826	1.1.1.1	192.168.2.16
Nov 1, 2024 13:44:38.639318943 CET	138	138	192.168.2.16	192.168.2.255
Nov 1, 2024 13:44:58.932611942 CET	53	59408	1.1.1.1	192.168.2.16

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:39 UTC	844	OUT	GET /rendition/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59;page=0;size=1200;type=image%2Fjpeg?access_token=1730507971_urn%3Aaaid%3Asc%3AVA6C2%3A28c3f5ca-4ed3-4a51-afb0-af2193497e59%3Bpublic_383ea3def3b3eb5568608beed4754fb9decbd811&api_key=dc_sendtrack HTTP/1.1 Host: cdn-sharing.adobecc.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://acrobat.adobe.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:43:39 UTC	1235	IN	HTTP/1.1 200 OK Connection: close Content-Length: 122596 access-control-allow-headers: authorization,x-api-key,x-request-id,if-match,accept,cache-control,uncommitted-revision,rendition-live,if-none-match,x-access-token,Uber-Trace-Id,priority,Content-Disposition access-control-allow-methods: OPTIONS,GET access-control-allow-origin: * access-control-expose-headers: asset-id,connection,content-length,content-type,etag,link,location,repository-id,x-breadcrumb-trail,x-request-id,version,video-rendition-available,retry-after,vary,content-location,video-rendition-duration,Total-Count,Content-Disposition access-control-max-age: 86400 asset-id: urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59 build: adea17a6 content-location: https://cdn-sharing.adobecc.com/rendition/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59;page=0;size=1200;type=image%2Fjpeg?api_key=dc_sendtrack content-type: image/jpeg etag: "dXJuOmFhaWQ6c2M6VkE2QzI6MjhjM2Y1Y2EtNGVkMy00YTUxLWFmYjAtYWYyMTkzNDk3ZTU5LzEyMDAvanBlZy8wLzA=" link: <https://platform-cs-va6c2.adobe.io/content/acl/check/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59{?privilege,relation}>; rel="http://ns.adobe.com/adobecloud/rel/ac/check"; templated="true"
2024-11-01 12:43:39 UTC	1477	IN	Data Raw: 6c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 70 6c 61 74 66 6f 72 6d 2d 63 73 2d 76 61 36 63 32 2e 61 64 6f 62 65 2e 69 6f 2f 63 6f 6e 74 65 6e 74 2f 61 63 6c 2f 65 66 66 65 63 74 69 76 65 2f 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a 32 38 63 33 66 35 63 61 2d 34 65 64 33 2d 34 61 35 31 2d 61 66 62 30 2d 61 66 32 31 39 33 34 39 37 65 35 39 3e 3b 20 72 65 6c 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 61 64 6f 62 65 63 6c 6f 75 64 2f 72 65 6c 2f 61 63 2f 65 66 66 65 63 74 69 76 65 22 0d 0a 6c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 70 6c 61 74 66 6f 72 6d 2d 63 73 2d 76 61 36 63 32 2e 61 64 6f 62 65 2e 69 6f 2f 63 6f 6e 74 65 6e 74 2f 61 63 6c 2f 70 6f 6c 69 63 79 2f 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a Data Ascii: link: <https://platform-cs-va6c2.adobe.io/content/acl/effective/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59>; rel="http://ns.adobe.com/adobecloud/rel/ac/effective"link: <https://platform-cs-va6c2.adobe.io/content/acl/policy/urn:aaid:sc:VA6C2:
2024-11-01 12:43:39 UTC	1255	IN	Data Raw: 6c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 73 68 61 72 69 6e 67 2e 61 64 6f 62 65 63 63 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 73 74 6f 72 61 67 65 2f 69 64 2f 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a 32 38 63 33 66 35 63 61 2d 34 65 64 33 2d 34 61 35 31 2d 61 66 62 30 2d 61 66 32 31 39 33 34 39 37 65 35 39 2f 3a 64 69 73 63 61 72 64 3e 3b 20 72 65 6c 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 61 64 6f 62 65 63 6c 6f 75 64 2f 72 65 6c 2f 64 69 73 63 61 72 64 22 0d 0a 6c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 73 68 61 72 69 6e 67 2e 61 64 6f 62 65 63 63 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 73 74 6f 72 61 67 65 2f 69 64 2f 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a 32 38 63 33 66 Data Ascii: link: <https://cdn-sharing.adobecc.com/content/storage/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59/:discard>; rel="http://ns.adobe.com/adobecloud/rel/discard"link: <https://cdn-sharing.adobecc.com/content/storage/id/urn:aaid:sc:VA6C2:28c3f
2024-11-01 12:43:39 UTC	1484	IN	Data Raw: 6c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 73 68 61 72 69 6e 67 2e 61 64 6f 62 65 63 63 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 73 74 6f 72 61 67 65 2f 69 64 2f 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a 32 38 63 33 66 35 63 61 2d 34 65 64 33 2d 34 61 35 31 2d 61 66 62 30 2d 61 66 32 31 39 33 34 39 37 65 35 39 2f 72 65 73 6f 75 72 63 65 3a 7b 72 65 73 6f 75 72 63 65 7d 2f 3a 70 61 67 65 7b 3f 6f 72 64 65 72 42 79 2c 73 74 61 72 74 2c 6c 69 6d 69 74 2c 70 72 6f 70 65 72 74 79 2c 76 65 72 73 69 6f 6e 7d 3e 3b 20 72 65 6c 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 61 64 6f 62 65 63 6c 6f 75 64 2f 72 65 6c 2f 70 61 67 65 22 3b 20 74 65 6d 70 6c 61 74 65 64 3d 22 74 72 75 65 22 3b 20 74 79 70 65 3d 22 61 70 70 6c Data Ascii: link: <https://cdn-sharing.adobecc.com/content/storage/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59/resource:{resource}/:page{?orderBy,start,limit,property,version}>; rel="http://ns.adobe.com/adobecloud/rel/page"; templated="true"; type="appl
2024-11-01 12:43:39 UTC	532	IN	Data Raw: 78 2d 72 65 73 6f 75 72 63 65 2d 69 64 3a 20 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a 32 38 63 33 66 35 63 61 2d 34 65 64 33 2d 34 61 35 31 2d 61 66 62 30 2d 61 66 32 31 39 33 34 39 37 65 35 39 0d 0a 73 74 72 69 63 74 2d 74 72 61 6e 73 70 6f 72 74 2d 73 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 38 36 34 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 69 6e 73 0d 0a 74 69 6d 69 6e 67 2d 61 6c 6c 6f 77 2d 6f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 73 74 61 67 65 2e 61 63 72 6f 62 61 74 2e 61 64 6f 62 65 2e 63 6f 6d 2c 20 68 74 74 70 73 3a 2f 2f 61 63 72 6f 62 61 74 2e 61 64 6f 62 65 2e 63 6f 6d 0d 0a 78 2d 72 65 71 75 65 73 74 2d 69 64 3a 20 63 64 34 65 35 34 34 63 2d 34 33 38 63 2d 34 33 33 33 2d 61 64 61 38 2d 34 63 65 35 Data Ascii: x-resource-id: urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59strict-transport-security: max-age=86400; includeSubDomainstiming-allow-origin: https://stage.acrobat.adobe.com, https://acrobat.adobe.comx-request-id: cd4e544c-438c-4333-ada8-4ce5
2024-11-01 12:43:39 UTC	1371	IN	Data Raw: ff d8 ff e1 09 bf 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 32 20 37 39 2e 66 64 30 32 37 31 35 2c 20 32 30 32 34 2f 30 35 2f 32 32 2d 30 34 3a 31 32 3a 33 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 Data Ascii: http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.fd02715, 2024/05/22-04:12:37 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-sy
2024-11-01 12:43:39 UTC	1371	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-11-01 12:43:39 UTC	1371	IN	Data Raw: 07 08 04 05 06 03 02 01 09 0a 0b 01 01 00 02 03 01 00 02 03 00 00 00 00 00 00 00 00 00 04 05 01 02 03 06 07 08 09 0a 0b 10 00 01 04 01 02 03 03 02 0e 08 05 06 0e 63 00 00 01 00 02 03 04 05 06 11 07 12 13 15 21 31 14 22 08 16 17 18 32 41 51 55 56 91 93 94 d4 d5 23 52 53 57 61 92 d2 d3 24 54 71 a4 d1 33 42 62 95 a1 a3 09 25 26 34 37 44 65 81 84 b1 b4 c1 c3 c4 0a 19 1a 27 28 29 2a 35 36 38 39 3a 43 45 46 47 48 49 4a 58 59 5a 63 64 66 67 68 69 6a 72 73 74 75 76 77 78 79 7a 82 83 85 86 87 88 89 8a 96 97 98 99 9a a2 a5 a6 a7 a8 a9 aa b2 b3 b5 b6 b7 b8 b9 ba c2 c5 c6 c7 c8 c9 ca d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 11 01 00 01 02 02 06 03 05 07 05 01 81 00 00 00 00 00 01 02 11 21 31 03 12 14 41 51 61 04 22 a1 13 71 81 91 Data Ascii: c!1"2AQUV#RSWa$Tq3Bb%&47De'()*5689:CEFGHIJXYZcdfghijrstuvwxyz!1AQa"q
2024-11-01 12:43:39 UTC	1371	IN	Data Raw: cb 67 20 8f 4c d8 1a b3 14 d1 59 d5 de ce d8 ad 18 e5 8e d5 57 38 35 fc cc 1d dd 58 c3 ba 91 c8 07 30 d8 83 cc 0e cb 8d 5d 49 d6 8c 2d e7 a3 75 54 ef c3 8c 67 12 d7 2c 7c 7c e1 29 29 ee e2 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 0f ff d1 b5 28 08 08 08 08 08 39 2e 21 fb 0d 3b fd e7 29 7f bd a8 fd 23 77 b7 47 b9 69 5e ee fc 3a 02 b7 6c fc 46 1f 85 01 07 e2 c0 fc 41 f8 50 7e 23 0f 94 02 83 f1 07 e2 0f c5 81 f8 51 87 e2 0f c4 1f 85 07 e2 c0 fc 41 f8 50 7e 14 1f 88 c0 83 f0 ac Data Ascii: g LYW85X0]I-uTg,\|\|))(9.!;)#wGi^:lFAP~#QAP~
2024-11-01 12:43:39 UTC	1371	IN	Data Raw: 52 ea ef d2 f2 87 d8 8b 9b 97 6e 6e 5e 72 37 db 71 be db ed b8 df c5 46 aa 6b 8c f5 a3 bf 78 f5 da 4d e3 8b d6 93 b8 89 7a 01 62 91 cb da ae e2 43 66 87 ca 64 61 23 b8 80 e6 ee 37 07 c7 bf b9 23 ba 4e 5a d3 de bc 91 7e 6e ec 59 d4 38 5e 10 df 9b 25 2d b8 32 b7 2d 86 42 eb 2e 91 b3 b1 a5 cc 1b 0e 7d 9e d0 59 1c 84 0e ef 64 4f 81 52 6f 55 3a 29 bd e2 66 77 de fb bc 3b a5 be 31 4f 37 07 8b 9b 5f 65 44 8e c6 cf 92 b8 d8 76 12 98 64 99 e1 a5 db ed be c7 bb 7d 8e df a8 a3 53 35 d5 95 e7 bd 76 91 79 e2 dc e2 30 9c 4d 97 2d 4a 2b 2d ca c5 5d f3 c4 d9 a4 91 f3 86 35 85 e0 39 ce 3b f7 00 dd c9 fc 0b a5 34 69 2f 1e 7a d7 e6 cc 45 5c dd 7f 1b f5 0e 47 1e cc 5d 3a 16 e6 aa e9 ba b2 ce 60 91 d1 97 35 bc ad 68 3c a4 12 09 2f ee 3d db 8f 6f da ef d2 eb 98 b4 46 19 de d8 Data Ascii: Rnn^r7qFkxMzbCfda#7#NZ~nY8^%-2-B.}YdORoU:)fw;1O7_eDvd}S5vy0M-J+-]59;4i/zE\G]:`5h</=oF
2024-11-01 12:43:39 UTC	1371	IN	Data Raw: ff 00 1e ab 7a 64 f5 a2 38 47 ae e1 a5 9c 52 6f 0d 28 f9 16 85 c4 44 46 c6 48 7a e7 f0 f5 dc 65 07 e2 78 db f0 6c a6 68 22 d4 47 8f c7 8b ad 11 83 93 e3 e5 ee 4c 36 2e 8e fd f3 d8 7c c4 7e 08 59 cb fc cb fa 9f 10 5c 3a 64 e1 11 c6 6f e2 f7 ad 34 b3 83 41 c2 cd 75 a6 34 d6 1e dc 39 17 ca db 96 6c 73 fd 8e 32 f1 d3 6b 1a 1b df ee f3 73 ff 00 1c 42 e7 d1 f4 d4 d1 18 e7 33 d9 ec bb 5a 2a 88 84 97 a6 b8 81 a7 b5 25 d9 29 e3 1d 2b a6 8a 33 33 fa 91 96 34 34 38 37 c4 fb 7b b8 6c 3d cd fd c5 2f 47 a6 a6 a9 b4 77 dd 62 a8 94 4d c6 db de 51 ac 9b 5c 1e ea 75 a3 8c 8f dc 9e 5d 21 f8 c3 db f1 05 0b a5 cd eb ef 47 bb f7 2e 3a 49 c5 2e e8 3a 3e 45 a3 70 f0 6d b1 f2 66 48 e1 ee 3a 51 d4 3f c7 ee f3 bf e1 53 74 31 6a 23 bd eb e2 ed 4c 60 8e 78 f1 8c ad 1d ac 5e 4a 36 06 Data Ascii: zd8GRo(DFHzexlh"GL6.\|~Y\:do4Au49ls2ksB3Z*%)+334487{l=/GwbMQ\u]!G.:I.:>EpmfH:Q?St1j#L`x^J6

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:40 UTC	844	OUT	GET /rendition/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59;page=1;size=1200;type=image%2Fjpeg?access_token=1730507971_urn%3Aaaid%3Asc%3AVA6C2%3A28c3f5ca-4ed3-4a51-afb0-af2193497e59%3Bpublic_383ea3def3b3eb5568608beed4754fb9decbd811&api_key=dc_sendtrack HTTP/1.1 Host: cdn-sharing.adobecc.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://acrobat.adobe.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:43:41 UTC	1234	IN	HTTP/1.1 200 OK Connection: close Content-Length: 79803 access-control-allow-headers: authorization,x-api-key,x-request-id,if-match,accept,cache-control,uncommitted-revision,rendition-live,if-none-match,x-access-token,Uber-Trace-Id,priority,Content-Disposition access-control-allow-methods: OPTIONS,GET access-control-allow-origin: * access-control-expose-headers: asset-id,connection,content-length,content-type,etag,link,location,repository-id,x-breadcrumb-trail,x-request-id,version,video-rendition-available,retry-after,vary,content-location,video-rendition-duration,Total-Count,Content-Disposition access-control-max-age: 86400 asset-id: urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59 build: adea17a6 content-location: https://cdn-sharing.adobecc.com/rendition/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59;page=1;size=1200;type=image%2Fjpeg?api_key=dc_sendtrack content-type: image/jpeg etag: "dXJuOmFhaWQ6c2M6VkE2QzI6MjhjM2Y1Y2EtNGVkMy00YTUxLWFmYjAtYWYyMTkzNDk3ZTU5LzEyMDAvanBlZy8wLzE=" link: <https://platform-cs-va6c2.adobe.io/content/acl/check/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59{?privilege,relation}>; rel="http://ns.adobe.com/adobecloud/rel/ac/check"; templated="true"
2024-11-01 12:43:41 UTC	1477	IN	Data Raw: 6c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 70 6c 61 74 66 6f 72 6d 2d 63 73 2d 76 61 36 63 32 2e 61 64 6f 62 65 2e 69 6f 2f 63 6f 6e 74 65 6e 74 2f 61 63 6c 2f 65 66 66 65 63 74 69 76 65 2f 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a 32 38 63 33 66 35 63 61 2d 34 65 64 33 2d 34 61 35 31 2d 61 66 62 30 2d 61 66 32 31 39 33 34 39 37 65 35 39 3e 3b 20 72 65 6c 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 61 64 6f 62 65 63 6c 6f 75 64 2f 72 65 6c 2f 61 63 2f 65 66 66 65 63 74 69 76 65 22 0d 0a 6c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 70 6c 61 74 66 6f 72 6d 2d 63 73 2d 76 61 36 63 32 2e 61 64 6f 62 65 2e 69 6f 2f 63 6f 6e 74 65 6e 74 2f 61 63 6c 2f 70 6f 6c 69 63 79 2f 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a Data Ascii: link: <https://platform-cs-va6c2.adobe.io/content/acl/effective/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59>; rel="http://ns.adobe.com/adobecloud/rel/ac/effective"link: <https://platform-cs-va6c2.adobe.io/content/acl/policy/urn:aaid:sc:VA6C2:
2024-11-01 12:43:41 UTC	1255	IN	Data Raw: 6c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 73 68 61 72 69 6e 67 2e 61 64 6f 62 65 63 63 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 73 74 6f 72 61 67 65 2f 69 64 2f 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a 32 38 63 33 66 35 63 61 2d 34 65 64 33 2d 34 61 35 31 2d 61 66 62 30 2d 61 66 32 31 39 33 34 39 37 65 35 39 2f 3a 64 69 73 63 61 72 64 3e 3b 20 72 65 6c 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 61 64 6f 62 65 63 6c 6f 75 64 2f 72 65 6c 2f 64 69 73 63 61 72 64 22 0d 0a 6c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 73 68 61 72 69 6e 67 2e 61 64 6f 62 65 63 63 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 73 74 6f 72 61 67 65 2f 69 64 2f 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a 32 38 63 33 66 Data Ascii: link: <https://cdn-sharing.adobecc.com/content/storage/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59/:discard>; rel="http://ns.adobe.com/adobecloud/rel/discard"link: <https://cdn-sharing.adobecc.com/content/storage/id/urn:aaid:sc:VA6C2:28c3f
2024-11-01 12:43:41 UTC	1484	IN	Data Raw: 6c 69 6e 6b 3a 20 3c 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 73 68 61 72 69 6e 67 2e 61 64 6f 62 65 63 63 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 73 74 6f 72 61 67 65 2f 69 64 2f 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a 32 38 63 33 66 35 63 61 2d 34 65 64 33 2d 34 61 35 31 2d 61 66 62 30 2d 61 66 32 31 39 33 34 39 37 65 35 39 2f 72 65 73 6f 75 72 63 65 3a 7b 72 65 73 6f 75 72 63 65 7d 2f 3a 70 61 67 65 7b 3f 6f 72 64 65 72 42 79 2c 73 74 61 72 74 2c 6c 69 6d 69 74 2c 70 72 6f 70 65 72 74 79 2c 76 65 72 73 69 6f 6e 7d 3e 3b 20 72 65 6c 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 61 64 6f 62 65 63 6c 6f 75 64 2f 72 65 6c 2f 70 61 67 65 22 3b 20 74 65 6d 70 6c 61 74 65 64 3d 22 74 72 75 65 22 3b 20 74 79 70 65 3d 22 61 70 70 6c Data Ascii: link: <https://cdn-sharing.adobecc.com/content/storage/id/urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59/resource:{resource}/:page{?orderBy,start,limit,property,version}>; rel="http://ns.adobe.com/adobecloud/rel/page"; templated="true"; type="appl
2024-11-01 12:43:41 UTC	532	IN	Data Raw: 78 2d 72 65 73 6f 75 72 63 65 2d 69 64 3a 20 75 72 6e 3a 61 61 69 64 3a 73 63 3a 56 41 36 43 32 3a 32 38 63 33 66 35 63 61 2d 34 65 64 33 2d 34 61 35 31 2d 61 66 62 30 2d 61 66 32 31 39 33 34 39 37 65 35 39 0d 0a 73 74 72 69 63 74 2d 74 72 61 6e 73 70 6f 72 74 2d 73 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 38 36 34 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 69 6e 73 0d 0a 74 69 6d 69 6e 67 2d 61 6c 6c 6f 77 2d 6f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 73 74 61 67 65 2e 61 63 72 6f 62 61 74 2e 61 64 6f 62 65 2e 63 6f 6d 2c 20 68 74 74 70 73 3a 2f 2f 61 63 72 6f 62 61 74 2e 61 64 6f 62 65 2e 63 6f 6d 0d 0a 78 2d 72 65 71 75 65 73 74 2d 69 64 3a 20 35 30 34 62 32 38 30 31 2d 37 32 34 38 2d 34 63 36 30 2d 39 64 34 30 2d 62 34 35 36 Data Ascii: x-resource-id: urn:aaid:sc:VA6C2:28c3f5ca-4ed3-4a51-afb0-af2193497e59strict-transport-security: max-age=86400; includeSubDomainstiming-allow-origin: https://stage.acrobat.adobe.com, https://acrobat.adobe.comx-request-id: 504b2801-7248-4c60-9d40-b456
2024-11-01 12:43:41 UTC	16384	IN	Data Raw: ff d8 ff e1 09 bf 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 32 20 37 39 2e 66 64 30 32 37 31 35 2c 20 32 30 32 34 2f 30 35 2f 32 32 2d 30 34 3a 31 32 3a 33 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 Data Ascii: http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.fd02715, 2024/05/22-04:12:37 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-sy
2024-11-01 12:43:41 UTC	16384	IN	Data Raw: 38 9e 18 eb 0f 82 6b eb 08 3e 28 b9 aa f0 f2 63 9c 9c 4f 0c 75 87 c1 35 f5 84 1f 14 5c d5 78 79 31 ce 4e 27 86 3a c3 e0 9a fa c2 0f 8a 2e 6a bc 3c 98 e7 27 13 c3 1d 61 f0 4d 7d 61 07 c5 17 35 5e 1e 4c 73 93 89 e1 8e b0 f8 26 be b0 83 e2 8b 9a af 0f 26 39 c9 c4 f0 c7 58 7c 13 5f 58 41 f1 45 cd 57 87 93 1c e4 e2 78 63 ac 3e 09 af ac 20 f8 a2 e6 ab c3 c9 8e 72 71 3c 31 d6 1f 04 d7 d6 10 7c 51 73 55 e1 e4 c7 39 38 9e 18 eb 0f 82 6b eb 08 3e 28 b9 aa f0 f2 63 9c 9c 4f 0c 75 87 c1 35 f5 84 1f 14 5c d5 78 79 31 ce 4e 27 86 3a c3 e0 9a fa c2 0f 8a 2e 6a bc 3c 98 e7 27 13 c3 1d 61 f0 4d 7d 61 07 c5 17 35 5e 1e 4c 73 93 89 e1 8e b0 f8 26 be b0 83 e2 8b 9a af 0f 26 39 c9 c4 f0 c7 58 7c 13 5f 58 41 f1 45 cd 57 87 93 1c e4 e2 78 63 ac 3e 09 af ac 20 f8 a2 e6 ab c3 c9 Data Ascii: 8k>(cOu5\xy1N':.j<'aM}a5^Ls&&9X\|_XAEWxc> rq<1\|QsU98k>(cOu5\xy1N':.j<'aM}a5^Ls&&9X\|_XAEWxc>
2024-11-01 12:43:41 UTC	16384	IN	Data Raw: d9 fb 11 b2 12 76 55 5f 58 c1 8b e5 90 b6 e8 a3 ad 49 ac b1 33 1f d6 b8 95 59 3b 59 0c 6e b4 f8 1f 1a f7 b6 23 20 59 9d 0a a2 23 15 eb b0 98 f2 32 3d a9 6a 6a 7a 46 1d 49 1d 3c 65 aa 91 75 59 6d 59 25 a8 9f 35 c6 d8 ee f1 e3 ab 56 9a 28 ed b2 eb 9c 8a 8e 4b 10 b5 1a f4 46 f0 54 57 3d 89 8d ac 8d 6a a2 2a b7 65 5f 71 7c e9 fc 06 e9 fc 02 89 8f a4 44 4f 31 00 00 00 00 00 00 00 00 0f ff d4 aa 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1d 4c be 32 b6 57 13 77 17 69 5c 95 af c1 2d 69 d5 8b b3 b8 4c c5 63 b8 aa a2 a2 3b 8b 97 65 54 5d 97 dc 50 30 bb 7d 8b e9 bc 83 5f ed ad ec 86 46 54 a3 16 36 a4 d3 c9 03 56 b4 10 4f 1d 96 Data Ascii: vU_XI3Y;Yn# Y#2=jjzFI<euYmY%5V(KFTW=j*e_q\|DO1@L2Wwi\-iLc;eT]P0}_FT6VO
2024-11-01 12:43:41 UTC	16384	IN	Data Raw: d8 d4 40 d9 00 78 3a eb 03 3e 7b 4c 5b c6 d6 8e 29 6d b9 d0 cd 59 27 96 58 1a 92 d7 9d 93 31 c9 34 08 b2 c5 23 1d 1a 3a 29 1a d7 f0 91 1a e7 47 23 11 cc 70 60 ba 4b b3 6d 71 85 9e f6 4d 6c d4 5c ab a1 bd 63 1a db 53 4f 76 36 5e c8 49 0a 2f 5e 55 64 32 4b c6 0a 50 23 e6 63 23 e2 fb 13 b2 18 52 26 35 ae 0e 9e 3b b2 dd 69 88 b2 ec ce 26 be 36 1b 6f 97 22 d8 f0 72 de b5 2d 78 61 c9 d7 a7 13 e4 ef cf ae eb 13 4a 93 d1 4b 0f 63 e0 6b 55 92 ba 28 de d5 63 5c a1 f6 ee cf 3b 44 c2 e9 05 c2 e9 e9 20 9e cd b9 aa d4 bf 6d 6d 3a 9c e9 89 c7 d1 86 9c 71 57 99 21 9d 61 9a 75 85 f2 ba 4e 9b d6 15 9e 6e 9a f3 56 3d 81 d8 ad d9 be a8 87 6a 54 a8 63 31 78 3b d6 70 d7 ad d4 8a d4 ce 92 92 e1 24 85 e9 5a bb 9b 03 3b c2 58 ee b0 a2 4e f7 c0 b0 f2 99 fd 39 1f c7 98 75 6b 76 6f Data Ascii: @x:>{L[)mY'X14#:)G#p`KmqMl\cSOv6^I/^Ud2KP#c#R&5;i&6o"r-xaJKckU(c\;D mm:qW!auNnV=jTc1x;p$Z;XN9ukvo
2024-11-01 12:43:41 UTC	14267	IN	Data Raw: 72 c5 d8 32 29 3e 3a 6c 3c 73 58 ef 12 4d d4 a7 14 c8 db ce 99 fd f2 3a ed 57 44 af 49 e2 75 3b 53 d9 5e 13 36 56 26 e8 c0 e2 93 4b eb 5d 35 a6 31 56 72 56 b2 6d a7 63 1b 8d f0 ba 3b 19 37 23 e7 b4 99 08 59 2d 68 e6 96 76 b2 bc b2 56 7b e1 6b a3 96 08 e4 8d ad 89 d2 a3 dc d7 81 d3 a9 43 b4 9c f6 16 9d ed 37 67 24 fc 3b a6 cb 43 8b 7b 6c be f4 d0 59 4c 94 8d ad 24 b3 b7 25 4e 39 5b 1d 74 6c 6c 9e 49 32 35 91 ac 95 8e 8e 54 91 16 40 a5 62 49 12 26 24 aa 8b 22 35 39 ab 7c 48 ae db c7 b2 7b 89 bf 98 0f a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 3d a1 e9 fc f6 a0 d3 ae c4 e1 ed 43 55 2d 4c c6 e4 ba fd 44 49 a9 78 d6 68 1a e8 bc b6 2c fe 4c 6f 72 78 fa 2e 91 1a ad 72 b5 c8 18 24 38 ac d2 76 51 4b 41 e5 71 36 a4 ca 45 8e af 65 d5 f1 Data Ascii: r2)>:l<sXM:WDIu;S^6V&K]51VrVmc;7#Y-hvV{kC7g$;C{lYL$%N9[tllI25T@bI&$"59\|H{c=CU-LDIxh,Lorx.r$8vQKAq6Ee

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:41 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 12:43:41 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=100921 Date: Fri, 01 Nov 2024 12:43:41 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:42 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tDT+9cW5VnA4gau&MD=Utt+Rz3o HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 12:43:42 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: bdba029a-e3d4-4b98-ac1c-1a4627ff3a98 MS-RequestId: d2a3c1c0-1d1b-422b-961c-76b4f004d507 MS-CV: oR0BVwS0u0+GdEju.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 12:43:41 GMT Connection: close Content-Length: 24490
2024-11-01 12:43:42 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-01 12:43:42 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:42 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 12:43:43 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=100976 Date: Fri, 01 Nov 2024 12:43:43 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-01 12:43:43 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:43 UTC	722	OUT	POST /api/4507022599913472/envelope/?sentry_key=a70bff58cd4048f9e05163230edfd1bd&sentry_version=7 HTTP/1.1 Host: o4505393339695104.ingest.us.sentry.io Connection: keep-alive Content-Length: 578 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://acrobat.adobe.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://acrobat.adobe.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:43:43 UTC	578	OUT	Data Raw: 7b 22 73 65 6e 74 5f 61 74 22 3a 22 32 30 32 34 2d 31 31 2d 30 31 54 31 32 3a 34 33 3a 34 31 2e 32 39 37 5a 22 2c 22 73 64 6b 22 3a 7b 22 6e 61 6d 65 22 3a 22 73 65 6e 74 72 79 2e 6a 61 76 61 73 63 72 69 70 74 2e 62 72 6f 77 73 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 37 2e 31 31 38 2e 30 22 7d 2c 22 64 73 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 61 37 30 62 66 66 35 38 63 64 34 30 34 38 66 39 65 30 35 31 36 33 32 33 30 65 64 66 64 31 62 64 40 6f 34 35 30 35 33 39 33 33 33 39 36 39 35 31 30 34 2e 69 6e 67 65 73 74 2e 75 73 2e 73 65 6e 74 72 79 2e 69 6f 2f 34 35 30 37 30 32 32 35 39 39 39 31 33 34 37 32 22 7d 0a 7b 22 74 79 70 65 22 3a 22 73 65 73 73 69 6f 6e 22 7d 0a 7b 22 73 69 64 22 3a 22 33 37 34 36 63 62 38 31 64 37 33 61 34 30 38 30 62 65 33 62 30 35 Data Ascii: {"sent_at":"2024-11-01T12:43:41.297Z","sdk":{"name":"sentry.javascript.browser","version":"7.118.0"},"dsn":"https://a70bff58cd4048f9e05163230edfd1bd@o4505393339695104.ingest.us.sentry.io/4507022599913472"}{"type":"session"}{"sid":"3746cb81d73a4080be3b05
2024-11-01 12:43:43 UTC	521	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 01 Nov 2024 12:43:43 GMT Content-Type: application/json Content-Length: 2 vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: * access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after cross-origin-resource-policy: cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-01 12:43:43 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:44 UTC	452	OUT	GET /api/4507022599913472/envelope/?sentry_key=a70bff58cd4048f9e05163230edfd1bd&sentry_version=7 HTTP/1.1 Host: o4505393339695104.ingest.us.sentry.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:43:44 UTC	518	IN	HTTP/1.1 405 Method Not Allowed Server: nginx Date: Fri, 01 Nov 2024 12:43:44 GMT Content-Length: 0 vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: * access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after cross-origin-resource-policy: cross-origin allow: POST Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:45 UTC	123	IN	HTTP/1.1 408 Request Time-out Content-length: 110 Cache-Control: no-cache Connection: close Content-Type: text/html
2024-11-01 12:43:45 UTC	110	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:44:19 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=tDT+9cW5VnA4gau&MD=Utt+Rz3o HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 12:44:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 04ceb315-9605-4f4b-a962-a31f2d1c0197 MS-RequestId: 931d1256-fbb9-42a7-bb98-8c7b8fb64d0b MS-CV: NhEqAfcxKEaegGhw.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 12:44:19 GMT Connection: close Content-Length: 30005
2024-11-01 12:44:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-01 12:44:20 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:44:51 UTC	722	OUT	POST /api/4507022599913472/envelope/?sentry_key=a70bff58cd4048f9e05163230edfd1bd&sentry_version=7 HTTP/1.1 Host: o4505393339695104.ingest.us.sentry.io Connection: keep-alive Content-Length: 300 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://acrobat.adobe.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://acrobat.adobe.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:44:51 UTC	300	OUT	Data Raw: 7b 22 64 73 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 61 37 30 62 66 66 35 38 63 64 34 30 34 38 66 39 65 30 35 31 36 33 32 33 30 65 64 66 64 31 62 64 40 6f 34 35 30 35 33 39 33 33 33 39 36 39 35 31 30 34 2e 69 6e 67 65 73 74 2e 75 73 2e 73 65 6e 74 72 79 2e 69 6f 2f 34 35 30 37 30 32 32 35 39 39 39 31 33 34 37 32 22 7d 0a 7b 22 74 79 70 65 22 3a 22 63 6c 69 65 6e 74 5f 72 65 70 6f 72 74 22 7d 0a 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 33 30 34 36 35 30 38 39 2e 32 30 32 2c 22 64 69 73 63 61 72 64 65 64 5f 65 76 65 6e 74 73 22 3a 5b 7b 22 72 65 61 73 6f 6e 22 3a 22 73 61 6d 70 6c 65 5f 72 61 74 65 22 2c 22 63 61 74 65 67 6f 72 79 22 3a 22 74 72 61 6e 73 61 63 74 69 6f 6e 22 2c 22 71 75 61 6e 74 69 74 79 22 3a 31 7d 2c 7b 22 72 65 61 73 6f 6e 22 3a 22 73 61 Data Ascii: {"dsn":"https://a70bff58cd4048f9e05163230edfd1bd@o4505393339695104.ingest.us.sentry.io/4507022599913472"}{"type":"client_report"}{"timestamp":1730465089.202,"discarded_events":[{"reason":"sample_rate","category":"transaction","quantity":1},{"reason":"sa
2024-11-01 12:44:51 UTC	521	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 01 Nov 2024 12:44:51 GMT Content-Type: application/json Content-Length: 2 vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: * access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after cross-origin-resource-policy: cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-01 12:44:51 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:44:51 UTC	452	OUT	GET /api/4507022599913472/envelope/?sentry_key=a70bff58cd4048f9e05163230edfd1bd&sentry_version=7 HTTP/1.1 Host: o4505393339695104.ingest.us.sentry.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:44:52 UTC	518	IN	HTTP/1.1 405 Method Not Allowed Server: nginx Date: Fri, 01 Nov 2024 12:44:52 GMT Content-Length: 0 vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: * access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after cross-origin-resource-policy: cross-origin allow: POST Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	08:43:28
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	08:43:30
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6Ikxza3JpcEBoYWlncm91cC5jb20iLCJyZXF1ZXN0SWQiOiIwYjZhYWRmNS0wZjFhLTQ2YmUtNThkMC01MWJiYjc0MGI1N2UiLCJsaW5rIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9pZC91cm46YWFpZDpzYzpWQTZDMjoyOGMzZjVjYS00ZWQzLTRhNTEtYWZiMC1hZjIxOTM0OTdlNTkiLCJsYWJlbCI6IjEyIiwibG9jYWxlIjoiZW5fVVMifQ._8FMpgIlJaL8t_oFi82d6XGNnzc2WfW_TfYxKziFaR71h8ZGtJ7PBv8KBam5pa7ud8u9KZnD4KW90UZjwVvtBg"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre