Create Interactive Tour

Windows Analysis Report
https://security.microsoft.com/url?url=https%3A%2F%2Facrobat.adobe.com%2Fid%2Furn%3Aaaid%3Asc%3AEU%3Aeafa7db4-a870-4976-bc32-05395f2fb53a

Overview

General Information

Sample URL:	https://security.microsoft.com/url?url=https%3A%2F%2Facrobat.adobe.com%2Fid%2Furn%3Aaaid%3Asc%3AEU%3Aeafa7db4-a870-4976-bc32-05395f2fb53a
Analysis ID:	1676169
Infos:

Detection

Score:	1
Range:	0 - 100
Confidence:	100%

Signatures

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7060 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1972,i,9276556746409924089,17106921590508392358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2008 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1972,i,9276556746409924089,17106921590508392358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5020 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://security.microsoft.com/url?url=https%3A%2F%2Facrobat.adobe.com%2Fid%2Furn%3Aaaid%3Asc%3AEU%3Aeafa7db4-a870-4976-bc32-05395f2fb53a" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0

HTTP Parser: Base64 decoded: f8b97238-37a1-40d9-be84-74c424f79aab8abace88-4da3-43c6-b4bd-2a2ede2dda2b

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DBZgRzYsnz1aKiZL9xlKbo_lheluJpJ4UkBNnJq7KGfHmfRe5e69AoguhK_3a2BesYd5hZrr_afwsn1o7rsAb_pqiGksq4uOwmlmV1N418_yAQnih_KsgxAmba9tn1BaYz7BngoxFf2YlI3YIzSONyHqQfn87ddZOhkGh6DuSKfYx06UFIFMIPL6PX5cbdZRQVXsyhubU8_p3jGYSUJ9RDDWvl6nfrK6f05EA5IFb-uwO-sZc53cGdkdJCpAa7aSxKP-HiMeOvtrBhaov-_qg_Q&response_mode=form_post&nonce=638814318741157454.ZjhiOTcyMzgtMzdhMS00MGQ5LWJlODQtNzRjNDI0Zjc5YWFiOGFiYWNlODgtNGRhMy00M2M2LWI0YmQtMmEyZWRlMmRkYTJi&client-request-id=7b7bd820-d005-4630-9e33-55fe2c232d5c&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 192.178.49.196:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.241.136:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.62.130:443 -> 192.168.2.5:49737 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.35
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.35
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.35
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.35
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.35
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.35
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-dRc2Pwesrlw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE59v8lS6y5-RdP_3Npa2-uD2OwrWUSW3qDcGpGGa2V45YsXbI9mch4KFs7xuZx2uD8zU_CPhZ2j5C3w5sLHxpHpaD5wLYc3apjOfSEzGOENCuvRaXOBoglR6uqyTIyTdQw8ai8z_0D2LhoBU9ZyvZuSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXYAMe_N-B6jSkuT5F9XHpElWmfKzIC9VKtEhiVLecTcd3UBAAB2AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEbWSnHL7Fq-ONawAIf4BrL04r5F_rp8DDJMOgs6foG-tulvjz2PssUi5T3mo19tOvklRFu3LgvwGi7lMeoi8pxSmxQhPzS0iVWYVBLbjfATggAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEdZBHsXI9ZU0R8V6b7NlAMLaNmLLM4Jw0CZmlMgqtKfecynPlpcK0nGbFWVyzcw0MP64xaGHDi03lQnGJzJZHm7pZjYtKfI3Ge7F8ctijJGYLo3zvDI41RcPyrvPJwC_i7cogcmK844mtHbIpTcIp6cn6-1zRSVTlTg1lC5KBSA0gAA; esctx-ohbWRyCBwOs=AQABCQEAAABVrSpeuWamRam2jAF1XRQEomvk8ouBJ4Qf17O6lv1ccZll0wYQUo2hFaaHA7HUWKqMyX3W4QMyOq38QYiq8tJXXxjW9pjiyzHofiXaXHbF2VIXi8MdbPqm_Yr2-NNIaUDE4QeiJduJi0FPeSijfP7KdtWXSVdPUdl54q-CyNyfsCAA; fpc=Aky4PaMTjZpLgBNZdvW_D_lc5p_pAQAAAEVLod8OAAAA; MicrosoftApplicationsTelemetryDeviceId=bf95ddf4-68a3-4f91-9ac3-f471ec78091f; brcap=0
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: unknown

HTTP traffic detected: POST /api/report?catId=GW+estsfd+est HTTP/1.1Host: identity.nel.measure.office.netConnection: keep-aliveContent-Length: 1276Content-Type: application/reports+jsonOrigin: https://login.microsoftonline.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 192.178.49.196:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.241.136:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.62.130:443 -> 192.168.2.5:49737 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@24/35@12/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1972,i,9276556746409924089,17106921590508392358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2008 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1972,i,9276556746409924089,17106921590508392358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5020 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://security.microsoft.com/url?url=https%3A%2F%2Facrobat.adobe.com%2Fid%2Furn%3Aaaid%3Asc%3AEU%3Aeafa7db4-a870-4976-bc32-05395f2fb53a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1972,i,9276556746409924089,17106921590508392358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2008 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1972,i,9276556746409924089,17106921590508392358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5020 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://security.microsoft.com/url?url=https%3A%2F%2Facrobat.adobe.com%2Fid%2Furn%3Aaaid%3Asc%3AEU%3Aeafa7db4-a870-4976-bc32-05395f2fb53a	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
e329293.dscd.akamaiedge.net	23.62.226.164	true	false	high
www.google.com	192.178.49.196	true	false	high
www.tm.a.prd.aadg.akadns.net	40.126.62.130	true	false	high
s-part-0043.t-0009.t-msedge.net	13.107.246.71	true	false	high
a1894.dscb.akamai.net	23.55.241.136	true	false	high
www.tm.a.prd.aadg.trafficmanager.net	20.190.151.67	true	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US	false	high
http://c.pki.goog/r/r4.crl	false	high
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.178.49.196	www.google.com	United States	15169	GOOGLEUS	false
40.126.62.130	www.tm.a.prd.aadg.akadns.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.55.241.136	a1894.dscb.akamai.net	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1676169
Start date and time:	2025-04-28 12:10:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://security.microsoft.com/url?url=https%3A%2F%2Facrobat.adobe.com%2Fid%2Furn%3Aaaid%3Asc%3AEU%3Aeafa7db4-a870-4976-bc32-05395f2fb53a
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@24/35@12/4

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.220.73.6, 142.250.188.238, 142.250.72.163, 192.178.49.174, 142.250.141.84, 192.178.49.206, 13.107.6.192, 20.190.151.68, 20.190.151.134, 20.190.151.133, 142.250.68.234, 192.178.49.170, 142.250.69.10, 192.178.49.202, 172.217.12.142, 142.251.40.46, 142.250.68.227, 20.42.73.27, 52.168.117.175, 20.190.151.67, 20.190.151.132, 20.190.151.131, 20.190.151.8, 20.190.151.9, 184.29.183.29, 69.192.44.226, 13.107.246.71, 4.175.87.197
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: https://security.microsoft.com/url?url=https%3A%2F%2Facrobat.adobe.com%2Fid%2Furn%3Aaaid%3Asc%3AEU%3Aeafa7db4-a870-4976-bc32-05395f2fb53a

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 12:10:58.582998037 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 28, 2025 12:10:58.895170927 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 28, 2025 12:10:59.504625082 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 28, 2025 12:10:59.551471949 CEST	49672	443	192.168.2.5	204.79.197.203
Apr 28, 2025 12:11:00.707664013 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 28, 2025 12:11:02.387645006 CEST	49691	80	192.168.2.5	142.251.40.35
Apr 28, 2025 12:11:02.535661936 CEST	80	49691	142.251.40.35	192.168.2.5
Apr 28, 2025 12:11:02.535737991 CEST	49691	80	192.168.2.5	142.251.40.35
Apr 28, 2025 12:11:02.637876987 CEST	49691	80	192.168.2.5	142.251.40.35
Apr 28, 2025 12:11:02.785888910 CEST	80	49691	142.251.40.35	192.168.2.5
Apr 28, 2025 12:11:02.786648035 CEST	80	49691	142.251.40.35	192.168.2.5
Apr 28, 2025 12:11:02.832664967 CEST	49691	80	192.168.2.5	142.251.40.35
Apr 28, 2025 12:11:03.113925934 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 28, 2025 12:11:07.926451921 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 28, 2025 12:11:09.205863953 CEST	49672	443	192.168.2.5	204.79.197.203
Apr 28, 2025 12:11:12.553623915 CEST	49701	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:11:12.553654909 CEST	443	49701	192.178.49.196	192.168.2.5
Apr 28, 2025 12:11:12.553806067 CEST	49701	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:11:12.553968906 CEST	49701	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:11:12.553982973 CEST	443	49701	192.178.49.196	192.168.2.5
Apr 28, 2025 12:11:12.871644974 CEST	443	49701	192.178.49.196	192.168.2.5
Apr 28, 2025 12:11:12.871757984 CEST	49701	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:11:12.872826099 CEST	49701	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:11:12.872837067 CEST	443	49701	192.178.49.196	192.168.2.5
Apr 28, 2025 12:11:12.873037100 CEST	443	49701	192.178.49.196	192.168.2.5
Apr 28, 2025 12:11:12.927264929 CEST	49701	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:11:17.544562101 CEST	49676	443	192.168.2.5	20.189.173.14
Apr 28, 2025 12:11:18.021699905 CEST	49712	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.021728039 CEST	443	49712	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.021789074 CEST	49712	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.021920919 CEST	49712	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.021934032 CEST	443	49712	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.353882074 CEST	443	49712	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.353956938 CEST	49712	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.354976892 CEST	49712	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.354985952 CEST	443	49712	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.355184078 CEST	443	49712	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.355432034 CEST	49712	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.400266886 CEST	443	49712	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.663597107 CEST	443	49712	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.663758039 CEST	443	49712	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.663809061 CEST	49712	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.665224075 CEST	49712	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.665245056 CEST	443	49712	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.665941954 CEST	49716	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.665985107 CEST	443	49716	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.666049957 CEST	49716	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.666193008 CEST	49716	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.666208029 CEST	443	49716	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.991836071 CEST	443	49716	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.992121935 CEST	49716	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.992136002 CEST	443	49716	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.992264986 CEST	49716	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.992270947 CEST	443	49716	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:18.992286921 CEST	49716	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:18.992297888 CEST	443	49716	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:19.713845015 CEST	443	49716	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:19.713908911 CEST	443	49716	23.55.241.136	192.168.2.5
Apr 28, 2025 12:11:19.714206934 CEST	49716	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:19.714207888 CEST	49716	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:19.714260101 CEST	49716	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:11:22.902811050 CEST	443	49701	192.178.49.196	192.168.2.5
Apr 28, 2025 12:11:22.902872086 CEST	443	49701	192.178.49.196	192.168.2.5
Apr 28, 2025 12:11:22.902982950 CEST	49701	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:11:23.134233952 CEST	49701	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:11:23.134260893 CEST	443	49701	192.178.49.196	192.168.2.5
Apr 28, 2025 12:11:35.145304918 CEST	49737	443	192.168.2.5	40.126.62.130
Apr 28, 2025 12:11:35.145344973 CEST	443	49737	40.126.62.130	192.168.2.5
Apr 28, 2025 12:11:35.145427942 CEST	49737	443	192.168.2.5	40.126.62.130
Apr 28, 2025 12:11:35.145602942 CEST	49737	443	192.168.2.5	40.126.62.130
Apr 28, 2025 12:11:35.145617008 CEST	443	49737	40.126.62.130	192.168.2.5
Apr 28, 2025 12:11:35.581259012 CEST	443	49737	40.126.62.130	192.168.2.5
Apr 28, 2025 12:11:35.581342936 CEST	49737	443	192.168.2.5	40.126.62.130
Apr 28, 2025 12:11:35.582505941 CEST	49737	443	192.168.2.5	40.126.62.130
Apr 28, 2025 12:11:35.582510948 CEST	443	49737	40.126.62.130	192.168.2.5
Apr 28, 2025 12:11:35.582758904 CEST	443	49737	40.126.62.130	192.168.2.5
Apr 28, 2025 12:11:35.583177090 CEST	49737	443	192.168.2.5	40.126.62.130
Apr 28, 2025 12:11:35.583192110 CEST	443	49737	40.126.62.130	192.168.2.5
Apr 28, 2025 12:11:35.911529064 CEST	443	49737	40.126.62.130	192.168.2.5
Apr 28, 2025 12:11:35.911596060 CEST	49737	443	192.168.2.5	40.126.62.130
Apr 28, 2025 12:11:35.911606073 CEST	443	49737	40.126.62.130	192.168.2.5
Apr 28, 2025 12:11:35.911657095 CEST	49737	443	192.168.2.5	40.126.62.130
Apr 28, 2025 12:11:35.913126945 CEST	49737	443	192.168.2.5	40.126.62.130
Apr 28, 2025 12:11:35.913141012 CEST	443	49737	40.126.62.130	192.168.2.5
Apr 28, 2025 12:12:02.926884890 CEST	49691	80	192.168.2.5	142.251.40.35
Apr 28, 2025 12:12:03.074954033 CEST	80	49691	142.251.40.35	192.168.2.5
Apr 28, 2025 12:12:03.075005054 CEST	49691	80	192.168.2.5	142.251.40.35
Apr 28, 2025 12:12:12.486759901 CEST	49742	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:12:12.486799002 CEST	443	49742	192.178.49.196	192.168.2.5
Apr 28, 2025 12:12:12.486906052 CEST	49742	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:12:12.487129927 CEST	49742	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:12:12.487145901 CEST	443	49742	192.178.49.196	192.168.2.5
Apr 28, 2025 12:12:12.800842047 CEST	443	49742	192.178.49.196	192.168.2.5
Apr 28, 2025 12:12:12.801143885 CEST	49742	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:12:12.801166058 CEST	443	49742	192.178.49.196	192.168.2.5
Apr 28, 2025 12:12:17.835864067 CEST	49744	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:17.835901976 CEST	443	49744	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:17.836016893 CEST	49744	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:17.836242914 CEST	49744	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:17.836261988 CEST	443	49744	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.169368982 CEST	443	49744	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.169873953 CEST	49744	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:18.169892073 CEST	443	49744	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.169955969 CEST	49744	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:18.169960022 CEST	443	49744	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.489715099 CEST	443	49744	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.489841938 CEST	443	49744	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.489914894 CEST	49744	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:18.490210056 CEST	49744	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:18.490221977 CEST	443	49744	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.661322117 CEST	49746	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:18.661354065 CEST	443	49746	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.661449909 CEST	49746	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:18.661550999 CEST	49746	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:18.661567926 CEST	443	49746	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.995642900 CEST	443	49746	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.995937109 CEST	49746	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:18.995964050 CEST	443	49746	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.996108055 CEST	49746	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:18.996113062 CEST	443	49746	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:18.996136904 CEST	49746	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:18.996141911 CEST	443	49746	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:19.441868067 CEST	443	49746	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:19.441915989 CEST	443	49746	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:19.442074060 CEST	49746	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:19.442161083 CEST	49746	443	192.168.2.5	23.55.241.136
Apr 28, 2025 12:12:19.442174911 CEST	443	49746	23.55.241.136	192.168.2.5
Apr 28, 2025 12:12:22.800288916 CEST	443	49742	192.178.49.196	192.168.2.5
Apr 28, 2025 12:12:22.800338030 CEST	443	49742	192.178.49.196	192.168.2.5
Apr 28, 2025 12:12:22.800412893 CEST	49742	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:12:23.619533062 CEST	49742	443	192.168.2.5	192.178.49.196
Apr 28, 2025 12:12:23.619576931 CEST	443	49742	192.178.49.196	192.168.2.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 12:11:07.877830029 CEST	53	64733	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:08.100086927 CEST	53	58280	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:09.211806059 CEST	53	57107	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:12.412604094 CEST	63905	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:11:12.412724018 CEST	64918	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:11:12.552601099 CEST	53	63905	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:12.552771091 CEST	53	64918	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:14.203408957 CEST	63127	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:11:14.203562021 CEST	50291	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:11:14.344093084 CEST	53	63127	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:14.344160080 CEST	53	50291	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:17.823504925 CEST	51641	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:11:17.823916912 CEST	59523	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:11:17.998152971 CEST	53	51641	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:18.014585018 CEST	61243	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:11:18.014734030 CEST	55093	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:11:18.020029068 CEST	53	59523	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:18.154711962 CEST	53	61243	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:18.154758930 CEST	53	55093	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:22.197575092 CEST	53	65515	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:26.286485910 CEST	53	49863	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:34.994895935 CEST	59998	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:11:34.995023012 CEST	64962	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:11:35.135061979 CEST	53	59998	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:35.144604921 CEST	53	64962	1.1.1.1	192.168.2.5
Apr 28, 2025 12:11:45.219726086 CEST	53	61263	1.1.1.1	192.168.2.5
Apr 28, 2025 12:12:01.854372978 CEST	138	138	192.168.2.5	192.168.2.255
Apr 28, 2025 12:12:07.790983915 CEST	53	64307	1.1.1.1	192.168.2.5
Apr 28, 2025 12:12:07.808022022 CEST	53	63527	1.1.1.1	192.168.2.5
Apr 28, 2025 12:12:11.122008085 CEST	53	53582	1.1.1.1	192.168.2.5
Apr 28, 2025 12:12:18.491022110 CEST	62214	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:12:18.491192102 CEST	50140	53	192.168.2.5	1.1.1.1
Apr 28, 2025 12:12:18.631897926 CEST	53	62214	1.1.1.1	192.168.2.5
Apr 28, 2025 12:12:18.672082901 CEST	53	50140	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 28, 2025 12:11:18.398917913 CEST	192.168.2.5	1.1.1.1	c2ce	(Port unreachable)	Destination Unreachable
Apr 28, 2025 12:12:18.672168970 CEST	192.168.2.5	1.1.1.1	c285	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Apr 28, 2025 12:11:02.637876987 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 28, 2025 12:11:02.786648035 CEST	1240	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 28 Apr 2025 10:10:56 GMT Expires: Mon, 28 Apr 2025 11:00:56 GMT Cache-Control: public, max-age=3000 Age: 6 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

Timestamp	Bytes transferred	Direction	Data
2025-04-28 10:11:18 UTC	441	OUT	OPTIONS /api/report?catId=GW+estsfd+est HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://login.microsoftonline.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 10:11:18 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Mon, 28 Apr 2025 10:11:18 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-04-28 10:11:18 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Timestamp	Bytes transferred	Direction	Data
2025-04-28 10:11:18 UTC	417	OUT	POST /api/report?catId=GW+estsfd+est HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Content-Length: 1276 Content-Type: application/reports+json Origin: https://login.microsoftonline.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 10:11:18 UTC	1276	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 30 33 37 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 38 30 63 63 63 61 36 37 2d 35 34 62 64 2d 34 34 61 62 2d 38 36 32 35 2d 34 62 37 39 63 34 64 63 37 37 37 35 26 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 25 32 30 69 64 5f 74 6f 6b 65 6e 26 73 63 6f 70 65 3d 6f 70 65 6e 69 Data Ascii: [{"age":0,"body":{"elapsed_time":1037,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openi
2025-04-28 10:11:19 UTC	399	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:0df9f0fa-2b61-4bcc-8864-10ea6079c765 Date: Mon, 28 Apr 2025 10:11:19 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Timestamp	Bytes transferred	Direction	Data
2025-04-28 10:11:35 UTC	1490	OUT	GET /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-dRc2Pwesrlw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE59v8lS6y5-RdP_3Npa2-uD2OwrWUSW3qDcGpGGa2V45YsXbI9mch4KFs7xuZx2uD8zU_CPhZ2j5C3w5sLHxpHpaD5wLYc3apjOfSEzGOENCuvRaXOBoglR6uqyTIyTdQw8ai8z_0D2LhoBU9ZyvZuSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXYAMe_N-B6jSkuT5F9XHpElWmfKzIC9VKtEhiVLecTcd3UBAAB2AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEbWSnHL7Fq-ONawAIf4BrL04r5F_rp8DDJMOgs6foG-tulvjz2PssUi5T3mo19tOvklRFu3LgvwGi7lMeoi8pxSmxQhPzS0iVWYVBLbjfATggAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEdZBHsXI9ZU0R8V6b7NlAMLaNmLLM4Jw0CZmlMgqtKfecynPlpcK0nGbFWVyzcw0MP64xaGHDi03lQnGJzJZHm7pZjYtKfI3Ge7F8ctijJGYLo3zvDI41RcPyrvPJwC_i7cogcmK844mtHbIpTcIp6cn6-1zRSVTlTg1lC5KBSA0gAA; esctx-ohbWRyCBwOs=AQABCQEAAABVrSpeuWamRam2jAF1XRQEomvk8ouBJ4Qf17O6lv1ccZll0wYQUo2hFaaHA7HUWKqMyX3W4QMyOq38QYiq8tJXXxjW9pjiyzHofiXaXHbF2VIXi8MdbPqm_Yr2-NNIaUDE4QeiJduJi0FPeSijfP7KdtWXSVdPUdl54q-CyNyfsCAA; fpc=Aky4PaMTjZpLgBNZdvW_D_lc5p_pAQAAAEVLod8OAAAA; MicrosoftApplicationsTelemetryDeviceId=bf95 [TRUNCATED]
2025-04-28 10:11:35 UTC	1562	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 0b9136ef-7e29-4e97-8f03-d9e5f6265000 x-ms-ests-server: 2.1.20663.10 - EUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce--C8ohlw-CzqovZPJ7By9SA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=Aky4PaMTjZpLgBNZdvW_D_lc5p_pAQAAAEVLod8OAAAA; expires=Wed, 28-May-2025 10:11:35 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Mon, 28 Apr 2025 10:11:35 GMT Connection: close Content-Length: 164
2025-04-28 10:11:35 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 33 62 34 37 33 34 33 31 2d 62 39 61 36 2d 34 37 36 66 2d 61 38 35 66 2d 32 31 36 30 62 38 39 32 35 33 36 38 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 34 2d 32 38 20 31 30 3a 31 31 3a 33 35 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"3b473431-b9a6-476f-a85f-2160b8925368","timestamp":"2025-04-28 10:11:35Z","message":"AADSTS900561"}}

Timestamp	Bytes transferred	Direction	Data
2025-04-28 10:12:18 UTC	441	OUT	OPTIONS /api/report?catId=GW+estsfd+est HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://login.microsoftonline.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-28 10:12:18 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Mon, 28 Apr 2025 10:12:18 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-04-28 10:12:18 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Target ID:	0
Start time:	06:11:02
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7464b0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	06:11:06
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1972,i,9276556746409924089,17106921590508392358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2008 /prefetch:3
Imagebase:	0x7ff7464b0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	06:11:09
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1972,i,9276556746409924089,17106921590508392358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5020 /prefetch:8
Imagebase:	0x7ff7464b0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	06:11:12
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://security.microsoft.com/url?url=https%3A%2F%2Facrobat.adobe.com%2Fid%2Furn%3Aaaid%3Asc%3AEU%3Aeafa7db4-a870-4976-bc32-05395f2fb53a"
Imagebase:	0x7ff7464b0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://security.microsoft.com/url?url=https%3A%2F%2Facrobat.adobe.com%2Fid%2Furn%3Aaaid%3Asc%3AEU%3Aeafa7db4-a870-4976-bc32-05395f2fb53a

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
https://security.microsoft.com/url?url=https%3A%2F%2Facrobat.adobe.com%2Fid%2Furn%3Aaaid%3Asc%3AEU%3Aeafa7db4-a870-4976-bc32-05395f2fb53a