Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://CA.docusign.net/member/Images/email/docInvite-white.png%5D

Overview

General Information

Sample URL:https://CA.docusign.net/member/Images/email/docInvite-white.png%5D
Analysis ID:1523642
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected non-DNS traffic on DNS port

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 3396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • chrome.exe (PID: 3744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2392,i,2971235124580381991,9876188233581106367,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • chrome.exe (PID: 7164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://CA.docusign.net/member/Images/email/docInvite-white.png%5D" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://ca.docusign.net/member/Images/email/docInvite-white.png%5DHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: global trafficTCP traffic: 192.168.2.7:60645 -> 162.159.36.2:53
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownUDP traffic detected without corresponding DNS query: 20.101.57.9
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficDNS traffic detected: DNS query: ca.docusign.net
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global trafficDNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49677 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 60651 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60651
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: classification engineClassification label: clean0.win@16/5@10/4
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2392,i,2971235124580381991,9876188233581106367,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://CA.docusign.net/member/Images/email/docInvite-white.png%5D"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2392,i,2971235124580381991,9876188233581106367,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalse
    		unknown
    www.google.com
    		142.250.184.228
    		truefalse
      		unknown
      docucdn-a.akamaihd.net
      		unknown
      		unknownfalse
        		unknown
        ca.docusign.net
        		unknown
        		unknownfalse
          		unknown
          171.39.242.20.in-addr.arpa
          		unknown
          		unknownfalse
            		unknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://ca.docusign.net/member/Images/email/docInvite-white.png%5Dfalse
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              142.250.186.68
              		unknownUnited States
              		15169GOOGLEUSfalse
              239.255.255.250
              		unknownReserved
              		unknownunknownfalse
              142.250.184.228
              		www.google.comUnited States
              		15169GOOGLEUSfalse

              Private

              IP
              192.168.2.7

              General Information

              Joe Sandbox version:41.0.0 Charoite
              Analysis ID:1523642
              Start date and time:2024-10-01 21:53:00 +02:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 3m 22s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:browseurl.jbs
              Sample URL:https://CA.docusign.net/member/Images/email/docInvite-white.png%5D
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:7
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Detection:CLEAN
              Classification:clean0.win@16/5@10/4
              EGA Information:Failed
              HCA Information:
              • Successful, ratio: 100%
              • Number of executed functions: 0
              • Number of non-executed functions: 0

              Warnings

              • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
              • Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.185.206, 173.194.76.84, 52.235.63.109, 34.104.35.123, 2.16.241.15, 2.16.241.14, 2.19.126.97, 2.19.126.79, 52.165.165.26, 199.232.210.172, 52.165.164.15, 93.184.221.240, 13.85.23.206, 20.242.39.171, 20.114.59.183, 216.58.212.163
              • Excluded domains from analysis (whitelisted): ca-lb.docusign.net.akadns.net, slscr.update.microsoft.com, clientservices.googleapis.com, time.windows.com, wu.azureedge.net, a1737.b.akamai.net, clients2.google.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, docucdn-a.akamaihd.net.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com
              • Not all processes where analyzed, report is missing behavior information
              • Report size getting too big, too many NtSetInformationFile calls found.
              • VT rate limit hit for: https://CA.docusign.net/member/Images/email/docInvite-white.png%5D

              Simulations

              Behavior and APIs

              ⊘No simulations

              LLM Input / Output

              InputOutput
              URL: https://ca.docusign.net/member/Images/email/docInvite-white.png%5D Model: jbxai
              {
"brand":[],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              ⊘No context

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              Chrome Cache Entry: 41

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:HTML document, ASCII text, with CRLF line terminators
              Category:downloaded
              Size (bytes):1245
              Entropy (8bit):5.462849750105637
              Encrypted:false
              SSDEEP:24:hM0mIAvy4Wvsqs1Ra7JZRGNeHX+AYcvP2wk1RjdEF3qpMk5:lmIAq1UqsziJZ+eHX+AdP2TvpMk5
              MD5:5343C1A8B203C162A3BF3870D9F50FD4
              SHA1:04B5B886C20D88B57EEA6D8FF882624A4AC1E51D
              SHA-256:DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
              SHA-512:E0F50ACB6061744E825A4051765CEBF23E8C489B55B190739409D8A79BB08DAC8F919247A4E5F65A015EA9C57D326BBEF7EA045163915129E01F316C4958D949
              Malicious:false
              Reputation:low
              URL:https://ca.docusign.net/member/Images/email/docInvite-white.png%5D
              Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">.. ..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="co

              Chrome Cache Entry: 42

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
              Category:downloaded
              Size (bytes):7405
              Entropy (8bit):2.037697524051661
              Encrypted:false
              SSDEEP:24:J/EFEXke6Ivyxpl3GCHKlJgY29Y8GEpx5Bh60G3Z2D7GStiv:miXhFvyxpxqQ1hpx5Bojm
              MD5:888E04D5D5FF290D47BF73787F1E0BFC
              SHA1:C8EDC4B60BB909C025B908F4ADBEEA557581687C
              SHA-256:387483B8C9FB9F677E0D72D066945675540FE417E6E6C70BAA9C013CB8FC88CD
              SHA-512:0662402C7EBC3D670D40EC55E5DC25C4360E54743517B783151F088A23FDCBE70803B4ED43BCE87D5B50908AC52AF4DEEDE6311445086E5CCFF98E2A82C0CB7A
              Malicious:false
              Reputation:low
              URL:https://docucdn-a.akamaihd.net/olive/images/2.15.0/favicons/favicon.ico
              Preview:......00..........6... ......................h.......(...0...`............................................"...........ti......................................|q......!..............# .......................y......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              Chrome Cache Entry: 43

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
              Category:dropped
              Size (bytes):7405
              Entropy (8bit):2.037697524051661
              Encrypted:false
              SSDEEP:24:J/EFEXke6Ivyxpl3GCHKlJgY29Y8GEpx5Bh60G3Z2D7GStiv:miXhFvyxpxqQ1hpx5Bojm
              MD5:888E04D5D5FF290D47BF73787F1E0BFC
              SHA1:C8EDC4B60BB909C025B908F4ADBEEA557581687C
              SHA-256:387483B8C9FB9F677E0D72D066945675540FE417E6E6C70BAA9C013CB8FC88CD
              SHA-512:0662402C7EBC3D670D40EC55E5DC25C4360E54743517B783151F088A23FDCBE70803B4ED43BCE87D5B50908AC52AF4DEEDE6311445086E5CCFF98E2A82C0CB7A
              Malicious:false
              Reputation:low
              Preview:......00..........6... ......................h.......(...0...`............................................"...........ti......................................|q......!..............# .......................y......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              Static File Info

              ⊘No static file info

              Network Behavior

              Network Port Distribution

              TCP Packets

              TimestampSource PortDest PortSource IPDest IP
              Oct 1, 2024 21:54:01.779381037 CEST49674443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:01.779421091 CEST49675443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:01.982521057 CEST49672443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:03.310542107 CEST49677443192.168.2.720.50.201.200
              Oct 1, 2024 21:54:08.101195097 CEST49671443192.168.2.7204.79.197.203
              Oct 1, 2024 21:54:09.267366886 CEST49677443192.168.2.720.50.201.200
              Oct 1, 2024 21:54:11.397434950 CEST49674443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:11.397476912 CEST49675443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:11.666573048 CEST49672443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:11.706283092 CEST49710443192.168.2.7142.250.184.228
              Oct 1, 2024 21:54:11.706342936 CEST44349710142.250.184.228192.168.2.7
              Oct 1, 2024 21:54:11.706454039 CEST49710443192.168.2.7142.250.184.228
              Oct 1, 2024 21:54:11.706856012 CEST49710443192.168.2.7142.250.184.228
              Oct 1, 2024 21:54:11.706870079 CEST44349710142.250.184.228192.168.2.7
              Oct 1, 2024 21:54:12.354156017 CEST44349710142.250.184.228192.168.2.7
              Oct 1, 2024 21:54:12.354634047 CEST49710443192.168.2.7142.250.184.228
              Oct 1, 2024 21:54:12.354656935 CEST44349710142.250.184.228192.168.2.7
              Oct 1, 2024 21:54:12.355811119 CEST44349710142.250.184.228192.168.2.7
              Oct 1, 2024 21:54:12.355950117 CEST49710443192.168.2.7142.250.184.228
              Oct 1, 2024 21:54:12.357153893 CEST49710443192.168.2.7142.250.184.228
              Oct 1, 2024 21:54:12.357234001 CEST44349710142.250.184.228192.168.2.7
              Oct 1, 2024 21:54:12.404551029 CEST49710443192.168.2.7142.250.184.228
              Oct 1, 2024 21:54:12.404570103 CEST44349710142.250.184.228192.168.2.7
              Oct 1, 2024 21:54:12.451428890 CEST49710443192.168.2.7142.250.184.228
              Oct 1, 2024 21:54:14.041670084 CEST44349702104.98.116.138192.168.2.7
              Oct 1, 2024 21:54:14.041774988 CEST49702443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:14.648154020 CEST49715443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:14.648195982 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:14.648261070 CEST49715443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:14.651952982 CEST49715443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:14.651964903 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.384258032 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.384341002 CEST49715443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:15.391637087 CEST49715443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:15.391650915 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.392004967 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.435431004 CEST49715443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:15.488538027 CEST49715443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:15.535404921 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.748533010 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.748599052 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.748886108 CEST49715443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:15.748933077 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.748948097 CEST49715443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:15.748955011 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.748979092 CEST49715443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:15.748982906 CEST44349715184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.789170027 CEST49717443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:15.789212942 CEST44349717184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:15.789392948 CEST49717443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:15.790227890 CEST49717443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:15.790247917 CEST44349717184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:16.477741957 CEST44349717184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:16.477865934 CEST49717443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:16.482039928 CEST49717443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:16.482063055 CEST44349717184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:16.482361078 CEST44349717184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:16.485325098 CEST49717443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:16.527409077 CEST44349717184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:16.767195940 CEST44349717184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:16.767268896 CEST44349717184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:16.767513990 CEST49717443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:16.771143913 CEST49717443192.168.2.7184.28.90.27
              Oct 1, 2024 21:54:16.771162987 CEST44349717184.28.90.27192.168.2.7
              Oct 1, 2024 21:54:21.185703993 CEST49677443192.168.2.720.50.201.200
              Oct 1, 2024 21:54:22.251991034 CEST44349710142.250.184.228192.168.2.7
              Oct 1, 2024 21:54:22.252055883 CEST44349710142.250.184.228192.168.2.7
              Oct 1, 2024 21:54:22.252234936 CEST49710443192.168.2.7142.250.184.228
              Oct 1, 2024 21:54:22.400379896 CEST49702443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:22.400973082 CEST49719443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:22.401006937 CEST44349719104.98.116.138192.168.2.7
              Oct 1, 2024 21:54:22.401256084 CEST49719443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:22.403675079 CEST49719443192.168.2.7104.98.116.138
              Oct 1, 2024 21:54:22.403687000 CEST44349719104.98.116.138192.168.2.7
              Oct 1, 2024 21:54:22.405316114 CEST44349702104.98.116.138192.168.2.7
              Oct 1, 2024 21:54:24.001204014 CEST49710443192.168.2.7142.250.184.228
              Oct 1, 2024 21:54:24.001251936 CEST44349710142.250.184.228192.168.2.7
              Oct 1, 2024 21:54:37.727669954 CEST6064553192.168.2.7162.159.36.2
              Oct 1, 2024 21:54:37.732620955 CEST5360645162.159.36.2192.168.2.7
              Oct 1, 2024 21:54:37.732723951 CEST6064553192.168.2.7162.159.36.2
              Oct 1, 2024 21:54:37.732956886 CEST6064553192.168.2.7162.159.36.2
              Oct 1, 2024 21:54:37.737804890 CEST5360645162.159.36.2192.168.2.7
              Oct 1, 2024 21:54:38.229701996 CEST5360645162.159.36.2192.168.2.7
              Oct 1, 2024 21:54:38.231142998 CEST6064553192.168.2.7162.159.36.2
              Oct 1, 2024 21:54:38.236356020 CEST5360645162.159.36.2192.168.2.7
              Oct 1, 2024 21:54:38.236462116 CEST6064553192.168.2.7162.159.36.2
              Oct 1, 2024 21:55:05.218311071 CEST44349719104.98.116.138192.168.2.7
              Oct 1, 2024 21:55:05.218415976 CEST49719443192.168.2.7104.98.116.138
              Oct 1, 2024 21:55:11.645426035 CEST60651443192.168.2.7142.250.186.68
              Oct 1, 2024 21:55:11.645457983 CEST44360651142.250.186.68192.168.2.7
              Oct 1, 2024 21:55:11.645522118 CEST60651443192.168.2.7142.250.186.68
              Oct 1, 2024 21:55:11.646274090 CEST60651443192.168.2.7142.250.186.68
              Oct 1, 2024 21:55:11.646285057 CEST44360651142.250.186.68192.168.2.7
              Oct 1, 2024 21:55:12.294457912 CEST44360651142.250.186.68192.168.2.7
              Oct 1, 2024 21:55:12.295197964 CEST60651443192.168.2.7142.250.186.68
              Oct 1, 2024 21:55:12.295222998 CEST44360651142.250.186.68192.168.2.7
              Oct 1, 2024 21:55:12.295587063 CEST44360651142.250.186.68192.168.2.7
              Oct 1, 2024 21:55:12.296930075 CEST60651443192.168.2.7142.250.186.68
              Oct 1, 2024 21:55:12.297013044 CEST44360651142.250.186.68192.168.2.7
              Oct 1, 2024 21:55:12.342549086 CEST60651443192.168.2.7142.250.186.68
              Oct 1, 2024 21:55:22.214682102 CEST44360651142.250.186.68192.168.2.7
              Oct 1, 2024 21:55:22.214740992 CEST44360651142.250.186.68192.168.2.7
              Oct 1, 2024 21:55:22.214787960 CEST60651443192.168.2.7142.250.186.68
              Oct 1, 2024 21:55:24.001007080 CEST60651443192.168.2.7142.250.186.68
              Oct 1, 2024 21:55:24.001032114 CEST44360651142.250.186.68192.168.2.7

              UDP Packets

              TimestampSource PortDest PortSource IPDest IP
              Oct 1, 2024 21:54:03.951713085 CEST123123192.168.2.720.101.57.9
              Oct 1, 2024 21:54:04.128304958 CEST12312320.101.57.9192.168.2.7
              Oct 1, 2024 21:54:09.339790106 CEST53546821.1.1.1192.168.2.7
              Oct 1, 2024 21:54:09.430986881 CEST53565191.1.1.1192.168.2.7
              Oct 1, 2024 21:54:10.131831884 CEST6056953192.168.2.71.1.1.1
              Oct 1, 2024 21:54:10.132018089 CEST5063053192.168.2.71.1.1.1
              Oct 1, 2024 21:54:10.159734011 CEST53506301.1.1.1192.168.2.7
              Oct 1, 2024 21:54:11.407668114 CEST53636111.1.1.1192.168.2.7
              Oct 1, 2024 21:54:11.659940004 CEST6086353192.168.2.71.1.1.1
              Oct 1, 2024 21:54:11.660108089 CEST5849853192.168.2.71.1.1.1
              Oct 1, 2024 21:54:11.666798115 CEST53608631.1.1.1192.168.2.7
              Oct 1, 2024 21:54:11.667289019 CEST53584981.1.1.1192.168.2.7
              Oct 1, 2024 21:54:11.892683983 CEST5216153192.168.2.71.1.1.1
              Oct 1, 2024 21:54:11.892822981 CEST5285953192.168.2.71.1.1.1
              Oct 1, 2024 21:54:12.852031946 CEST5995753192.168.2.71.1.1.1
              Oct 1, 2024 21:54:12.852231979 CEST6167453192.168.2.71.1.1.1
              Oct 1, 2024 21:54:28.476869106 CEST53499771.1.1.1192.168.2.7
              Oct 1, 2024 21:54:37.725542068 CEST5360289162.159.36.2192.168.2.7
              Oct 1, 2024 21:54:38.249689102 CEST5801653192.168.2.71.1.1.1
              Oct 1, 2024 21:54:38.257910967 CEST53580161.1.1.1192.168.2.7
              Oct 1, 2024 21:54:58.193485022 CEST138138192.168.2.7192.168.2.255
              Oct 1, 2024 21:55:11.635840893 CEST5031553192.168.2.71.1.1.1
              Oct 1, 2024 21:55:11.642672062 CEST53503151.1.1.1192.168.2.7

              ICMP Packets

              TimestampSource IPDest IPChecksumCodeType
              Oct 1, 2024 21:54:10.159794092 CEST192.168.2.71.1.1.1c252(Port unreachable)Destination Unreachable

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Oct 1, 2024 21:54:10.131831884 CEST192.168.2.71.1.1.10x7f94Standard query (0)ca.docusign.netA (IP address)IN (0x0001)false
              Oct 1, 2024 21:54:10.132018089 CEST192.168.2.71.1.1.10xcdebStandard query (0)ca.docusign.net65IN (0x0001)false
              Oct 1, 2024 21:54:11.659940004 CEST192.168.2.71.1.1.10x91daStandard query (0)www.google.comA (IP address)IN (0x0001)false
              Oct 1, 2024 21:54:11.660108089 CEST192.168.2.71.1.1.10x3fc3Standard query (0)www.google.com65IN (0x0001)false
              Oct 1, 2024 21:54:11.892683983 CEST192.168.2.71.1.1.10x9556Standard query (0)docucdn-a.akamaihd.netA (IP address)IN (0x0001)false
              Oct 1, 2024 21:54:11.892822981 CEST192.168.2.71.1.1.10xd65bStandard query (0)docucdn-a.akamaihd.net65IN (0x0001)false
              Oct 1, 2024 21:54:12.852031946 CEST192.168.2.71.1.1.10x2507Standard query (0)docucdn-a.akamaihd.netA (IP address)IN (0x0001)false
              Oct 1, 2024 21:54:12.852231979 CEST192.168.2.71.1.1.10x556bStandard query (0)docucdn-a.akamaihd.net65IN (0x0001)false
              Oct 1, 2024 21:54:38.249689102 CEST192.168.2.71.1.1.10x9790Standard query (0)171.39.242.20.in-addr.arpaPTR (Pointer record)IN (0x0001)false
              Oct 1, 2024 21:55:11.635840893 CEST192.168.2.71.1.1.10x4e11Standard query (0)www.google.comA (IP address)IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Oct 1, 2024 21:54:10.148686886 CEST1.1.1.1192.168.2.70x7f94No error (0)ca.docusign.netca-lb.docusign.net.akadns.netCNAME (Canonical name)IN (0x0001)false
              Oct 1, 2024 21:54:10.159734011 CEST1.1.1.1192.168.2.70xcdebNo error (0)ca.docusign.netca-lb.docusign.net.akadns.netCNAME (Canonical name)IN (0x0001)false
              Oct 1, 2024 21:54:11.666798115 CEST1.1.1.1192.168.2.70x91daNo error (0)www.google.com142.250.184.228A (IP address)IN (0x0001)false
              Oct 1, 2024 21:54:11.667289019 CEST1.1.1.1192.168.2.70x3fc3No error (0)www.google.com65IN (0x0001)false
              Oct 1, 2024 21:54:11.902190924 CEST1.1.1.1192.168.2.70xd65bNo error (0)docucdn-a.akamaihd.netdocucdn-a.akamaihd.net.edgesuite.netCNAME (Canonical name)IN (0x0001)false
              Oct 1, 2024 21:54:11.904649973 CEST1.1.1.1192.168.2.70x9556No error (0)docucdn-a.akamaihd.netdocucdn-a.akamaihd.net.edgesuite.netCNAME (Canonical name)IN (0x0001)false
              Oct 1, 2024 21:54:12.861109972 CEST1.1.1.1192.168.2.70x2507No error (0)docucdn-a.akamaihd.netdocucdn-a.akamaihd.net.edgesuite.netCNAME (Canonical name)IN (0x0001)false
              Oct 1, 2024 21:54:12.861712933 CEST1.1.1.1192.168.2.70x556bNo error (0)docucdn-a.akamaihd.netdocucdn-a.akamaihd.net.edgesuite.netCNAME (Canonical name)IN (0x0001)false
              Oct 1, 2024 21:54:23.005852938 CEST1.1.1.1192.168.2.70xf884No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
              Oct 1, 2024 21:54:23.005852938 CEST1.1.1.1192.168.2.70xf884No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
              Oct 1, 2024 21:54:38.257910967 CEST1.1.1.1192.168.2.70x9790Name error (3)171.39.242.20.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false
              Oct 1, 2024 21:55:11.642672062 CEST1.1.1.1192.168.2.70x4e11No error (0)www.google.com142.250.186.68A (IP address)IN (0x0001)false

              HTTP Request Dependency Graph

              • fs.microsoft.com

              HTTPS Proxied Packets

              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              0192.168.2.749715184.28.90.27443
              TimestampBytes transferredDirectionData
              2024-10-01 19:54:15 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
              Connection: Keep-Alive
              Accept: */*
              Accept-Encoding: identity
              User-Agent: Microsoft BITS/7.8
              Host: fs.microsoft.com
              2024-10-01 19:54:15 UTC467INHTTP/1.1 200 OK
              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
              Content-Type: application/octet-stream
              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
              Server: ECAcc (lpl/EF06)
              X-CID: 11
              X-Ms-ApiVersion: Distribute 1.2
              X-Ms-Region: prod-neu-z1
              Cache-Control: public, max-age=161495
              Date: Tue, 01 Oct 2024 19:54:15 GMT
              Connection: close
              X-CID: 2


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              1192.168.2.749717184.28.90.27443
              TimestampBytes transferredDirectionData
              2024-10-01 19:54:16 UTC239OUTGET /fs/windows/config.json HTTP/1.1
              Connection: Keep-Alive
              Accept: */*
              Accept-Encoding: identity
              If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
              Range: bytes=0-2147483646
              User-Agent: Microsoft BITS/7.8
              Host: fs.microsoft.com
              2024-10-01 19:54:16 UTC515INHTTP/1.1 200 OK
              ApiVersion: Distribute 1.1
              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
              Content-Type: application/octet-stream
              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
              Server: ECAcc (lpl/EF06)
              X-CID: 11
              X-Ms-ApiVersion: Distribute 1.2
              X-Ms-Region: prod-weu-z1
              Cache-Control: public, max-age=161438
              Date: Tue, 01 Oct 2024 19:54:16 GMT
              Content-Length: 55
              Connection: close
              X-CID: 2
              2024-10-01 19:54:16 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
              Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:0
              Start time:15:54:04
              Start date:01/10/2024
              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
              Imagebase:0x7ff6c4390000
              File size:3'242'272 bytes
              MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:false

              General

              Target ID:2
              Start time:15:54:06
              Start date:01/10/2024
              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2392,i,2971235124580381991,9876188233581106367,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Imagebase:0x7ff6c4390000
              File size:3'242'272 bytes
              MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:false

              General

              Target ID:3
              Start time:15:54:09
              Start date:01/10/2024
              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://CA.docusign.net/member/Images/email/docInvite-white.png%5D"
              Imagebase:0x7ff6c4390000
              File size:3'242'272 bytes
              MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:true

              Disassembly

              ⊘No disassembly