Edit tour

Windows Analysis Report
https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAXOLPIJBfBmvGxlXwPlfq9c6X3NsD1pg6O8JYZY2E-Ga3AuSQNGZ-g8N0TvBmaUFABJvylLGhsJ9uMpqr2DHsr9g8lX7QuPwmuLcGhhclzXMQHuhGjFAB_Dnt33FKgDL2&

Overview

General Information

Sample URL:	https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAXOLPIJBfBmvGxlXwPlfq9c6X3NsD1pg6O8JYZY2E-Ga3AuSQNGZ-g8N0TvBmaUFABJvylLGhsJ9uMpqr2DHsr9g8lX7QuPwmuLcGhhclzXMQHuhGjFAB_Dnt3
Analysis ID:	1524299
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML body contains low number of good links

HTML body contains password input but no form action

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1908,i,2733554176455454787,14053848275243881291,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAXOLPIJBfBmvGxlXwPlfq9c6X3NsD1pg6O8JYZY2E-Ga3AuSQNGZ-g8N0TvBmaUFABJvylLGhsJ9uMpqr2DHsr9g8lX7QuPwmuLcGhhclzXMQHuhGjFAB_Dnt33FKgDL2&" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerOrg%2Caddi...

HTTP Parser: Number of links: 0

HTTP Parser: <input type="password" .../> found but no <form action="...

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49843 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9E1005A551ED61CA0A490D45%40AdobeOrg&d_nsid=0&ts=1727881899327 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://auth.services.adobe.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerOrg%2Cadditional_info.roles%2Caps.read.app_merchandising%2Csign_application_read%2Csign_application_write&state=5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8&relay=81555558-98b9-4eda-b01f-5bc6fa3def7e&locale=en_US&flow_type=code&ctx_id=Adobe_Sign&dctx_id=adobe_document_cloud&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fgps.echosign.com%2Fpublic%2FadobeIDLogin%3Fserver%3Dna4.documents.adobe.com%26isAdobeSignAuth%3Dfalse%26port%3D443&use_ms_for_expiry=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9E1005A551ED61CA0A490D45%40AdobeOrg&d_nsid=0&ts=1727881899327 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://auth.services.adobe.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerOrg%2Cadditional_info.roles%2Caps.read.app_merchandising%2Csign_application_read%2Csign_application_write&state=5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8&relay=81555558-98b9-4eda-b01f-5bc6fa3def7e&locale=en_US&flow_type=code&ctx_id=Adobe_Sign&dctx_id=adobe_document_cloud&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fgps.echosign.com%2Fpublic%2FadobeIDLogin%3Fserver%3Dna4.documents.adobe.com%26isAdobeSignAuth%3Dfalse%26port%3D443&use_ms_for_expiry=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=00284102289035300662441585223568858635
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=9E1005A551ED61CA0A490D45%40AdobeOrg&mid=00123936210207526042425938051521735301&ts=1727881901909 HTTP/1.1Host: sstats.adobe.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://auth.services.adobe.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerOrg%2Cadditional_info.roles%2Caps.read.app_merchandising%2Csign_application_read%2Csign_application_write&state=5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8&relay=81555558-98b9-4eda-b01f-5bc6fa3def7e&locale=en_US&flow_type=code&ctx_id=Adobe_Sign&dctx_id=adobe_document_cloud&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fgps.echosign.com%2Fpublic%2FadobeIDLogin%3Fserver%3Dna4.documents.adobe.com%26isAdobeSignAuth%3Dfalse%26port%3D443&use_ms_for_expiry=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889101s%7CNONE%7CvVersion%7C5.4.0
Source: global traffic	HTTP traffic detected: GET /clients/adobe-sign-2020/4x_f39219ea552b8fc1c7b42c6a2d0290c2.png HTTP/1.1Host: static.adobelogin.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerOrg%2Cadditional_info.roles%2Caps.read.app_merchandising%2Csign_application_read%2Csign_application_write&state=5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8&relay=81555558-98b9-4eda-b01f-5bc6fa3def7e&locale=en_US&flow_type=code&ctx_id=Adobe_Sign&dctx_id=adobe_document_cloud&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fgps.echosign.com%2Fpublic%2FadobeIDLogin%3Fserver%3Dna4.documents.adobe.com%26isAdobeSignAuth%3Dfalse%26port%3D443&use_ms_for_expiry=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9E1005A551ED61CA0A490D45%40AdobeOrg&d_nsid=0&ts=1727881899327 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=00284102289035300662441585223568858635
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=9E1005A551ED61CA0A490D45%40AdobeOrg&mid=00123936210207526042425938051521735301&ts=1727881901909 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; s_ecid=MCMID%7C00123936210207526042425938051521735301; s_cc=true; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889102s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0
Source: global traffic	HTTP traffic detected: GET /clients/adobe-sign-2020/4x_f39219ea552b8fc1c7b42c6a2d0290c2.png HTTP/1.1Host: static.adobelogin.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/adbims,adbadobenonacdcprod,adbadobeprototype/1/JS-2.22.4-LCS4/s9125782429231 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; s_ecid=MCMID%7C00123936210207526042425938051521735301; s_cc=true; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889102s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0
Source: global traffic	HTTP traffic detected: GET /b/ss/adbims,adbadobenonacdcprod,adbadobeprototype/1/JS-2.22.4-LCS4/s9125782429231?AQB=1&pccr=true&vidn=337EB158DF781E12-600014BE22F88CB1&g=none&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; s_ecid=MCMID%7C00123936210207526042425938051521735301; s_cc=true; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889102s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; s_vi=[CS]v1\|337EB158DF781E12-600014BE22F88CB1[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbims,adbadobenonacdcprod,adbadobeprototype/1/JS-2.22.4-LCS4/s9847560444662 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; s_ecid=MCMID%7C00123936210207526042425938051521735301; s_cc=true; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889102s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; s_vi=[CS]v1\|337EB158DF781E12-600014BE22F88CB1[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbims,adbadobenonacdcprod,adbadobeprototype/1/JS-2.22.4-LCS4/s94143179143099 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; s_ecid=MCMID%7C00123936210207526042425938051521735301; s_cc=true; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889102s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; s_vi=[CS]v1\|337EB158DF781E12-600014BE22F88CB1[CE]

Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: static.echocdn.com
Source: global traffic	DNS traffic detected: DNS query: secure.na4.echocdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net
Source: global traffic	DNS traffic detected: DNS query: secure.na4.adobesign.com
Source: global traffic	DNS traffic detected: DNS query: ims-na1.adobelogin.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: static.adobelogin.com

Source: unknown

HTTP traffic detected: POST /b/ss/adbims,adbadobenonacdcprod,adbadobeprototype/1/JS-2.22.4-LCS4/s9125782429231 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveContent-Length: 6554sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://auth.services.adobe.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerOrg%2Cadditional_info.roles%2Caps.read.app_merchandising%2Csign_application_read%2Csign_application_write&state=5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8&relay=81555558-98b9-4eda-b01f-5bc6fa3def7e&locale=en_US&flow_type=code&ctx_id=Adobe_Sign&dctx_id=adobe_document_cloud&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fgps.echosign.com%2Fpublic%2FadobeIDLogin%3Fserver%3Dna4.documents.adobe.com%26isAdobeSignAuth%3Dfalse%26port%3D443&use_ms_for_expiry=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; s_ecid=MCMID%7C00123936210207526042425938051521735301; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889101s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; s_cc=true

Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: http://api.jqueryui.com/position/
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: http://eightmedia.github.com/hammer.js
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: http://flesler.blogspot.com
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: http://flesler.blogspot.com/2007/10/jqueryscrollto.html
Source: chromecache_140.2.dr, chromecache_129.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_81.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: http://trentrichardson.com/examples/timepicker
Source: chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000149e7
Source: chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000176ff
Source: chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017701
Source: chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017702
Source: chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017703
Source: chromecache_140.2.dr, chromecache_129.2.dr	String found in binary or memory: http://underscorejs.org/LICENSE
Source: chromecache_96.2.dr, chromecache_116.2.dr, chromecache_81.2.dr, chromecache_136.2.dr	String found in binary or memory: http://www.mozilla.org/MPL/
Source: chromecache_84.2.dr	String found in binary or memory: https://github.com/WebReflection/url-search-params/blob/master/README.md#ios-10--other-platforms-bug
Source: chromecache_140.2.dr, chromecache_129.2.dr	String found in binary or memory: https://github.com/facebook/regenerator/blob/main/LICENSE
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: https://github.com/gabceb
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: https://github.com/gabceb/jquery-browser-plugin
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: https://github.com/jquery/jquery-color
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: https://github.com/websanova/mousestop
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: https://jqueryvalidation.org/
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_140.2.dr, chromecache_129.2.dr	String found in binary or memory: https://lodash.com/
Source: chromecache_140.2.dr, chromecache_129.2.dr	String found in binary or memory: https://lodash.com/license
Source: chromecache_140.2.dr, chromecache_129.2.dr	String found in binary or memory: https://openjsf.org/
Source: chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: https://p.typekit.net/p.gif
Source: chromecache_96.2.dr, chromecache_81.2.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_138.2.dr, chromecache_119.2.dr	String found in binary or memory: https://sso.behance.net/ims
Source: chromecache_137.2.dr, chromecache_110.2.dr	String found in binary or memory: https://static.adobelogin.com/clients/adobe-sign-2020/1x_f39219ea552b8fc1c7b42c6a2d0290c2.png
Source: chromecache_137.2.dr, chromecache_110.2.dr	String found in binary or memory: https://static.adobelogin.com/clients/adobe-sign-2020/2x_f39219ea552b8fc1c7b42c6a2d0290c2.png
Source: chromecache_137.2.dr, chromecache_110.2.dr	String found in binary or memory: https://static.adobelogin.com/clients/adobe-sign-2020/4x_f39219ea552b8fc1c7b42c6a2d0290c2.png
Source: chromecache_137.2.dr, chromecache_110.2.dr	String found in binary or memory: https://static.adobelogin.com/clients/adobe-sign-2020/f39219ea552b8fc1c7b42c6a2d0290c2.png
Source: chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/
Source: chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/
Source: chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/
Source: chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: https://use.typekit.net/af/e301c6/0000000000000000000149e7/27/
Source: chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1908,i,2733554176455454787,14053848275243881291,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAXOLPIJBfBmvGxlXwPlfq9c6X3NsD1pg6O8JYZY2E-Ga3AuSQNGZ-g8N0TvBmaUFABJvylLGhsJ9uMpqr2DHsr9g8lX7QuPwmuLcGhhclzXMQHuhGjFAB_Dnt33FKgDL2&"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1908,i,2733554176455454787,14053848275243881291,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
http://jquery.org/license	0%	URL Reputation	safe
https://lodash.com/	0%	URL Reputation	safe
http://sizzlejs.com/	0%	URL Reputation	safe
http://jqueryui.com	0%	URL Reputation	safe
http://api.jqueryui.com/position/	0%	URL Reputation	safe
http://underscorejs.org/LICENSE	0%	URL Reputation	safe
https://jquery.org/license	0%	URL Reputation	safe
https://jquery.com/	0%	URL Reputation	safe
https://p.typekit.net/p.gif	0%	URL Reputation	safe
https://lodash.com/license	0%	URL Reputation	safe
https://openjsf.org/	0%	URL Reputation	safe
https://sizzlejs.com/	0%	URL Reputation	safe
https://js.foundation/	0%	URL Reputation	safe
http://jedwatson.github.io/classnames	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
dd20fzx9mj46f.cloudfront.net	13.224.189.8	true	false	unknown
adobe.com.ssl.d1.sc.omtrdc.net	63.140.62.17	true	false	unknown
www.google.com	216.58.206.36	true	false	unknown
secure.na4.adobesign.com	52.35.253.84	true	false	unknown
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	99.81.250.169	true	false	unknown
secure.na4dc2.echosign.com	52.35.253.84	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
windowsupdatebg.s.llnwi.net	87.248.204.0	true	false	unknown
use.typekit.net	unknown	unknown	false	unknown
p.typekit.net	unknown	unknown	false	unknown
ims-na1.adobelogin.com	unknown	unknown	false	unknown
secure.na4.echocdn.com	unknown	unknown	false	unknown
dpm.demdex.net	unknown	unknown	false	unknown
static.adobelogin.com	unknown	unknown	false	unknown
static.echocdn.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://static.adobelogin.com/clients/adobe-sign-2020/4x_f39219ea552b8fc1c7b42c6a2d0290c2.png	false	unknown
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9E1005A551ED61CA0A490D45%40AdobeOrg&d_nsid=0&ts=1727881899327	false	unknown
https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9E1005A551ED61CA0A490D45%40AdobeOrg&d_nsid=0&ts=1727881899327	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://sso.behance.net/ims	chromecache_138.2.dr, chromecache_119.2.dr	false		unknown
https://jqueryvalidation.org/	chromecache_96.2.dr, chromecache_81.2.dr	false		unknown
http://jquery.org/license	chromecache_96.2.dr, chromecache_81.2.dr	false	URL Reputation: safe	unknown
https://lodash.com/	chromecache_140.2.dr, chromecache_129.2.dr	false	URL Reputation: safe	unknown
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/	chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	false		unknown
http://sizzlejs.com/	chromecache_96.2.dr, chromecache_81.2.dr	false	URL Reputation: safe	unknown
https://static.adobelogin.com/clients/adobe-sign-2020/2x_f39219ea552b8fc1c7b42c6a2d0290c2.png	chromecache_137.2.dr, chromecache_110.2.dr	false		unknown
http://jqueryui.com	chromecache_81.2.dr	false	URL Reputation: safe	unknown
http://api.jqueryui.com/position/	chromecache_96.2.dr, chromecache_81.2.dr	false	URL Reputation: safe	unknown
https://use.typekit.net/af/e301c6/0000000000000000000149e7/27/	chromecache_87.2.dr, chromecache_76.2.dr	false		unknown
https://github.com/WebReflection/url-search-params/blob/master/README.md#ios-10--other-platforms-bug	chromecache_84.2.dr	false		unknown
https://github.com/jquery/jquery-color	chromecache_96.2.dr, chromecache_81.2.dr	false		unknown
http://typekit.com/eulas/0000000000000000000149e7	chromecache_87.2.dr, chromecache_76.2.dr	false		unknown
https://use.typekit.net/af/cb695f/000000000000000000017701/27/	chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	false		unknown
http://underscorejs.org/LICENSE	chromecache_140.2.dr, chromecache_129.2.dr	false	URL Reputation: safe	unknown
http://eightmedia.github.com/hammer.js	chromecache_96.2.dr, chromecache_81.2.dr	false		unknown
https://jquery.org/license	chromecache_96.2.dr, chromecache_81.2.dr	false	URL Reputation: safe	unknown
https://github.com/gabceb/jquery-browser-plugin	chromecache_96.2.dr, chromecache_81.2.dr	false		unknown
https://jquery.com/	chromecache_96.2.dr, chromecache_81.2.dr	false	URL Reputation: safe	unknown
https://p.typekit.net/p.gif	chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	false	URL Reputation: safe	unknown
http://typekit.com/eulas/0000000000000000000176ff	chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	false		unknown
https://github.com/gabceb	chromecache_96.2.dr, chromecache_81.2.dr	false		unknown
http://typekit.com/eulas/000000000000000000017701	chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	false		unknown
https://static.adobelogin.com/clients/adobe-sign-2020/f39219ea552b8fc1c7b42c6a2d0290c2.png	chromecache_137.2.dr, chromecache_110.2.dr	false		unknown
http://typekit.com/eulas/000000000000000000017702	chromecache_87.2.dr, chromecache_76.2.dr	false		unknown
http://flesler.blogspot.com	chromecache_96.2.dr, chromecache_81.2.dr	false		unknown
http://typekit.com/eulas/000000000000000000017703	chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	false		unknown
https://lodash.com/license	chromecache_140.2.dr, chromecache_129.2.dr	false	URL Reputation: safe	unknown
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/	chromecache_144.2.dr, chromecache_100.2.dr, chromecache_87.2.dr, chromecache_76.2.dr	false		unknown
https://static.adobelogin.com/clients/adobe-sign-2020/1x_f39219ea552b8fc1c7b42c6a2d0290c2.png	chromecache_137.2.dr, chromecache_110.2.dr	false		unknown
http://flesler.blogspot.com/2007/10/jqueryscrollto.html	chromecache_96.2.dr, chromecache_81.2.dr	false		unknown
https://openjsf.org/	chromecache_140.2.dr, chromecache_129.2.dr	false	URL Reputation: safe	unknown
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/	chromecache_87.2.dr, chromecache_76.2.dr	false		unknown
https://github.com/websanova/mousestop	chromecache_96.2.dr, chromecache_81.2.dr	false		unknown
https://sizzlejs.com/	chromecache_96.2.dr, chromecache_81.2.dr	false	URL Reputation: safe	unknown
https://js.foundation/	chromecache_96.2.dr, chromecache_81.2.dr	false	URL Reputation: safe	unknown
https://github.com/facebook/regenerator/blob/main/LICENSE	chromecache_140.2.dr, chromecache_129.2.dr	false		unknown
http://jedwatson.github.io/classnames	chromecache_140.2.dr, chromecache_129.2.dr	false	URL Reputation: safe	unknown
http://trentrichardson.com/examples/timepicker	chromecache_96.2.dr, chromecache_81.2.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
13.224.189.78	unknown	United States	16509	AMAZON-02US	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
63.140.62.27	unknown	United States	15224	OMNITUREUS	false
13.224.189.8	dd20fzx9mj46f.cloudfront.net	United States	16509	AMAZON-02US	false
63.140.62.17	adobe.com.ssl.d1.sc.omtrdc.net	United States	15224	OMNITUREUS	false
18.202.109.49	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
99.81.250.169	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524299
Start date and time:	2024-10-02 17:09:50 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAXOLPIJBfBmvGxlXwPlfq9c6X3NsD1pg6O8JYZY2E-Ga3AuSQNGZ-g8N0TvBmaUFABJvylLGhsJ9uMpqr2DHsr9g8lX7QuPwmuLcGhhclzXMQHuhGjFAB_Dnt33FKgDL2&
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/122@30/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://na4.documents.adobe.com/public/login

Input	Output
URL: https://na4.documents.adobe.com/public/userMessage?token=A59DBC66ECB7F2734F210B1836E128D1312E52479E1A670A3F336B32E45E910 Model: jbxai

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2258)
Category:	dropped
Size (bytes):	17008
Entropy (8bit):	5.5502271222360395
Encrypted:	false
SSDEEP:	384:cx2hpIgIVsUGiRm4lIeU4iDFeFs2NdFJsQF+i:cR7GiRm4X0JqsG7Ui
MD5:	A10396392AF7006E81573A789F8F0367
SHA1:	187F5E45A312D581FE4248DFF447F6DC4DDB208D
SHA-256:	92C86130DAF66FC1BCEF9A45A15608ABE448740ABDC3BCA1EEE9301767DDAF8B
SHA-512:	092900888FD08AE5B5458E91F92880EF10D909BA9F4656FB8DD80B9A4E24760213D5CB02E5BD6849360797FDD1D0D85E71BF4A6C868A40C9110EF3F7765300EA
Malicious:	false
Reputation:	low
Preview:	/. The Typekit service used to deliver this font or fonts for use on websites. * is provided by Adobe and is subject to these Terms of Use. * http://www.adobe.com/products/eulas/tou_typekit. For font license. * information, see the list below.. . adobe-clean:. * - http://typekit.com/eulas/000000000000000000017701. * - http://typekit.com/eulas/000000000000000000017703. * - http://typekit.com/eulas/0000000000000000000176ff. . . 2009-2024 Adobe Systems Incorporated. All Rights Reserved.. */.if(!window.Typekit)window.Typekit={};window.Typekit.config={"a":"1164490","c":[".tk-adobe-clean","\"adobe-clean\",sans-serif"],"fi":[7180,7182,7184],"fc":[{"id":7180,"family":"adobe-clean","src":"https://use.typekit.net/af/cb695f/000000000000000000017701/27/{format}{?primer,subset_id,fvd,v}","descriptors":{"weight":"400","style":"normal","stretch":"normal","display":"auto","variable":false,"subset_id":2}},{"id":7182,"family":"adobe-clean","src":"https://use.typekit.net/af/eaf09c/0000000

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://p.typekit.net/p.gif?s=1&k=pfu1huz&ht=tk&h=na4.documents.adobe.com&f=7180.7181.7182.7184.22766&a=717200&js=1.21.0&app=typekit&e=js&_=1727881886810
Preview:	GIF89a.............,..............;

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 29980, version 1.0
Category:	downloaded
Size (bytes):	29980
Entropy (8bit):	7.991242817341188
Encrypted:	true
SSDEEP:	384:Qe9rpy2HXqWLQHZGKdRNVaFFHvYk9ur4QMvkQ5OAe0kM/1uwOnz6AuPtUZfLLcBt:QCrB/MHpIZCgsQ5Xkbwo6A+UZncXp0E
MD5:	864FC6D95444FD085441968A712F6C9F
SHA1:	7E54F060DF28A16E146AB1EB15AB3A59D3D9BE06
SHA-256:	371F06319FA71DE555AEBEFCFFBE3C1F755E5761D90AACD9BBA0C64C6CF40090
SHA-512:	7CADDDDCD35910BC04D80EB10F0776BBF7C770AFCF960FBBDFCC8E8DB1BACD694883A3E9A1540552B544AE639FA42C9B79690ADB81F7D5210467B6494BA25880
Malicious:	false
Reputation:	low
URL:	https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?subset_id=2&fvd=n7&v=3
Preview:	wOF2OTTO..u........0..t..........................F...D?DYNA.i?GDYN.y..H.`..N...6.$..H...... .5...H..V.CDE....}........W.?@..................o.9.%r.xtl%V.H9I....{..;.3..._..Km...LL..5...$..d.-0.b(...;I $..Vc3.d..\|....9..=f..,....4../......-..J..z...r...C.%....U.V,....T.l......q%...A..]I....E..$.......s...N...p.(4Is.K.r.C.v.L.a...(.e..{............m!...\&p.T2S.O..e...?....#...ylj..!....d....W..E...Q....y..z...!X..^QY..W_9..x...?...M...!.......,+`YV.e]........?V.{.jd..+krf.3K?.9...,.8....CREr...YLf..?.3.dqv..\...pU...H`!..+...l}..)....J.....M.P.;.......;w.....Zw...(.....lM..zj....`X.:.CqL.L..?.....d./...l.y9..xy;. ...P.X .I.l....Y......5'.0S'..L../...p.....+.B.. ....eb..:3.ns..B..a........~L.....R.w..!E.9{.}..dB%.zxq.5.F. ..q0.f.\|X..\|.o.m..+w.....<&...k9{..&......+...s..."..d2.u.UC..q.K..8....VC'qr.....j[.qb2NZ!.N.O.:._...e..*.C.u..5.8....t.h+...:..!Lv>8......<J......R......A:B.Gg...:.6K.J.N... ......uIl.V.C....{....X..uS.2.)..=..s

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 17:10:55.040437937 CEST	53	64747	1.1.1.1	192.168.2.6
Oct 2, 2024 17:10:55.160742044 CEST	53	50407	1.1.1.1	192.168.2.6
Oct 2, 2024 17:10:56.234371901 CEST	53	59550	1.1.1.1	192.168.2.6
Oct 2, 2024 17:10:57.677474022 CEST	53	55150	1.1.1.1	192.168.2.6
Oct 2, 2024 17:10:59.429325104 CEST	59834	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:10:59.429697990 CEST	62952	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:10:59.430022955 CEST	49607	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:10:59.430239916 CEST	49573	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:10:59.430836916 CEST	56275	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:10:59.431407928 CEST	64698	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:10:59.459142923 CEST	53	56275	1.1.1.1	192.168.2.6
Oct 2, 2024 17:10:59.461730957 CEST	53	64698	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:00.017821074 CEST	56541	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:00.018929958 CEST	50919	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:00.028115988 CEST	53	56541	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:00.029031992 CEST	53	50919	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:02.350872040 CEST	54445	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:02.351406097 CEST	58592	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:02.351830006 CEST	60626	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:02.351983070 CEST	64109	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:02.380181074 CEST	53	64109	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:02.380291939 CEST	53	60626	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:02.389920950 CEST	63096	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:02.390378952 CEST	49475	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:13.495373964 CEST	53	61952	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:27.825072050 CEST	49253	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:27.825376034 CEST	64551	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:30.946109056 CEST	52115	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:30.946604013 CEST	62806	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:30.959850073 CEST	53	50215	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:32.866924047 CEST	53059	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:32.867085934 CEST	53777	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:32.872494936 CEST	53	63329	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:32.885139942 CEST	53	53059	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:32.885281086 CEST	53	53777	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:33.771792889 CEST	56031	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:33.772161961 CEST	64521	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:40.623086929 CEST	59987	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:40.623262882 CEST	59100	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:40.630340099 CEST	53	59987	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:40.630738974 CEST	53	59100	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:41.348927975 CEST	53	65065	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:43.005525112 CEST	53	53522	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:43.103310108 CEST	60831	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:43.103530884 CEST	55263	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:43.110835075 CEST	53	60831	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:43.178318977 CEST	53	55263	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:43.369292021 CEST	59549	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:43.369810104 CEST	57774	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:43.376422882 CEST	53	59549	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:43.376526117 CEST	53	57774	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:43.594996929 CEST	53	54582	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:44.072992086 CEST	49307	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:44.073471069 CEST	56946	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:11:44.080924034 CEST	53	49307	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:44.098191977 CEST	53	56946	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:55.206958055 CEST	53	65270	1.1.1.1	192.168.2.6
Oct 2, 2024 17:11:55.909778118 CEST	53	64651	1.1.1.1	192.168.2.6
Oct 2, 2024 17:12:23.135761976 CEST	53	61468	1.1.1.1	192.168.2.6

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 2, 2024 17:10:57.677546978 CEST	192.168.2.6	1.1.1.1	c243	(Port unreachable)	Destination Unreachable
Oct 2, 2024 17:10:59.457195997 CEST	192.168.2.6	1.1.1.1	c27a	(Port unreachable)	Destination Unreachable
Oct 2, 2024 17:11:02.417247057 CEST	192.168.2.6	1.1.1.1	c27a	(Port unreachable)	Destination Unreachable
Oct 2, 2024 17:11:34.028645992 CEST	192.168.2.6	1.1.1.1	c27d	(Port unreachable)	Destination Unreachable
Oct 2, 2024 17:11:43.178380013 CEST	192.168.2.6	1.1.1.1	c29d	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 17:10:59.436778069 CEST	1.1.1.1	192.168.2.6	0x68dd	No error (0)	use.typekit.net	use-stls.adobe.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:10:59.437244892 CEST	1.1.1.1	192.168.2.6	0x98a6	No error (0)	use.typekit.net	use-stls.adobe.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:10:59.438272953 CEST	1.1.1.1	192.168.2.6	0x1a9a	No error (0)	static.echocdn.com	static.echocdn.com.i.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:10:59.457103968 CEST	1.1.1.1	192.168.2.6	0xab20	No error (0)	static.echocdn.com	static.echocdn.com.i.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:10:59.459142923 CEST	1.1.1.1	192.168.2.6	0x3acc	No error (0)	secure.na4.echocdn.com	secure.na4dc2.echosign.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:10:59.459142923 CEST	1.1.1.1	192.168.2.6	0x3acc	No error (0)	secure.na4dc2.echosign.com		52.35.253.84	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:10:59.459142923 CEST	1.1.1.1	192.168.2.6	0x3acc	No error (0)	secure.na4dc2.echosign.com		52.35.253.85	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:10:59.459142923 CEST	1.1.1.1	192.168.2.6	0x3acc	No error (0)	secure.na4dc2.echosign.com		52.35.253.89	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:10:59.461730957 CEST	1.1.1.1	192.168.2.6	0x920f	No error (0)	secure.na4.echocdn.com	secure.na4dc2.echosign.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:00.028115988 CEST	1.1.1.1	192.168.2.6	0x37aa	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:00.029031992 CEST	1.1.1.1	192.168.2.6	0x8419	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 2, 2024 17:11:02.357724905 CEST	1.1.1.1	192.168.2.6	0x22d2	No error (0)	use.typekit.net	use-stls.adobe.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:02.358874083 CEST	1.1.1.1	192.168.2.6	0xfc15	No error (0)	use.typekit.net	use-stls.adobe.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:02.380181074 CEST	1.1.1.1	192.168.2.6	0x2989	No error (0)	secure.na4.echocdn.com	secure.na4dc2.echosign.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:02.380291939 CEST	1.1.1.1	192.168.2.6	0xfeae	No error (0)	secure.na4.echocdn.com	secure.na4dc2.echosign.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:02.380291939 CEST	1.1.1.1	192.168.2.6	0xfeae	No error (0)	secure.na4dc2.echosign.com		52.35.253.84	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:02.380291939 CEST	1.1.1.1	192.168.2.6	0xfeae	No error (0)	secure.na4dc2.echosign.com		52.35.253.85	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:02.380291939 CEST	1.1.1.1	192.168.2.6	0xfeae	No error (0)	secure.na4dc2.echosign.com		52.35.253.89	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:02.399174929 CEST	1.1.1.1	192.168.2.6	0xe7ae	No error (0)	static.echocdn.com	static.echocdn.com.i.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:02.417166948 CEST	1.1.1.1	192.168.2.6	0x5f3c	No error (0)	static.echocdn.com	static.echocdn.com.i.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:07.884145975 CEST	1.1.1.1	192.168.2.6	0xcf2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:07.884145975 CEST	1.1.1.1	192.168.2.6	0xcf2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:27.832102060 CEST	1.1.1.1	192.168.2.6	0xc2c1	No error (0)	p.typekit.net	p.typekit.net-stls-v3.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:27.832199097 CEST	1.1.1.1	192.168.2.6	0xd51e	No error (0)	p.typekit.net	p.typekit.net-stls-v3.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:29.447312117 CEST	1.1.1.1	192.168.2.6	0xea99	No error (0)	windowsupdatebg.s.llnwi.net		87.248.204.0	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:30.953407049 CEST	1.1.1.1	192.168.2.6	0xebaf	No error (0)	p.typekit.net	p.typekit.net-stls-v3.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:30.954365969 CEST	1.1.1.1	192.168.2.6	0x8687	No error (0)	p.typekit.net	p.typekit.net-stls-v3.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:32.885139942 CEST	1.1.1.1	192.168.2.6	0x1718	No error (0)	secure.na4.adobesign.com		52.35.253.84	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:32.885139942 CEST	1.1.1.1	192.168.2.6	0x1718	No error (0)	secure.na4.adobesign.com		52.35.253.85	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:32.885139942 CEST	1.1.1.1	192.168.2.6	0x1718	No error (0)	secure.na4.adobesign.com		52.35.253.89	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:33.779314041 CEST	1.1.1.1	192.168.2.6	0xa9db	No error (0)	ims-na1.adobelogin.com	adobelogin-weighted.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:33.779314041 CEST	1.1.1.1	192.168.2.6	0xa9db	No error (0)	adobelogin-weighted.prod.ims.adobejanus.com	ims-na1.adobelogin.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:34.028574944 CEST	1.1.1.1	192.168.2.6	0xd1f	No error (0)	ims-na1.adobelogin.com	adobelogin-weighted.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:34.028574944 CEST	1.1.1.1	192.168.2.6	0xd1f	No error (0)	adobelogin-weighted.prod.ims.adobejanus.com	ims-na1.adobelogin.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:34.405225039 CEST	1.1.1.1	192.168.2.6	0x3423	No error (0)	auth.prod.ims.adobejanus.com	auth-weighted.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:34.405225039 CEST	1.1.1.1	192.168.2.6	0x3423	No error (0)	auth-weighted.prod.ims.adobejanus.com	auth.services.adobe.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:34.476876020 CEST	1.1.1.1	192.168.2.6	0x94a7	No error (0)	auth.prod.ims.adobejanus.com	auth-weighted.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:34.476876020 CEST	1.1.1.1	192.168.2.6	0x94a7	No error (0)	auth-weighted.prod.ims.adobejanus.com	auth.services.adobe.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:35.915699005 CEST	1.1.1.1	192.168.2.6	0x39d	No error (0)	auth.prod.ims.adobejanus.com	auth-weighted.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:35.915699005 CEST	1.1.1.1	192.168.2.6	0x39d	No error (0)	auth-weighted.prod.ims.adobejanus.com	auth.services.adobe.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:35.918080091 CEST	1.1.1.1	192.168.2.6	0x582f	No error (0)	auth.prod.ims.adobejanus.com	auth-weighted.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:35.918080091 CEST	1.1.1.1	192.168.2.6	0x582f	No error (0)	auth-weighted.prod.ims.adobejanus.com	auth.services.adobe.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		99.81.250.169	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		99.80.175.1	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		18.202.150.204	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.214.203.240	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.31.64.150	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.19.26.215	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		18.202.39.134	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630340099 CEST	1.1.1.1	192.168.2.6	0x8109	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.72.136.225	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630738974 CEST	1.1.1.1	192.168.2.6	0xeada	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630738974 CEST	1.1.1.1	192.168.2.6	0xeada	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:40.630738974 CEST	1.1.1.1	192.168.2.6	0xeada	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.006700993 CEST	1.1.1.1	192.168.2.6	0x2d00	No error (0)	adobe.com.ssl.d1.sc.omtrdc.net		63.140.62.17	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.006700993 CEST	1.1.1.1	192.168.2.6	0x2d00	No error (0)	adobe.com.ssl.d1.sc.omtrdc.net		63.140.62.27	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.006700993 CEST	1.1.1.1	192.168.2.6	0x2d00	No error (0)	adobe.com.ssl.d1.sc.omtrdc.net		63.140.62.222	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.110835075 CEST	1.1.1.1	192.168.2.6	0x86a2	No error (0)	static.adobelogin.com	adobelogin-static.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.110835075 CEST	1.1.1.1	192.168.2.6	0x86a2	No error (0)	adobelogin-static.prod.ims.adobejanus.com	dd20fzx9mj46f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.110835075 CEST	1.1.1.1	192.168.2.6	0x86a2	No error (0)	dd20fzx9mj46f.cloudfront.net		13.224.189.8	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.110835075 CEST	1.1.1.1	192.168.2.6	0x86a2	No error (0)	dd20fzx9mj46f.cloudfront.net		13.224.189.18	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.110835075 CEST	1.1.1.1	192.168.2.6	0x86a2	No error (0)	dd20fzx9mj46f.cloudfront.net		13.224.189.78	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.110835075 CEST	1.1.1.1	192.168.2.6	0x86a2	No error (0)	dd20fzx9mj46f.cloudfront.net		13.224.189.15	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.178318977 CEST	1.1.1.1	192.168.2.6	0xe397	No error (0)	static.adobelogin.com	adobelogin-static.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.178318977 CEST	1.1.1.1	192.168.2.6	0xe397	No error (0)	adobelogin-static.prod.ims.adobejanus.com	dd20fzx9mj46f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		18.202.109.49	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.31.64.150	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.72.106.111	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		18.202.150.204	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		46.137.24.228	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		99.80.175.1	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.31.82.54	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376422882 CEST	1.1.1.1	192.168.2.6	0x6a8f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.31.23.243	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376526117 CEST	1.1.1.1	192.168.2.6	0x2eb9	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376526117 CEST	1.1.1.1	192.168.2.6	0x2eb9	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.376526117 CEST	1.1.1.1	192.168.2.6	0x2eb9	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:43.868124962 CEST	1.1.1.1	192.168.2.6	0xa82b	No error (0)	adobe.com.ssl.d1.sc.omtrdc.net		63.140.62.27	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.868124962 CEST	1.1.1.1	192.168.2.6	0xa82b	No error (0)	adobe.com.ssl.d1.sc.omtrdc.net		63.140.62.17	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:43.868124962 CEST	1.1.1.1	192.168.2.6	0xa82b	No error (0)	adobe.com.ssl.d1.sc.omtrdc.net		63.140.62.222	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:44.080924034 CEST	1.1.1.1	192.168.2.6	0xba52	No error (0)	static.adobelogin.com	adobelogin-static.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:44.080924034 CEST	1.1.1.1	192.168.2.6	0xba52	No error (0)	adobelogin-static.prod.ims.adobejanus.com	dd20fzx9mj46f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:44.080924034 CEST	1.1.1.1	192.168.2.6	0xba52	No error (0)	dd20fzx9mj46f.cloudfront.net		13.224.189.78	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:44.080924034 CEST	1.1.1.1	192.168.2.6	0xba52	No error (0)	dd20fzx9mj46f.cloudfront.net		13.224.189.18	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:44.080924034 CEST	1.1.1.1	192.168.2.6	0xba52	No error (0)	dd20fzx9mj46f.cloudfront.net		13.224.189.15	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:44.080924034 CEST	1.1.1.1	192.168.2.6	0xba52	No error (0)	dd20fzx9mj46f.cloudfront.net		13.224.189.8	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:11:44.098191977 CEST	1.1.1.1	192.168.2.6	0x159	No error (0)	static.adobelogin.com	adobelogin-static.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:11:44.098191977 CEST	1.1.1.1	192.168.2.6	0x159	No error (0)	adobelogin-static.prod.ims.adobejanus.com	dd20fzx9mj46f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 17:12:08.247924089 CEST	1.1.1.1	192.168.2.6	0x628a	No error (0)	windowsupdatebg.s.llnwi.net		87.248.204.0	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:10:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 30 36 4e 62 6c 4a 4d 71 64 45 36 39 4c 6c 59 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 37 64 39 36 35 37 62 36 63 65 31 65 34 39 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 06NblJMqdE69LlYb.1Context: 77d9657b6ce1e495
2024-10-02 15:10:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-02 15:10:53 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 30 36 4e 62 6c 4a 4d 71 64 45 36 39 4c 6c 59 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 37 64 39 36 35 37 62 36 63 65 31 65 34 39 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 41 53 65 66 6f 69 66 59 57 62 71 56 6d 78 74 71 59 63 32 42 54 5a 33 64 52 46 64 5a 74 2b 74 4e 63 74 66 55 4d 54 37 4b 75 49 76 2b 43 50 72 51 63 70 56 64 41 32 7a 6f 4f 51 4a 36 2b 67 49 76 58 30 47 47 43 52 61 5a 75 66 57 55 2f 77 49 33 51 2b 54 55 35 4f 68 33 39 68 39 61 70 4d 42 42 77 39 77 74 56 78 32 79 53 31 73 4a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 06NblJMqdE69LlYb.2Context: 77d9657b6ce1e495<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdASefoifYWbqVmxtqYc2BTZ3dRFdZt+tNctfUMT7KuIv+CPrQcpVdA2zoOQJ6+gIvX0GGCRaZufWU/wI3Q+TU5Oh39h9apMBBw9wtVx2yS1sJ
2024-10-02 15:10:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 30 36 4e 62 6c 4a 4d 71 64 45 36 39 4c 6c 59 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 37 64 39 36 35 37 62 36 63 65 31 65 34 39 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 06NblJMqdE69LlYb.3Context: 77d9657b6ce1e495<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-02 15:10:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-02 15:10:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 70 6b 4e 66 59 45 41 59 6b 4b 39 5a 6b 2b 49 33 70 61 39 61 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ppkNfYEAYkK9Zk+I3pa9aw.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:04 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 30 42 6f 30 39 4f 2b 31 4d 30 32 50 42 30 6e 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 36 30 34 61 66 35 38 64 61 64 66 33 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: 0Bo09O+1M02PB0nT.1Context: 31604af58dadf37
2024-10-02 15:11:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-02 15:11:04 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 30 42 6f 30 39 4f 2b 31 4d 30 32 50 42 30 6e 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 36 30 34 61 66 35 38 64 61 64 66 33 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 41 53 65 66 6f 69 66 59 57 62 71 56 6d 78 74 71 59 63 32 42 54 5a 33 64 52 46 64 5a 74 2b 74 4e 63 74 66 55 4d 54 37 4b 75 49 76 2b 43 50 72 51 63 70 56 64 41 32 7a 6f 4f 51 4a 36 2b 67 49 76 58 30 47 47 43 52 61 5a 75 66 57 55 2f 77 49 33 51 2b 54 55 35 4f 68 33 39 68 39 61 70 4d 42 42 77 39 77 74 56 78 32 79 53 31 73 4a 41 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: 0Bo09O+1M02PB0nT.2Context: 31604af58dadf37<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdASefoifYWbqVmxtqYc2BTZ3dRFdZt+tNctfUMT7KuIv+CPrQcpVdA2zoOQJ6+gIvX0GGCRaZufWU/wI3Q+TU5Oh39h9apMBBw9wtVx2yS1sJA
2024-10-02 15:11:04 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 30 42 6f 30 39 4f 2b 31 4d 30 32 50 42 30 6e 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 31 36 30 34 61 66 35 38 64 61 64 66 33 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: 0Bo09O+1M02PB0nT.3Context: 31604af58dadf37<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-02 15:11:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-02 15:11:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 35 72 34 4f 59 50 73 6e 4f 45 79 58 6b 48 51 39 4c 6e 31 5a 6f 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 5r4OYPsnOEyXkHQ9Ln1Zog.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:23 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2f 75 75 71 61 76 73 58 6d 45 71 35 6a 75 36 51 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 35 33 31 62 36 62 32 65 31 64 62 36 39 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: /uuqavsXmEq5ju6Q.1Context: e0531b6b2e1db692
2024-10-02 15:11:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-02 15:11:23 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2f 75 75 71 61 76 73 58 6d 45 71 35 6a 75 36 51 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 35 33 31 62 36 62 32 65 31 64 62 36 39 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 41 53 65 66 6f 69 66 59 57 62 71 56 6d 78 74 71 59 63 32 42 54 5a 33 64 52 46 64 5a 74 2b 74 4e 63 74 66 55 4d 54 37 4b 75 49 76 2b 43 50 72 51 63 70 56 64 41 32 7a 6f 4f 51 4a 36 2b 67 49 76 58 30 47 47 43 52 61 5a 75 66 57 55 2f 77 49 33 51 2b 54 55 35 4f 68 33 39 68 39 61 70 4d 42 42 77 39 77 74 56 78 32 79 53 31 73 4a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: /uuqavsXmEq5ju6Q.2Context: e0531b6b2e1db692<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdASefoifYWbqVmxtqYc2BTZ3dRFdZt+tNctfUMT7KuIv+CPrQcpVdA2zoOQJ6+gIvX0GGCRaZufWU/wI3Q+TU5Oh39h9apMBBw9wtVx2yS1sJ
2024-10-02 15:11:23 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2f 75 75 71 61 76 73 58 6d 45 71 35 6a 75 36 51 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 35 33 31 62 36 62 32 65 31 64 62 36 39 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: /uuqavsXmEq5ju6Q.3Context: e0531b6b2e1db692<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-02 15:11:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-02 15:11:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 42 71 34 68 55 4a 6b 69 30 4f 53 79 58 43 39 4c 49 32 4c 4c 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: JBq4hUJki0OSyXC9LI2LLA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:41 UTC	2301	OUT	GET /id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9E1005A551ED61CA0A490D45%40AdobeOrg&d_nsid=0&ts=1727881899327 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://auth.services.adobe.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerO [TRUNCATED] Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 15:11:41 UTC	958	IN	HTTP/1.1 302 Found Date: Wed, 02 Oct 2024 15:11:41 GMT Content-Length: 0 Connection: close X-TID: w8vaCOzyQyM= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://auth.services.adobe.com Vary: Origin Access-Control-Allow-Credentials: true Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9E1005A551ED61CA0A490D45%40AdobeOrg&d_nsid=0&ts=1727881899327 DCS: dcs-prod-irl1-2-v065-029541a7d.edge-irl1.demdex.com 0 ms set-cookie: demdex=00284102289035300662441585223568858635; Max-Age=15552000; Expires=Mon, 31 Mar 2025 15:11:41 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:42 UTC	2359	OUT	GET /id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9E1005A551ED61CA0A490D45%40AdobeOrg&d_nsid=0&ts=1727881899327 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://auth.services.adobe.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerO [TRUNCATED] Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=00284102289035300662441585223568858635
2024-10-02 15:11:42 UTC	829	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:11:42 GMT Content-Type: application/json;charset=utf-8 Content-Length: 4430 Connection: close X-TID: VCrnjpxgSCc= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://auth.services.adobe.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-irl1-2-v065-0823c8262.edge-irl1.demdex.com 3 ms set-cookie: demdex=00284102289035300662441585223568858635; Max-Age=15552000; Expires=Mon, 31 Mar 2025 15:11:42 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-10-02 15:11:42 UTC	4430	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 30 30 31 32 33 39 33 36 32 31 30 32 30 37 35 32 36 30 34 32 34 32 35 39 33 38 30 35 31 35 32 31 37 33 35 33 30 31 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 52 4b 68 70 52 7a 38 6b 72 67 32 74 4c 4f 36 70 67 75 58 57 70 35 6f 6c 6b 41 63 55 6e 69 51 59 50 48 61 4d 57 57 67 64 4a 33 78 7a 50 57 51 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 36 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 36 30 22 2c 22 74 74 6c 22 3a 31 34 34 30 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 30 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 30 2c 22 75 72 6c 22 3a 5b 22 2f 2f 69 64 73 79 6e 63 2e 72 Data Ascii: {"d_mid":"00123936210207526042425938051521735301","id_sync_ttl":604800,"d_blob":"RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y","dcs_region":6,"d_ottl":7200,"ibs":[{"id":"60","ttl":14400,"tag":"img","fireURLSync":0,"syncOnPage":0,"url":["//idsync.r

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:43 UTC	2643	OUT	GET /id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=9E1005A551ED61CA0A490D45%40AdobeOrg&mid=00123936210207526042425938051521735301&ts=1727881901909 HTTP/1.1 Host: sstats.adobe.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://auth.services.adobe.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerO [TRUNCATED] Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889101s%7CNONE%7CvVersion%7C5.4.0
2024-10-02 15:11:43 UTC	722	IN	HTTP/1.1 200 OK access-control-allow-origin: https://auth.services.adobe.com access-control-allow-credentials: true date: Wed, 02 Oct 2024 15:11:43 GMT p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C00123936210207526042425938051521735301; Path=/; Domain=adobe.com; Max-Age=63072000; Expires=Fri, 02 Oct 2026 15:11:11 GMT; SameSite=Lax; vary: Origin content-type: application/x-javascript;charset=utf-8 content-length: 48 cross-origin-resource-policy: cross-origin strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-10-02 15:11:43 UTC	48	IN	Data Raw: 7b 22 6d 69 64 22 3a 22 30 30 31 32 33 39 33 36 32 31 30 32 30 37 35 32 36 30 34 32 34 32 35 39 33 38 30 35 31 35 32 31 37 33 35 33 30 31 22 7d Data Ascii: {"mid":"00123936210207526042425938051521735301"}

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:43 UTC	2208	OUT	GET /clients/adobe-sign-2020/4x_f39219ea552b8fc1c7b42c6a2d0290c2.png HTTP/1.1 Host: static.adobelogin.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerO [TRUNCATED] Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 15:11:44 UTC	511	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3649 Connection: close Date: Wed, 02 Oct 2024 00:41:34 GMT Last-Modified: Thu, 10 Jun 2021 12:30:28 GMT ETag: "8a942a0106de80793a0113df635f6a0e" x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 1ac3fd533bf6be1b511077f8b8e23bfc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA2-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: oBzWY8T0yLN8_tsxz8TD0F6CJoAeEtXmRa-k1zgnJhaDQD7gi00Pfg== Age: 52210
2024-10-02 15:11:44 UTC	3649	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b0 00 00 00 a8 08 06 00 00 00 40 32 64 a8 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 0d f3 49 44 41 54 78 9c ed 9d 5f 88 54 d7 1d c7 cf ae c6 50 37 b2 1b fc 47 02 e2 aa c5 10 31 28 1d 43 93 17 d7 62 5e 94 8c b1 d4 87 4c 1e dc 85 34 21 3e 24 6c 48 1e 6a 13 44 25 a9 79 a8 74 db 3e a4 60 03 6e 1f 32 7d b0 b8 3a a0 2f 96 ba 79 49 4b 77 40 31 58 0c 51 47 2c 06 77 0d b8 58 95 24 2d 5b be 77 cf 1d ae e3 3d f7 9e 73 ee 99 99 73 67 bf 1f 58 5c 64 66 f6 ee de ef fc e6 7b 7e bf df f9 9d ae 99 99 19 d1 2c 4a c5 ea 16 21 04 be 36 0a 21 fa 84 10 03 4d fb 61 c4 27 c6 85 10 b7 85 10 e7 84 10 67 cb 95 c2 d9 66 5d 9b 73 01 97 8a d5 21 21 c4 4e 29 dc 5e a7 2f 4e f2 ca 34 84 2c 84 18 2b 57 0a Data Ascii: PNGIHDR@2dpHYs~IDATx_TP7G1(Cb^L4!>$lHjD%yt>`n2}:/yIKw@1XQG,wX$-[w=ssgX\df{~,J!6!Ma'gf]s!!N)^/N4,+W

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAXOLPIJBfBmvGxlXwPlfq9c6X3NsD1pg6O8JYZY2E-Ga3AuSQNGZ-g8N0TvBmaUFABJvylLGhsJ9uMpqr2DHsr9g8lX7QuPwmuLcGhhclzXMQHuhGjFAB_Dnt33FKgDL2&

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Windows Analysis Report
https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAXOLPIJBfBmvGxlXwPlfq9c6X3NsD1pg6O8JYZY2E-Ga3AuSQNGZ-g8N0TvBmaUFABJvylLGhsJ9uMpqr2DHsr9g8lX7QuPwmuLcGhhclzXMQHuhGjFAB_Dnt33FKgDL2&

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:44 UTC	2680	OUT	POST /b/ss/adbims,adbadobenonacdcprod,adbadobeprototype/1/JS-2.22.4-LCS4/s9125782429231 HTTP/1.1 Host: sstats.adobe.com Connection: keep-alive Content-Length: 6554 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://auth.services.adobe.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerO [TRUNCATED] Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; s_ecid=MCMID%7C00123936210207526042425938051521735301; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889101s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; s_cc=true
2024-10-02 15:11:44 UTC	6554	OUT	Data Raw: 41 51 42 3d 31 26 6e 64 68 3d 31 26 70 66 3d 31 26 74 3d 32 25 32 46 39 25 32 46 32 30 32 34 25 32 30 31 31 25 33 41 31 31 25 33 41 34 32 25 32 30 33 25 32 30 32 34 30 26 6d 69 64 3d 30 30 31 32 33 39 33 36 32 31 30 32 30 37 35 32 36 30 34 32 34 32 35 39 33 38 30 35 31 35 32 31 37 33 35 33 30 31 26 61 61 6d 6c 68 3d 36 26 63 65 3d 55 54 46 2d 38 26 63 64 70 3d 32 26 66 70 43 6f 6f 6b 69 65 44 6f 6d 61 69 6e 50 65 72 69 6f 64 73 3d 32 26 67 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 75 74 68 2e 73 65 72 76 69 63 65 73 2e 61 64 6f 62 65 2e 63 6f 6d 25 32 46 65 6e 5f 55 53 25 32 46 64 65 65 70 6c 69 6e 6b 2e 68 74 6d 6c 25 33 46 64 65 65 70 6c 69 6e 6b 25 33 44 73 73 6f 66 69 72 73 74 25 32 36 63 61 6c 6c 62 61 63 6b 25 33 44 68 74 74 70 73 25 32 35 33 Data Ascii: AQB=1&ndh=1&pf=1&t=2%2F9%2F2024%2011%3A11%3A42%203%20240&mid=00123936210207526042425938051521735301&aamlh=6&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&g=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdeeplink%3Dssofirst%26callback%3Dhttps%253
2024-10-02 15:11:44 UTC	1141	IN	HTTP/1.1 200 OK access-control-allow-origin: https://auth.services.adobe.com access-control-allow-credentials: true date: Wed, 02 Oct 2024 15:11:44 GMT expires: Tue, 01 Oct 2024 15:11:44 GMT last-modified: Thu, 03 Oct 2024 15:11:44 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C00123936210207526042425938051521735301; Path=/; Domain=adobe.com; Max-Age=63072000; Expires=Fri, 02 Oct 2026 15:11:11 GMT; set-cookie: s_ecid=MCMID%7C00123936210207526042425938051521735301; Path=/; Domain=adobe.com; Max-Age=63072000; Expires=Fri, 02 Oct 2026 15:11:11 GMT; set-cookie: s_ecid=MCMID%7C00123936210207526042425938051521735301; Path=/; Domain=adobe.com; Max-Age=63072000; Expires=Fri, 02 Oct 2026 15:11:11 GMT; etag: 3710598134686810112-4618576090386256240 vary: * content-type: image/gif;charset=utf-8 content-length: 43 cross-origin-resource-policy: cross-origin strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-10-02 15:11:44 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:44 UTC	408	OUT	GET /clients/adobe-sign-2020/4x_f39219ea552b8fc1c7b42c6a2d0290c2.png HTTP/1.1 Host: static.adobelogin.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 15:11:45 UTC	511	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3649 Connection: close Date: Wed, 02 Oct 2024 00:41:34 GMT Last-Modified: Thu, 10 Jun 2021 12:30:28 GMT ETag: "8a942a0106de80793a0113df635f6a0e" x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 34f50889bc574f1edeb41dd758962a5a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA2-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: bfpK8qWD6PXL5CzejDudb6JD3AxTEAsAjHTewcPeJ5HrBITjX5wX3g== Age: 52212
2024-10-02 15:11:45 UTC	3198	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b0 00 00 00 a8 08 06 00 00 00 40 32 64 a8 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 0d f3 49 44 41 54 78 9c ed 9d 5f 88 54 d7 1d c7 cf ae c6 50 37 b2 1b fc 47 02 e2 aa c5 10 31 28 1d 43 93 17 d7 62 5e 94 8c b1 d4 87 4c 1e dc 85 34 21 3e 24 6c 48 1e 6a 13 44 25 a9 79 a8 74 db 3e a4 60 03 6e 1f 32 7d b0 b8 3a a0 2f 96 ba 79 49 4b 77 40 31 58 0c 51 47 2c 06 77 0d b8 58 95 24 2d 5b be 77 cf 1d ae e3 3d f7 9e 73 ee 99 99 73 67 bf 1f 58 5c 64 66 f6 ee de ef fc e6 7b 7e bf df f9 9d ae 99 99 19 d1 2c 4a c5 ea 16 21 04 be 36 0a 21 fa 84 10 03 4d fb 61 c4 27 c6 85 10 b7 85 10 e7 84 10 67 cb 95 c2 d9 66 5d 9b 73 01 97 8a d5 21 21 c4 4e 29 dc 5e a7 2f 4e f2 ca 34 84 2c 84 18 2b 57 0a Data Ascii: PNGIHDR@2dpHYs~IDATx_TP7G1(Cb^L4!>$lHjD%yt>`n2}:/yIKw@1XQG,wX$-[w=ssgX\df{~,J!6!Ma'gf]s!!N)^/N4,+W
2024-10-02 15:11:45 UTC	451	IN	Data Raw: e4 1a 0a 98 e4 1a 08 78 9c b7 90 e4 94 71 08 98 3d 85 24 af dc 86 80 cf f1 f6 91 9c 72 0e 02 3e cb bb 47 72 ca d9 ae 99 99 19 51 2a 56 61 23 7a 79 17 49 8e 98 2e 57 0a 7d 61 16 82 51 98 e4 8d 40 b3 a1 80 c7 78 fb 48 ce 08 34 1b 58 08 40 1b 41 72 44 60 1f 44 43 21 e3 28 ef 20 c9 09 75 ad 46 05 3c c2 bb 47 72 42 5d ab 75 01 97 2b 05 cc 15 1d e5 1d 24 9e 33 2a b5 1a d0 d8 0b 31 0c 7f c1 3b 48 3c 65 5a 6a b4 ce 03 02 2e 57 0a 58 c8 ed e7 dd 23 9e b2 5f 6a b4 4e 3d 0b 11 a5 54 ac a2 bc bc 81 77 91 78 c4 f9 72 a5 b0 b1 f1 72 54 ed 94 3b 69 25 88 47 4c 4b 4d 3e 44 ac 80 a5 49 1e e2 1d 24 9e 30 14 5d b8 45 51 36 b4 97 2b 05 54 3a 0e f0 0e 92 36 73 40 6a 31 96 58 0f 1c a5 54 ac 22 69 3c c8 bb 48 da 00 52 66 89 4e 20 75 4b 91 7c 01 e6 87 49 ab 49 15 af d0 dd 13 27 Data Ascii: xq=$r>GrQVa#zyI.W}aQ@xH4X@ArD`DC!( uF<GrB]u+$31;H<eZj.WX#_jN=TwxrrT;i%GLKM>DI$0]EQ6+T:6s@j1XT"i<HRfN uK\|II'

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:45 UTC	2681	OUT	POST /b/ss/adbims,adbadobenonacdcprod,adbadobeprototype/1/JS-2.22.4-LCS4/s94143179143099 HTTP/1.1 Host: sstats.adobe.com Connection: keep-alive Content-Length: 6771 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://auth.services.adobe.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FEchoSign2%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fgps.echosign.com%252Fpublic%252FadobeIDLogin%253Fserver%253Dna4.documents.adobe.com%2526isAdobeSignAuth%253Dfalse%2526port%253D443%26state%3D5e3fa6080f778198bce2065c11f736284fb842515c3cd03fca993e4cece5efa8%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=EchoSign2&scope=openid%2CAdobeID%2CDCAPI%2Cadditional_info.account_type%2Cskybox%2Cupdate_profile.first_name%2Cupdate_profile.last_name%2Cagreement_send%2Cagreement_sign%2Csign_library_write%2Csign_user_read%2Csign_user_write%2Cagreement_read%2Cagreement_write%2Cwidget_read%2Cwidget_write%2Cworkflow_read%2Cworkflow_write%2Csign_addressbook_read%2Csign_library_read%2Cadditional_info.projectedProductContext%2Csign_webhook_read%2Csign_webhook_write%2Csign_webhook_retention%2Csao.ACOM_ESIGN_TRIAL%2Cee.GROUP_SIGN_WEB%2Cadditional_info.ownerO [TRUNCATED] Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; s_ecid=MCMID%7C00123936210207526042425938051521735301; s_cc=true; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889102s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0
2024-10-02 15:11:45 UTC	6771	OUT	Data Raw: 41 51 42 3d 31 26 6e 64 68 3d 31 26 70 66 3d 31 26 74 3d 32 25 32 46 39 25 32 46 32 30 32 34 25 32 30 31 31 25 33 41 31 31 25 33 41 34 32 25 32 30 33 25 32 30 32 34 30 26 6d 69 64 3d 30 30 31 32 33 39 33 36 32 31 30 32 30 37 35 32 36 30 34 32 34 32 35 39 33 38 30 35 31 35 32 31 37 33 35 33 30 31 26 61 61 6d 6c 68 3d 36 26 63 65 3d 55 54 46 2d 38 26 63 64 70 3d 32 26 66 70 43 6f 6f 6b 69 65 44 6f 6d 61 69 6e 50 65 72 69 6f 64 73 3d 32 26 67 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 75 74 68 2e 73 65 72 76 69 63 65 73 2e 61 64 6f 62 65 2e 63 6f 6d 25 32 46 65 6e 5f 55 53 25 32 46 64 65 65 70 6c 69 6e 6b 2e 68 74 6d 6c 25 33 46 64 65 65 70 6c 69 6e 6b 25 33 44 73 73 6f 66 69 72 73 74 25 32 36 63 61 6c 6c 62 61 63 6b 25 33 44 68 74 74 70 73 25 32 35 33 Data Ascii: AQB=1&ndh=1&pf=1&t=2%2F9%2F2024%2011%3A11%3A42%203%20240&mid=00123936210207526042425938051521735301&aamlh=6&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&g=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdeeplink%3Dssofirst%26callback%3Dhttps%253
2024-10-02 15:11:45 UTC	1141	IN	HTTP/1.1 200 OK access-control-allow-origin: https://auth.services.adobe.com access-control-allow-credentials: true date: Wed, 02 Oct 2024 15:11:45 GMT expires: Tue, 01 Oct 2024 15:11:45 GMT last-modified: Thu, 03 Oct 2024 15:11:45 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C00123936210207526042425938051521735301; Path=/; Domain=adobe.com; Max-Age=63072000; Expires=Fri, 02 Oct 2026 15:11:11 GMT; set-cookie: s_ecid=MCMID%7C00123936210207526042425938051521735301; Path=/; Domain=adobe.com; Max-Age=63072000; Expires=Fri, 02 Oct 2026 15:11:11 GMT; set-cookie: s_ecid=MCMID%7C00123936210207526042425938051521735301; Path=/; Domain=adobe.com; Max-Age=63072000; Expires=Fri, 02 Oct 2026 15:11:11 GMT; etag: 3710598137542180864-4618544231388374643 vary: * content-type: image/gif;charset=utf-8 content-length: 43 cross-origin-resource-policy: cross-origin strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-10-02 15:11:45 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:45 UTC	841	OUT	GET /b/ss/adbims,adbadobenonacdcprod,adbadobeprototype/1/JS-2.22.4-LCS4/s9125782429231 HTTP/1.1 Host: sstats.adobe.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; s_ecid=MCMID%7C00123936210207526042425938051521735301; s_cc=true; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889102s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0
2024-10-02 15:11:45 UTC	912	IN	HTTP/1.1 302 Found access-control-allow-origin: * vary: Origin date: Wed, 02 Oct 2024 15:11:45 GMT content-type: text/plain;charset=utf-8 expires: Tue, 01 Oct 2024 15:11:45 GMT last-modified: Thu, 03 Oct 2024 15:11:45 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag set-cookie: s_vi=[CS]v1\|337EB158DF781E12-600014BE22F88CB1[CE]; Path=/; Domain=adobe.com; Max-Age=63072000; Expires=Fri, 02 Oct 2026 15:11:11 GMT; location: https://sstats.adobe.com/b/ss/adbims,adbadobenonacdcprod,adbadobeprototype/1/JS-2.22.4-LCS4/s9125782429231?AQB=1&pccr=true&vidn=337EB158DF781E12-600014BE22F88CB1&g=none&AQE=1 content-length: 0 cross-origin-resource-policy: cross-origin strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:47 UTC	960	OUT	GET /b/ss/adbims,adbadobenonacdcprod,adbadobeprototype/1/JS-2.22.4-LCS4/s9125782429231?AQB=1&pccr=true&vidn=337EB158DF781E12-600014BE22F88CB1&g=none&AQE=1 HTTP/1.1 Host: sstats.adobe.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: gpv=Account:IMS:GetStarted:OnLoad; AMCVS_9E1005A551ED61CA0A490D45%40AdobeOrg=1; s_ecid=MCMID%7C00123936210207526042425938051521735301; s_cc=true; AMCV_9E1005A551ED61CA0A490D45%40AdobeOrg=1176715910%7CMCMID%7C00123936210207526042425938051521735301%7CMCAAMLH-1728486701%7C6%7CMCAAMB-1728486701%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1727889102s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; s_vi=[CS]v1\|337EB158DF781E12-600014BE22F88CB1[CE]
2024-10-02 15:11:47 UTC	765	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Wed, 02 Oct 2024 15:11:47 GMT expires: Tue, 01 Oct 2024 15:11:47 GMT last-modified: Thu, 03 Oct 2024 15:11:47 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag set-cookie: s_vi=[CS]v1\|337EB158DF781E12-600014BE22F88CB1[CE]; Path=/; Domain=adobe.com; Max-Age=63072000; Expires=Fri, 02 Oct 2026 15:11:11 GMT; etag: 3710598141579591680-4618617258734310520 vary: * content-type: image/gif;charset=utf-8 content-length: 43 cross-origin-resource-policy: cross-origin strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-10-02 15:11:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:11:50 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 79 78 7a 6f 6b 64 65 36 30 61 42 4a 6f 64 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 36 39 34 36 33 38 65 62 63 61 31 66 63 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Gyxzokde60aBJodq.1Context: 6d694638ebca1fc3
2024-10-02 15:11:50 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-02 15:11:50 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 47 79 78 7a 6f 6b 64 65 36 30 61 42 4a 6f 64 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 36 39 34 36 33 38 65 62 63 61 31 66 63 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 41 53 65 66 6f 69 66 59 57 62 71 56 6d 78 74 71 59 63 32 42 54 5a 33 64 52 46 64 5a 74 2b 74 4e 63 74 66 55 4d 54 37 4b 75 49 76 2b 43 50 72 51 63 70 56 64 41 32 7a 6f 4f 51 4a 36 2b 67 49 76 58 30 47 47 43 52 61 5a 75 66 57 55 2f 77 49 33 51 2b 54 55 35 4f 68 33 39 68 39 61 70 4d 42 42 77 39 77 74 56 78 32 79 53 31 73 4a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Gyxzokde60aBJodq.2Context: 6d694638ebca1fc3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdASefoifYWbqVmxtqYc2BTZ3dRFdZt+tNctfUMT7KuIv+CPrQcpVdA2zoOQJ6+gIvX0GGCRaZufWU/wI3Q+TU5Oh39h9apMBBw9wtVx2yS1sJ
2024-10-02 15:11:50 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 47 79 78 7a 6f 6b 64 65 36 30 61 42 4a 6f 64 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 36 39 34 36 33 38 65 62 63 61 31 66 63 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Gyxzokde60aBJodq.3Context: 6d694638ebca1fc3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-02 15:11:50 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-02 15:11:50 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 70 70 6f 37 34 73 71 68 30 69 55 79 44 38 4d 39 36 6f 65 45 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Cppo74sqh0iUyD8M96oeEg.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:12:23 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 36 57 6f 53 4b 74 41 49 57 6b 65 7a 51 4e 4d 34 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 33 30 35 61 31 37 32 37 32 34 33 64 36 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: 6WoSKtAIWkezQNM4.1Context: c305a1727243d6a
2024-10-02 15:12:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-02 15:12:23 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 36 57 6f 53 4b 74 41 49 57 6b 65 7a 51 4e 4d 34 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 33 30 35 61 31 37 32 37 32 34 33 64 36 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 41 53 65 66 6f 69 66 59 57 62 71 56 6d 78 74 71 59 63 32 42 54 5a 33 64 52 46 64 5a 74 2b 74 4e 63 74 66 55 4d 54 37 4b 75 49 76 2b 43 50 72 51 63 70 56 64 41 32 7a 6f 4f 51 4a 36 2b 67 49 76 58 30 47 47 43 52 61 5a 75 66 57 55 2f 77 49 33 51 2b 54 55 35 4f 68 33 39 68 39 61 70 4d 42 42 77 39 77 74 56 78 32 79 53 31 73 4a 41 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: 6WoSKtAIWkezQNM4.2Context: c305a1727243d6a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdASefoifYWbqVmxtqYc2BTZ3dRFdZt+tNctfUMT7KuIv+CPrQcpVdA2zoOQJ6+gIvX0GGCRaZufWU/wI3Q+TU5Oh39h9apMBBw9wtVx2yS1sJA
2024-10-02 15:12:23 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 36 57 6f 53 4b 74 41 49 57 6b 65 7a 51 4e 4d 34 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 33 30 35 61 31 37 32 37 32 34 33 64 36 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: 6WoSKtAIWkezQNM4.3Context: c305a1727243d6a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-02 15:12:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-02 15:12:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 77 56 71 72 2f 69 4a 55 5a 45 36 31 51 33 70 66 75 37 6f 46 4a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: wVqr/iJUZE61Q3pfu7oFJQ.0Payload parsing failed.

Target ID:	0
Start time:	11:10:48
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	11:10:53
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1908,i,2733554176455454787,14053848275243881291,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	11:10:56
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAAXOLPIJBfBmvGxlXwPlfq9c6X3NsD1pg6O8JYZY2E-Ga3AuSQNGZ-g8N0TvBmaUFABJvylLGhsJ9uMpqr2DHsr9g8lX7QuPwmuLcGhhclzXMQHuhGjFAB_Dnt33FKgDL2&"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true