Edit tour

Windows Analysis Report
Vertexgroup#Signature.pdf

Overview

General Information

Sample name:	Vertexgroup#Signature.pdf
Analysis ID:	1499890
MD5:	1783219408e9aecb46085991db36d438
SHA1:	5bb12f3c99f4a4e929e123e5947bc21d0425980d
SHA256:	3437bd9fbe5dacfb17e33c8d9cf4e416d483583500e4fe0c565753adc9331248
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Phishing site or detected (based on various text indicators)

Detected clear text password fields (password is not hidden)

Detected hidden input values containing email addresses (often used in phishing pages)

Found iframes

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7256 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Vertexgroup#Signature.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7436 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7624 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1616,i,1713217016441259986,848854696645655636,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ceo.ca/api/banner_redirect?channel=g&url=https://watercolorjourney.net/afew/ribs.html&banner=824 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2244,i,805177385167841147,1461457387704447815,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11VQwcdQDkV4Ht24MUUNIkE_oWzh6NqDfIc5-ouG_AuVvziiFx_Gx1dTh955Vh9mM4K5iaxlPz2CmmuLvPGoYL-lfW5fbEmFGmRWH8cOP2J5UVOL52LSWmoJd310j6cVa-JTDbcLEsqPxVdFR1SPpTE3cbk0DxU-5_3BcQPrasTDI-3hJcz4ZSyylwlwhgXyMiYdEPvzwwZ3jAmh3pXPhtruxVopO7oZDT_KCsfyB2LztgATvic3IfYW9M4-sNipqFBWdRMnWnlH9vwfZU6KMC0VgUfTTW_zxL3rJ4T6wc3lkaiFnqvn3bnNG8OrCYbn7wz9SxtMRgRqBNcl3Mg99IyoAOQXm-29gvg-bO7Kzl6QKPE9x1jPGObDJLUugnDsRajJC3vyvqK3dDS_KER6lRHDuWL52NdeSg4HO0D8Lf5Ng&lang=en" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2028,i,835848995580459791,17264038142937124725,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5104 --field-trial-handle=2028,i,835848995580459791,17264038142937124725,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://watercolorjourney.net/afew/ribs.html

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 171.61

OCR Text: eSigntur X Intellectu- X Mnage C X Trust Cent X aocusign X Decline Tc X Get Suppr X + Report x Restore pages? docusign support Products Community Resources Get Support Chrome didn't shut down correctly. O Help ntke Google Chrome better by sending crash reports nd usage statitics to Google Sign a Document with Docusign Contents Collapse All Expand All Restore Decline To Sign an Envelope Docusign eSignature Signing Aug 2024 2 min read Tags Docusign eSonature Process Here are some examples of when you might decline to sign an envelope: System Requirements fbr Signing You received an envelope meant far another person. Accessibility at Dacusign You're signing an agreement, such os on apartment lease. Some of the terms you agreed to during your diScussion with the leasing agent are missing or incorrect. Verify Your Identity The envelope containing the on-boarding package for your new job is missing key > Add Information to Dacuments documents. When you decline to sign, it prevents you and all 00 envelope recipients from signing. Sign a Document With Supplements Before declining ta sign an envelope. ask the envelope'S sender a question by posting a comment to the envelope, as descrbed in the use Comments to Ask and Answer Ouestions Sign Through an SMS Text About Document topic_ You can also reply ta the email notification you received. Notification Note: A sender can void an envelope as described in Void an Envelo=. Sign as a Delegated Signer Sign a Document With Data Verification Fields To decline to sign: > Complete the Signing SssiOn 1. Open the email notification and select REVIEW DOCUMENT 2. In the upper right of the envelope, select OTHER ACTIONS and select Decline to Sign. v Additional Signing Actions v Other Signing Actions OTHER ACTIONS CONTINUE > Print ond Sign Documents Finish Later Prant & Sign Change Signing Responsibility Assign to Someone Else 11:26 ENG Type here to search SG 27/08/2024

Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: <input type="text"... for password input
Source: https://support.docusign.com/s/document-item?bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus&language=en_US&rsc_301	HTTP Parser: <input type="text"... for password input
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: <input type="text"... for password input
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: <input type="text"... for password input

Source: https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11VQwcdQDkV4Ht24MUUNIkE_oWzh6NqDfIc5-ouG_AuVvziiFx_Gx1dTh955Vh9mM4K5iaxlPz2CmmuLvPGoYL-lfW5fbEmFGmRWH8cOP2J5UVOL52LSWmoJd310j6cVa-JTDbcLEsqPxVdFR1SPpTE3cbk0DxU-5_3BcQPrasTDI-3hJcz4ZSyylwlwhgXyMiYdEPvzwwZ3jAmh3pXPhtruxVopO7oZDT_KCsfyB2LztgATvic3IfYW9M4-sNipqFBWdRMnWnlH9vwfZU6KMC0VgUfTTW_zxL3rJ4T6wc3lkaiFnqvn3bnNG8OrCYbn7wz9SxtMRgRqBNcl3Mg99IyoAOQXm-29gvg-bO7Kzl6QKPE9x1jPGObDJLUugnDsRajJC3vyvqK3dDS_KER6lRHDuWL52NdeSg4HO0D8Lf5Ng&lang=en

Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominGAPage
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominGAPage
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/thirdparty-plugins.html
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger.html
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger-renderer.html
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominGAPage
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/thirdparty-plugins.html
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger.html
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger-renderer.html
Source: https://www.docusign.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NXX2M47
Source: https://www.docusign.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NXX2M47
Source: https://www.docusign.com/	HTTP Parser: Iframe src: https://chat.docusign.net/drift/?ds_drt_dsa=c051c188-5752-4221-8d9f-f48ace7af386&ds_drt_hfc=1&ds_drt_country=us&ds_drt_noHook=1
Source: https://www.docusign.com/	HTTP Parser: Iframe src: https://s.company-target.com/s/sync?exc=lr
Source: https://www.docusign.com/	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/949750955?random=1724772387820&cv=11&fst=1724772387820&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be48q0v868768000z8856130670za201zb856130670&gcd=13v3v3v3v5l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.docusign.com%2F&label=x1yBCM2D1_sCEKuZ8MQD&hn=www.googleadservices.com&frm=0&tiba=Docusign%20%7C%20%231%20in%20Electronic%20Signature%20and%20Intelligent%20Agreement%20Management&did=dYWJhMj&gdid=dYWJhMj&npa=0&pscdl=noapi&auid=554614420.1724772307&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=ads_data_redaction%3Dfalse
Source: https://support.docusign.com/s/document-item?bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus&language=en_US&rsc_301	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominGAPage
Source: https://support.docusign.com/s/document-item?bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus&language=en_US&rsc_301	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominStickyHeader
Source: https://support.docusign.com/s/document-item?bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus&language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/thirdparty-plugins.html
Source: https://support.docusign.com/s/document-item?bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus&language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger.html
Source: https://support.docusign.com/s/document-item?bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus&language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger-renderer.html
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominGAPage
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/thirdparty-plugins.html
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger.html
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger-renderer.html
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominGAPage
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/thirdparty-plugins.html
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger.html
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger-renderer.html
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominGAPage
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/thirdparty-plugins.html
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger.html
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger-renderer.html
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominGAPage
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominStickyHeader
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/thirdparty-plugins.html
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger.html
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger-renderer.html
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominGAPage
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: Iframe src: https://support.docusign.com/apex/zoomin_app__ZoominStickyHeader
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/thirdparty-plugins.html
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger.html
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: Iframe src: https://apps.usw2.pure.cloud/messenger/messenger-renderer.html

Source: https://watercolorjourney.net/afew/ribs.html	HTTP Parser: No favicon
Source: https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11VQwcdQDkV4Ht24MUUNIkE_oWzh6NqDfIc5-ouG_AuVvziiFx_Gx1dTh955Vh9mM4K5iaxlPz2CmmuLvPGoYL-lfW5fbEmFGmRWH8cOP2J5UVOL52LSWmoJd310j6cVa-JTDbcLEsqPxVdFR1SPpTE3cbk0DxU-5_3BcQPrasTDI-3hJcz4ZSyylwlwhgXyMiYdEPvzwwZ3jAmh3pXPhtruxVopO7oZDT_KCsfyB2LztgATvic3IfYW9M4-sNipqFBWdRMnWnlH9vwfZU6KMC0VgUfTTW_zxL3rJ4T6wc3lkaiFnqvn3bnNG8OrCYbn7wz9SxtMRgRqBNcl3Mg99IyoAOQXm-29gvg-bO7Kzl6QKPE9x1jPGObDJLUugnDsRajJC3vyvqK3dDS_KER6lRHDuWL52NdeSg4HO0D8Lf5Ng&lang=en	HTTP Parser: No favicon
Source: https://www.docusign.com/products/electronic-signature/legality/global	HTTP Parser: No favicon
Source: https://www.docusign.com/products/electronic-signature/legality/global	HTTP Parser: No favicon
Source: https://www.docusign.com/products/electronic-signature/legality/global	HTTP Parser: No favicon
Source: https://www.docusign.com/products/electronic-signature/legality/global	HTTP Parser: No favicon
Source: https://www.docusign.com/products/electronic-signature/legality/global	HTTP Parser: No favicon
Source: https://www.docusign.com/products/electronic-signature/legality/global	HTTP Parser: No favicon
Source: https://www.docusign.com/ip	HTTP Parser: No favicon
Source: https://www.docusign.com/ip	HTTP Parser: No favicon
Source: https://www.docusign.com/ip	HTTP Parser: No favicon
Source: https://www.docusign.com/ip	HTTP Parser: No favicon
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: No favicon
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: No favicon
Source: https://www.docusign.com/trust	HTTP Parser: No favicon
Source: https://www.docusign.com/trust	HTTP Parser: No favicon
Source: https://www.docusign.com/trust	HTTP Parser: No favicon
Source: https://www.docusign.com/	HTTP Parser: No favicon
Source: https://www.docusign.com/	HTTP Parser: No favicon
Source: https://www.docusign.com/	HTTP Parser: No favicon
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: No favicon
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: No favicon
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: No favicon
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: No favicon
Source: https://www.docusign.com/products	HTTP Parser: No favicon
Source: https://www.docusign.com/products	HTTP Parser: No favicon
Source: https://www.docusign.com/products	HTTP Parser: No favicon

Source: https://watercolorjourney.net/afew/ribs.html	HTTP Parser: No <meta name="author".. found
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: No <meta name="author".. found
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: No <meta name="author".. found
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: No <meta name="author".. found
Source: https://www.docusign.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.docusign.com/	HTTP Parser: No <meta name="author".. found
Source: https://support.docusign.com/s/document-item?bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus&language=en_US&rsc_301	HTTP Parser: No <meta name="author".. found
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: No <meta name="author".. found
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: No <meta name="author".. found
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: No <meta name="author".. found
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: No <meta name="author".. found
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: No <meta name="author".. found

Source: https://watercolorjourney.net/afew/ribs.html	HTTP Parser: No <meta name="copyright".. found
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: No <meta name="copyright".. found
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: No <meta name="copyright".. found
Source: https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	HTTP Parser: No <meta name="copyright".. found
Source: https://www.docusign.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.docusign.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://support.docusign.com/s/document-item?bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus&language=en_US&rsc_301	HTTP Parser: No <meta name="copyright".. found
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: No <meta name="copyright".. found
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: No <meta name="copyright".. found
Source: https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	HTTP Parser: No <meta name="copyright".. found
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: No <meta name="copyright".. found
Source: https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	HTTP Parser: No <meta name="copyright".. found

Source: Joe Sandbox View	IP Address: 18.66.102.98 18.66.102.98
Source: Joe Sandbox View	IP Address: 151.101.194.27 151.101.194.27
Source: Joe Sandbox View	IP Address: 151.101.2.27 151.101.2.27
Source: Joe Sandbox View	IP Address: 185.89.210.153 185.89.210.153

Source: chromecache_728.5.dr, chromecache_769.5.dr	String found in binary or memory: url: '//www.youtube.com/embed/$3', equals www.youtube.com (Youtube)
Source: chromecache_728.5.dr, chromecache_769.5.dr	String found in binary or memory: * http://www.youtube.com/embed/opj24KnzrWo equals www.youtube.com (Youtube)
Source: chromecache_728.5.dr, chromecache_769.5.dr	String found in binary or memory: * http://www.youtube.com/watch?v=opj24KnzrWo equals www.youtube.com (Youtube)
Source: chromecache_1487.5.dr, chromecache_1338.5.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=aA(a,c,e);O(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return O(122),!0;if(d&&f){for(var m=Mb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},dA=function(){var a=[],b=function(c){return rb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_1487.5.dr, chromecache_687.5.dr, chromecache_798.5.dr, chromecache_1338.5.dr, chromecache_776.5.dr, chromecache_903.5.dr, chromecache_1443.5.dr, chromecache_1203.5.dr	String found in binary or memory: return b}qC.J="internal.enableAutoEventOnTimer";var hc=ja(["data-gtm-yt-inspected-"]),sC=["www.youtube.com","www.youtube-nocookie.com"],tC,uC=!1; equals www.youtube.com (Youtube)
Source: chromecache_1458.5.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_1458.5.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_1458.5.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_1487.5.dr, chromecache_798.5.dr, chromecache_1338.5.dr, chromecache_1443.5.dr	String found in binary or memory: var FB=function(a,b,c,d,e){var f=yz("fsl",c?"nv.mwt":"mwt",0),g;g=c?yz("fsl","nv.ids",[]):yz("fsl","ids",[]);if(!g.length)return!0;var k=Dz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);O(121);if(m==="https://www.facebook.com/tr/")return O(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!my(k,ny(b, equals www.facebook.com (Facebook)

Source: Vertexgroup#Signature.pdf	Initial sample: https://www.docusign.com/features-and-benefits/mobile?utm_campaign=gbl_xx_dbu_ups_2211_signnotificationemailfooter&utm_medium=product&utm_source=postsend
Source: Vertexgroup#Signature.pdf	Initial sample: https://support.docusign.com/
Source: Vertexgroup#Signature.pdf	Initial sample: https://support.docusign.com/en/guides/declining-to-sign-docusign-signer-guide
Source: Vertexgroup#Signature.pdf	Initial sample: https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11VQwcdQDkV4Ht24MUUNIkE_oWzh6NqDfIc5-ouG_AuVvziiFx_Gx1dTh955Vh9mM4K5iaxlPz2CmmuLvPGoYL-lfW5fbEmFGmRWH8cOP2J5UVOL52LSWmoJd310j6cVa-JTDbcLEsqPxVdFR1SPpTE3cbk0DxU-5_3BcQPrasTDI-3hJcz4ZSyylwlwhgXyMiYdEPvzwwZ3jAmh3pXPhtruxVopO7oZDT_KCsfyB2LztgATvic3IfYW9M4-sNipqFBWdRMnWnlH9vwfZU6KMC0VgUfTTW_zxL3rJ4T6wc3lkaiFnqvn3bnNG8OrCYbn7wz9SxtMRgRqBNcl3Mg99IyoAOQXm-29gvg-bO7Kzl6QKPE9x1jPGObDJLUugnDsRajJC3vyvqK3dDS_KER6lRHDuWL52NdeSg4HO0D8Lf5Ng&lang=en
Source: Vertexgroup#Signature.pdf	Initial sample: https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_US&utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend
Source: Vertexgroup#Signature.pdf	Initial sample: https://support.docusign.com/s/articles/how-do-i-sign-a-docusign-document-basic-signing?language=en_us&utm_campaign=gbl_xx_dbu_ups_2211_signnotificationemailfooter&utm_medium=product&utm_source=postsend
Source: Vertexgroup#Signature.pdf	Initial sample: https://protect.docusign.net/report-abuse?e=automjpfak9glbpl0zffi11vqwcdqdkv4ht24muunike_owzh6nqdfic5-oug_auvvziifx_gx1dth955vh9mm4k5iaxlpz2cmmulvpgoyl-lfw5fbemfgmrwh8cop2j5uvol52lswmojd310j6cva-jtdbclesqpxvdfr1sppte3cbk0dxu-5_3bcqprastdi-3hjcz4zsyylwlwhgxymiydepvzwwz3jamh3pxphtruxvopo7ozdt_kcsfyb2lztgatvic3ifyw9m4-snipqfbwdrmnwnlh9vwfzu6kmc0vgufttw_zxl3rj4t6wc3lkaifnqvn3bnng8orcybn7wz9sxtmrgrqbncl3mg99iyoaoqxm-29gvg-bo7kzl6qkpe9x1jpgobdjluugndsrajjc3vyvqk3dds_ker6lrhduwl52ndesg4ho0d8lf5ng&lang=en
Source: Vertexgroup#Signature.pdf	Initial sample: https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications
Source: Vertexgroup#Signature.pdf	Initial sample: https://community.docusign.com/signing-7
Source: Vertexgroup#Signature.pdf	Initial sample: https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend
Source: Vertexgroup#Signature.pdf	Initial sample: https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide
Source: Vertexgroup#Signature.pdf	Initial sample: https://support.docusign.com/en/articles/how-do-i-manage-my-email-notifications

Source: chromecache_1217.5.dr, chromecache_1029.5.dr	Binary or memory string: SelectFilterElement.prototype.filter=function(){var a=document.getElementById(this.controllerName),b=document.getElementById(this.targetName),d=document.getElementById(this.getSearchElementId());this.useJsSearch&&(d&&0!=d.value.length)&&(d.value="");b.options.length=0;SelectFilterElement.prototype.NONE_LABEL&&(b.options[0]=new Option(SelectFilterElement.prototype.NONE_LABEL,"000000000000000"));var c=0,f=0,e=this.allOptions[a.value];if(e){var g=this.existingName;g&&this.initSelectedOptionsFromUi();
Source: chromecache_1217.5.dr, chromecache_1029.5.dr	Binary or memory string: SelectFilterElement.prototype.init=function(){this.filter();if(this.existingName){var a=document.getElementById(this.existingName);a&&(a.selectFilterEl=this,a.onchange=function(){this.selectFilterEl.initSelectedOptionsFromUi()})}if(this.controllerOption&&this.controllerName){var b=document.getElementById(this.controllerName);if(null!=b.options&&void 0!=b.options)for(a=0;a<b.options.length;a++)b.options[a].value==this.controllerOption&&(b.options[a].selected=!0)}if(this.targetOption){b=document.getElementById(this.targetName);
Source: chromecache_1217.5.dr, chromecache_1029.5.dr	Binary or memory string: SelectFilterElement.prototype.initSelectedOptionsFromUi=function(){if(this.existingName){this.selectedOptions=[];var a=document.getElementById(this.existingName);if(a)for(var b=0;b<a.options.length;b++)0<a.options[b].value.length&&(this.selectedOptions[a.options[b].value]=!0)}};

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Vertexgroup#Signature.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1616,i,1713217016441259986,848854696645655636,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ceo.ca/api/banner_redirect?channel=g&url=https://watercolorjourney.net/afew/ribs.html&banner=824
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2244,i,805177385167841147,1461457387704447815,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11VQwcdQDkV4Ht24MUUNIkE_oWzh6NqDfIc5-ouG_AuVvziiFx_Gx1dTh955Vh9mM4K5iaxlPz2CmmuLvPGoYL-lfW5fbEmFGmRWH8cOP2J5UVOL52LSWmoJd310j6cVa-JTDbcLEsqPxVdFR1SPpTE3cbk0DxU-5_3BcQPrasTDI-3hJcz4ZSyylwlwhgXyMiYdEPvzwwZ3jAmh3pXPhtruxVopO7oZDT_KCsfyB2LztgATvic3IfYW9M4-sNipqFBWdRMnWnlH9vwfZU6KMC0VgUfTTW_zxL3rJ4T6wc3lkaiFnqvn3bnNG8OrCYbn7wz9SxtMRgRqBNcl3Mg99IyoAOQXm-29gvg-bO7Kzl6QKPE9x1jPGObDJLUugnDsRajJC3vyvqK3dDS_KER6lRHDuWL52NdeSg4HO0D8Lf5Ng&lang=en"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2028,i,835848995580459791,17264038142937124725,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5104 --field-trial-handle=2028,i,835848995580459791,17264038142937124725,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1616,i,1713217016441259986,848854696645655636,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2244,i,805177385167841147,1461457387704447815,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2028,i,835848995580459791,17264038142937124725,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5104 --field-trial-handle=2028,i,835848995580459791,17264038142937124725,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Vertexgroup#Signature.pdf	Initial sample: PDF keyword /JS count = 0
Source: Vertexgroup#Signature.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9rsz1u9_1ekimjl_5nw.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9rsz1u9_1ekimjl_5nw.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Drive-by Compromise	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Source	Detection	Scanner	Label
https://watercolorjourney.net/afew/ribs.html	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://developers.google.com/recaptcha/docs/faq#localhost_support	0%	URL Reputation	safe
https://px.ads.linkedin.com/collect?	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php	0%	URL Reputation	safe
https://metrics.api.drift.com	0%	URL Reputation	safe
https://support.google.com/recaptcha/#6175971	0%	URL Reputation	safe
https://support.google.com/recaptcha	0%	URL Reputation	safe
https://siteintercept.qualtrics.com	0%	URL Reputation	safe
https://schema.org	0%	URL Reputation	safe
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	0%	URL Reputation	safe
https://connect.facebook.net/	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe
https://github.com/zloirock/core-js	0%	Avira URL Cloud	safe
https://github.com/cure53/DOMPurify/blob/2.0.11/dist/purify.js#L128	0%	Avira URL Cloud	safe
https://www.google.com/pagead/1p-user-list/949750955/?random	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery/blob/1.5/jquery.js#L5147	0%	Avira URL Cloud	safe
https://images.ctfassets.net/0jnmtsdzg6p5/4AzFR608LEA58AROS90ZuO/e9cd0d3f01c1cf1be427d534d03e162a/fl	0%	Avira URL Cloud	safe
https://www.docusign.com/ja-jp/trust	0%	Avira URL Cloud	safe
http://garlicjs.org	0%	Avira URL Cloud	safe
https://docucdn-a.akamaihd.net/olive/fonts/2.8.0/DSIndigo-Semibold.woff2	0%	Avira URL Cloud	safe
http://c.brightcove.com/services	0%	Avira URL Cloud	safe
http://adomas.org/javascript-mouse-wheel/	0%	Avira URL Cloud	safe
https://customer.api.drift.com	0%	URL Reputation	safe
https://opensource.org/licenses/MIT	0%	URL Reputation	safe
https://sketch.com	0%	URL Reputation	safe
https://cloud.google.com/contact	0%	URL Reputation	safe
https://conversation.api.drift.com	0%	URL Reputation	safe
https://td.doubleclick.net/td/bjs	0%	URL Reputation	safe
https://www.docusign.com/en-ca/free-account	0%	Avira URL Cloud	safe
https://github.com/gabceb/jquery-browser-plugin	0%	Avira URL Cloud	safe
http://kenwheeler.github.io/slick	0%	URL Reputation	safe
https://github.com/scottjehl/picturefill/blob/master/Authors.txt;	0%	Avira URL Cloud	safe
https://support.docusign.com/s/contactSupport?language=nl_NL&langSet=1&transfer=dc	0%	Avira URL Cloud	safe
https://cloud.google.com/recaptcha-enterprise/billing-information	0%	URL Reputation	safe
https://support.docusign.com/favicon.ico	0%	Avira URL Cloud	safe
https://docucdn-a.akamaihd.net/olive/fonts/2.8.0/DSIndigo-Regular.woff	0%	Avira URL Cloud	safe
http://jqueryvalidation.org/	0%	URL Reputation	safe
https://www.docusign.com/how-it-works/legality/global	0%	Avira URL Cloud	safe
https://e-courts.org/wp-content/uploads/docusign-logo.png	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery/blob/1.5/jquery.js#L4960	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/cure53/DOMPurify/blob/2.0.11/dist/purify.js#L128	chromecache_992.5.dr	false	Avira URL Cloud: safe	unknown
http://garlicjs.org	chromecache_1313.5.dr	false	Avira URL Cloud: safe	unknown
https://images.ctfassets.net/0jnmtsdzg6p5/4AzFR608LEA58AROS90ZuO/e9cd0d3f01c1cf1be427d534d03e162a/fl	chromecache_1453.5.dr	false	Avira URL Cloud: safe	unknown
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_786.5.dr, chromecache_716.5.dr	false	URL Reputation: safe	unknown
http://adomas.org/javascript-mouse-wheel/	chromecache_728.5.dr, chromecache_769.5.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/pagead/1p-user-list/949750955/?random	chromecache_1451.5.dr, chromecache_884.5.dr, chromecache_1234.5.dr, chromecache_1067.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/zloirock/core-js	chromecache_1021.5.dr	false	Avira URL Cloud: safe	unknown
http://c.brightcove.com/services	chromecache_669.5.dr	false	Avira URL Cloud: safe	unknown
https://docucdn-a.akamaihd.net/olive/fonts/2.8.0/DSIndigo-Semibold.woff2	chromecache_1437.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery/blob/1.5/jquery.js#L5147	chromecache_992.5.dr	false	Avira URL Cloud: safe	unknown
https://px.ads.linkedin.com/collect?	chromecache_1443.5.dr	false	URL Reputation: safe	unknown
https://www.docusign.com/ja-jp/trust	chromecache_1054.5.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_992.5.dr, chromecache_706.5.dr	false	URL Reputation: safe	unknown
https://metrics.api.drift.com	chromecache_1300.5.dr, chromecache_830.5.dr, chromecache_1471.5.dr, chromecache_1503.5.dr, chromecache_941.5.dr, chromecache_1293.5.dr, chromecache_734.5.dr	false	URL Reputation: safe	unknown
https://www.docusign.com/en-ca/free-account	chromecache_662.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/gabceb/jquery-browser-plugin	chromecache_1313.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/scottjehl/picturefill/blob/master/Authors.txt;	chromecache_1262.5.dr, chromecache_1402.5.dr	false	Avira URL Cloud: safe	unknown
https://support.docusign.com/favicon.ico	chromecache_1430.5.dr, chromecache_1025.5.dr	false	Avira URL Cloud: safe	unknown
https://support.google.com/recaptcha/#6175971	chromecache_786.5.dr, chromecache_716.5.dr	false	URL Reputation: safe	unknown
https://support.docusign.com/s/contactSupport?language=nl_NL&langSet=1&transfer=dc	chromecache_826.5.dr, chromecache_721.5.dr	false	Avira URL Cloud: safe	unknown
https://docucdn-a.akamaihd.net/olive/fonts/2.8.0/DSIndigo-Regular.woff	chromecache_1437.5.dr	false	Avira URL Cloud: safe	unknown
https://www.docusign.com/how-it-works/legality/global	chromecache_1473.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery/blob/1.5/jquery.js#L4960	chromecache_992.5.dr	false	Avira URL Cloud: safe	unknown
https://support.google.com/recaptcha	chromecache_716.5.dr	false	URL Reputation: safe	unknown
https://gist.github.com	chromecache_1157.5.dr	false	Avira URL Cloud: safe	unknown
https://e-courts.org/wp-content/uploads/docusign-logo.png	chromecache_1230.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery/blob/1.5/jquery.js#L5493	chromecache_992.5.dr	false	Avira URL Cloud: safe	unknown
https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide)	Vertexgroup#Signature.pdf	false	Avira URL Cloud: safe	unknown
https://docucdn-a.akamaihd.net/olive/fonts/2.8.0/DSIndigo-Medium.woff2	chromecache_1437.5.dr	false	Avira URL Cloud: safe	unknown
https://www.docusign.com/products/rooms-for-real-estate	chromecache_1079.5.dr	false	Avira URL Cloud: safe	unknown
http://benalman.com/projects/jquery-hashchange-plugin/	chromecache_706.5.dr	false	Avira URL Cloud: safe	unknown
https://siteintercept.qualtrics.com	chromecache_1511.5.dr, chromecache_816.5.dr, chromecache_839.5.dr	false	URL Reputation: safe	unknown
https://github.com/jquery/jquery/blob/1.5/jquery.js#L4958	chromecache_992.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery/blob/1.5/jquery.js#L4957	chromecache_992.5.dr	false	Avira URL Cloud: safe	unknown
https://schema.org	chromecache_1054.5.dr, chromecache_1079.5.dr, chromecache_1473.5.dr	false	URL Reputation: safe	unknown
https://ecom.docusign.com/plans-and-pricing/real-estate	chromecache_1079.5.dr	false	Avira URL Cloud: safe	unknown
https://support.docusign.com/s/contactSupport?language=en_US&transfer=dc	chromecache_826.5.dr, chromecache_721.5.dr	false	Avira URL Cloud: safe	unknown
https://www.docusign.com/company/cookie-policy	chromecache_950.5.dr	false	Avira URL Cloud: safe	unknown
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_786.5.dr, chromecache_716.5.dr	false	URL Reputation: safe	unknown
https://connect.facebook.net/	chromecache_840.5.dr, chromecache_1458.5.dr	false	URL Reputation: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
18.66.102.98	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.74.200	unknown	United States	15169	GOOGLEUS	false
172.217.16.138	unknown	United States	15169	GOOGLEUS	false
3.222.244.48	unknown	United States	14618	AMAZON-AESUS	false
151.101.194.27	unknown	United States	54113	FASTLYUS	false
35.186.194.58	unknown	United States	15169	GOOGLEUS	false
151.101.2.27	unknown	United States	54113	FASTLYUS	false
142.250.185.100	unknown	United States	15169	GOOGLEUS	false
185.89.210.153	unknown	Germany	29990	ASN-APPNEXUS	false
50.16.7.188	unknown	United States	14618	AMAZON-AESUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
13.33.187.16	unknown	United States	16509	AMAZON-02US	false
34.215.121.79	unknown	United States	16509	AMAZON-02US	false
18.172.112.55	unknown	United States	3	MIT-GATEWAYSUS	false
65.9.86.119	unknown	United States	16509	AMAZON-02US	false
13.227.219.42	unknown	United States	16509	AMAZON-02US	false
151.101.193.140	unknown	United States	54113	FASTLYUS	false
13.110.252.159	unknown	United States	14340	SALESFORCEUS	false
23.60.211.52	unknown	United States	16625	AKAMAI-ASUS	false
184.28.89.92	unknown	United States	16625	AKAMAI-ASUS	false
52.86.6.77	unknown	United States	14618	AMAZON-AESUS	false
157.240.252.13	unknown	United States	32934	FACEBOOKUS	false
199.232.210.172	unknown	United States	54113	FASTLYUS	false
52.71.169.56	unknown	United States	14618	AMAZON-AESUS	false
54.164.95.99	unknown	United States	14618	AMAZON-AESUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.87.42	unknown	United States	13335	CLOUDFLARENETUS	false
44.238.14.128	unknown	United States	16509	AMAZON-02US	false
74.125.21.147	unknown	United States	15169	GOOGLEUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
199.232.198.27	unknown	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.5.13.197	unknown	United States	14618	AMAZON-AESUS	false
3.12.140.230	unknown	United States	16509	AMAZON-02US	false
35.244.174.68	unknown	United States	15169	GOOGLEUS	false
18.245.86.14	unknown	United States	16509	AMAZON-02US	false
185.81.101.84	unknown	Germany	62856	DOCUS-6-PRODUS	false
85.222.140.6	unknown	United Kingdom	14340	SALESFORCEUS	false
185.81.101.86	unknown	Germany	62856	DOCUS-6-PRODUS	false
216.239.38.181	unknown	United States	15169	GOOGLEUS	false

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Name	Malicious	Reputation
https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus	false	unknown
https://support.docusign.com/s/articles/How-do-I-manage-my-email-notifications?language=en_US&rsc_301	false	unknown
https://support.docusign.com/s/document-item?bundleId=yca1573855023892&topicId=fqo1573855017663.html&_LANG=enus&language=en_US&rsc_301	false	unknown
https://support.docusign.com/s/contactSupport?language=en_US&rsc_301	false	unknown

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1499890
Start date and time:	2024-08-27 17:23:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Vertexgroup#Signature.pdf
Detection:	MAL
Classification:	mal52.phis.winPDF@70/1317@0/100
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Browse: https://www.docusign.com/how-it-works/legality/global Browse: https://www.docusign.com/IP Browse: https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications Close Viewer Browse: https://www.docusign.com/trust Browse: https://www.docusign.com/ Browse: https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide Browse: https://support.docusign.com/contactSupport Browse: https://www.docusign.com/products

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
18.66.102.98	https://myallsouth.com/privacy-policy/	Get hash	malicious	Unknown	Browse
	https://eu.docusign.net	Get hash	malicious	Unknown	Browse
	Factura.pdf	Get hash	malicious	Unknown	Browse
	https://www.svb.com/learning-central/go/contact	Get hash	malicious	Unknown	Browse
	https://url5041.app.lucid.co/uni/ls/click?upn=u001.9CEiYqsCeDB7JcEaXQIz-2F9XjjPqk-2Fb4pFcLw69B6WqTy-2BbVFLiir3sSJZjbRo6mBAwRtKNr9Kf4WztrdCBts7iyzvcJ-2FIUH0XDrcbuiiKrlzy8ZwzSxYR1urVGEa2H8lG0Sg7ExDExUtTEJeACnxEcvsJ4CnFcY2OyyabtZjsqjBmQJR0iCaQNYCn9tJqfPt0sqRsrpUZbmtTsF5u4sk76aC5ja3Exi0TVSSBuxtzkkrePRrkTP-2FRoxSefUr1y9ifBkb_dUh7YYn0CWe7g0uIZp9zt65Hthp00ETbvJwQ2-2FPnaFo-2F6mxOihmrHPDDfCfshjvQGVU9-2Bd2-2B3vsLq0LwwbeORlRqCPnIR26Xq1m6ZVCtavwwAaoSjStADst1UVTP0l4d-2FzBe05CWQHZRJZnuruhZc2ae0Zf85sATPdd2ckxoL02afjX6IZ-2FOnZhoY7M8W-2FjfCWzd1oIyP3ANpDIJAgvTalmosz4y3Bzw-2FhLw29NweA30QmgJS04wuz2oXimlo6op-2FqJedWdU8-2FFbrJTBeUgeanW2Czs-2FFx2TH3awx6W-2F55Yb82yx-2F62ecOROxbh-2BxRxP0NuIJ3E3kOjP9A-2FBHPPistrMOyMfHL3jiBAgKbwxDOZEkcZdWn-2FbhWLonViLvhgsmNJILGX2sEzIPx5T9dHffneCLLKkuS58PqzDIY8zgACYh67a-2BB2UiAkAJ2RKKsfjEyBczdi7jS1NPJGO8JELOnONA-2BUkh-2FPUe3G9cdiSbxRW0MxW4MALRMk7Wout0aHFsrJ7Eh7hadnZE4mjg6TM4MQdJoJM9kphXs-2FrJ8by1dOwVfzD1MjU7M-2FUsC6hEi8gkYGjfbMvNzOqhWtGlGQX1TqXB4dLSi-2FpFlKLKKTOyb-2BEg-2Fk4dUHiOlXDdWkbx1GLw9K6ZKJtQNSWhWZuSXKhKo1a2RW3Ug4SPFD-2F-2Fq24DMjrCmm0g8oFpoDapmDPd4UzAivOlfdqqtkNSCkPToMecTrMkYlTeNujTr-2Bbw99hSJKirL4rAfH9oaNg32Alc4lwJoCppVycgre3BcqTLb2WoN7sUpmWarOPciYLuedGYc0-3D	Get hash	malicious	Unknown	Browse
	file-sample_100kB.doc	Get hash	malicious	Unknown	Browse
	https://in.xero.com/wwkwvl0g2njip86pvix1xtkdqpe7u3z1vzdpadcn	Get hash	malicious	Unknown	Browse
	https://in.xero.com/otg9csffpxao6afkqb3xwrugoatdbpeduijycctc	Get hash	malicious	Unknown	Browse
	https://developers.foxit.com/	Get hash	malicious	Unknown	Browse
	https://us02web.zoom.us/webinar/register/6317193087387/WN_wbycs5lISL2eo8rEP6qUDg#/registration	Get hash	malicious	Unknown	Browse
151.101.194.27	http://frshbks.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://foundbv.box.com/s/gse33y18m85x002nsfdn69ekkg7q7nfg	Get hash	malicious	Unknown	Browse
	http://xotkv.liveslotwin.win/4vvAbP14462aDrK1306xrgwuopgbq27894YISBHZZSBHFDXYQ99KKKX16691O17	Get hash	malicious	Unknown	Browse
	https://ssl.sonicsecuremail.com/r.aspx?b=8&e=pamela%2Ecase%40marionfl%2Eorg&p=4VEU&cb=181	Get hash	malicious	Unknown	Browse
	https://opposite-grandiose-flock.glitch.me/public/digitalapps.navyfederal.org.html	Get hash	malicious	HTMLPhisher	Browse
	http://flexilink.com.ar/oo/docusign.php	Get hash	malicious	Unknown	Browse
	http://mibs-neotenies-b73c3308-57653002eca0e1-3ad8141911d9be9-258.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://app.esign.docusign.com/e/er?utm_campaign=GBL_XX_DBU_NEW_2307_FreetoTrialUnlock_Email1AU&utm_medium=email&utm_source=Eloqua&elqCampaignId=29542&s=566810826&lid=32871&elqTrackId=1034fb987fd44c9a9a4d0833ff06a55d&elq=89d72859fe264966a0176d4309dbb1a6&elqaid=60251&elqat=1	Get hash	malicious	Unknown	Browse
	https://bs-2pp.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://content.amac.us/?m=ff1Z8iQrULAL24m6HV3KXgLVd6tjSdDrf&r=https://www.lcrhtrk.com/LSK646/3M7TGPW/?sub1=4956	Get hash	malicious	Unknown	Browse
151.101.2.27	https://rogue-orange-foe.glitch.me/public/USANFCU.html	Get hash	malicious	HTMLPhisher	Browse
	http://vbfii.pgslotmx.com/4lErLl15833GMQN1411zilkbmrmpx14462UVBCFIXAXTJVAYQ286RNBY17492g17	Get hash	malicious	Unknown	Browse
	http://frshbks.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://ashanioliver14.wixsite.com/my-site-1	Get hash	malicious	Unknown	Browse
	https://foundbv.box.com/s/gse33y18m85x002nsfdn69ekkg7q7nfg	Get hash	malicious	Unknown	Browse
	http://dkpmt.ngelink.cc/4NiJac15319dpCI1377ckliwublab21000DYABYJHPBRHUKFV28279WINZ17387I18#un92gu3drmwdgxav0i4clt74ygdc5umnx660ge2pw16j2d27zp	Get hash	malicious	Unknown	Browse
	https://petalite-crocus-mitten.glitch.me/public/nfcu703553.HTML	Get hash	malicious	HTMLPhisher	Browse
	https://shell-shiny-spectrum.glitch.me/public/CcNfN0.HTM	Get hash	malicious	HTMLPhisher	Browse
	http://aol-ahc-hrsn-form.pages.dev/	Get hash	malicious	Unknown	Browse
	https://ssl.sonicsecuremail.com/r.aspx?b=8&e=pamela%2Ecase%40marionfl%2Eorg&p=4VEU&cb=181	Get hash	malicious	Unknown	Browse
185.89.210.153	https://yoge0104.github.io/Yoge0104	Get hash	malicious	HTMLPhisher	Browse
	http://es.jpwn6.shop/reda/redirect.html	Get hash	malicious	Unknown	Browse
	Remittance 728 Norriselectric0032xslx.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://rogue-orange-foe.glitch.me/public/USANFCU.html	Get hash	malicious	HTMLPhisher	Browse
	http://lazily-devoted-snipe.pgsdemo.com	Get hash	malicious	Unknown	Browse
	https://www.msn.com/en-us/news/politics/sunday-meltdown-trump-floods-truth-social-with-photos-of-swifties-and-communists/ar-AA1p19A0?ocid=socialshare&cvid=d5d44c775cbf4f01a72d252af5f493ba&ei=19	Get hash	malicious	Unknown	Browse
	http://pflwh.pomeryan.com/4HpNTt15553xtqa1382knsykfmuvm25912PUWUJAJOPLPWWDM2837EWZP17387i18	Get hash	malicious	Unknown	Browse
	http://kcrekanlogien.gitbook.io/us	Get hash	malicious	Unknown	Browse
	http://help-mettamskexteiin.gitbook.io/us	Get hash	malicious	Unknown	Browse
	http://nxejt.polluxcastor.top	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	Proof Of Payment.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFgXXvv2-2BWxavJhSFh1X9YeE09JxYfGZOrfNXpE1b1zMSec6V_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZNvtRLmuq9nwTUBLvlyUQLSTjA0dDcTtmNJHz5AQBzdlGtncKRz08-2BYDBtkpKhh0KX17i2fmd5it7ecx-2FWvhsbD-2BwYBTTPKQ3j-2FAyMvTur79Dsx-2FPO7GwMrKARE8VWDjAjvStKY75qeeBLXHuDipEV3KKO3k4ABqkQG2RlytfHIDieNQv9UnoJapwQuVaik0jLuTXarvnnfl3sa3LYFT4h4hVVagLZJwfqoXYBXcReN-2F1X4eM9FZF-2BvVOXIZ-2BqDy2Q-3D	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	Request For Quotation.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	Proof Of Payment.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	https://files.fm/u/vtrxvgdh6w	Get hash	malicious	GuLoader	Browse	151.101.65.229
	https://github.com/VioletteChiara/AnimalTA/releases/download/v3.2.2/AnimalTA_installer_v3.2.2.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	http://journalscene.secondstreetapp.com/api/organization_user_email_verifications?token=npv0kjeneci&opid=1033948&lrt=rmsqe55tykx&bf=bc07ae1cf7bbffb3bcd5bc7a10f031b8&ip=207.144.57.39&redirect=https://unsus3.ru/oth/chameleon/#mloomans@securustech.net	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://www.empoweryourretirement.com	Get hash	malicious	Unknown	Browse	151.101.194.137
	adobe_document.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	http://o62arw.dsjpropertymanagementllc.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	151.101.1.229
MIT-GATEWAYSUS	http://chart.wwwoaretirement.com	Get hash	malicious	Unknown	Browse	18.66.121.138
	Doc-Secure6025.pdf	Get hash	malicious	Unknown	Browse	18.66.122.20
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	18.66.112.34
	https://n3ki6w9.r.ap-northeast-2.awstrack.me/L0/https:%2F%2Fet.sp-25.com%2Fe%2Fc%2FOTizp%3FreferCode=product_OT2211aaaaaaaaaa%26shortLink=aaaaa%26longLink=H4sIAAAAAAAAAAXBWxLAEAwAwBNFCFP0Np7DhzLC_bvbzln8IvKCeQSPsM-63EoeIs2BYXW8H9_IafdYUCotqyUCW00Co8wDzmUFkhJ58qVqo35jyZFkUwAAAA==%26ecSource=OT%26referId=8725724309822211/1/010c01918f3a3e79-f24b6623-ae8f-4f46-a748-e9746a6021e2-000000/4Oo6Bk-hd_o5oOs3lBvVzZAlIjU=173	Get hash	malicious	Unknown	Browse	18.172.112.87
	https://we.tl/t-RErWU1YgQS	Get hash	malicious	Unknown	Browse	18.172.103.101
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	18.66.196.38
	https://messaging-security.comano.us/XdEtiQ3I4emJ5ZldQUWF3SmcwOEQ4cURsb24rSWYyY2loVzV5bktYMlpLSlVxalNnL1RabENaQmozTzkvS3FhK1Z5ZTJDZHlNa1VGbnJDL1g3ZHBLdXdYNUJJbXVhckp5RmFuam41SWhoR0tQUTVWSmNSeEdVdXp3ZmV3eksreWs4dlFnVTBqZG8xUDdFZU9sN1JGZUNtUGdHQnZsVVJLRHREbFNUQm54UWtMa3dmdFNwVENxQTRLaFh3PT0tLUd4TXFReTErSUVBOTZZdDQtLWFZbmE1c254RWIwVWNyTkhyVHN0TUE9PQ==?cid=2140479915	Get hash	malicious	Unknown	Browse	18.173.205.50
	http://constructivesoftware.com.au	Get hash	malicious	Unknown	Browse	18.66.122.128
	https://57365oo.cc/	Get hash	malicious	Phisher	Browse	18.66.122.93
	http://es.jpwn6.shop/reda/redirect.html	Get hash	malicious	Unknown	Browse	18.172.112.26
AMAZON-AESUS	https://files.fm/u/vtrxvgdh6w	Get hash	malicious	GuLoader	Browse	54.204.123.228
	http://journalscene.secondstreetapp.com/api/organization_user_email_verifications?token=npv0kjeneci&opid=1033948&lrt=rmsqe55tykx&bf=bc07ae1cf7bbffb3bcd5bc7a10f031b8&ip=207.144.57.39&redirect=https://unsus3.ru/oth/chameleon/#mloomans@securustech.net	Get hash	malicious	HTMLPhisher	Browse	54.197.229.45
	Gov Annual Salary + Employer - Provided Benefits.pdf	Get hash	malicious	Phisher	Browse	54.227.187.23
	https://www.dropbox.com/scl/fi/divczsjhc8wrt1wb18r2b/AT-Society-Directory.docx?rlkey=sjkzm3g8jkcekmsxm460sja78&st=r52leq64&dl=0	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	54.90.44.119
	Gov Annual Salary + Employer - Provided Benefits2.pdf	Get hash	malicious	Phisher	Browse	34.193.227.236
	Doc-Secure6025.pdf	Get hash	malicious	Unknown	Browse	3.212.150.182
	UBONg7lmVR.exe	Get hash	malicious	Unknown	Browse	3.211.178.193
	UBONg7lmVR.exe	Get hash	malicious	Unknown	Browse	34.194.69.213
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	54.90.52.195
	1feP5qTCl0.exe	Get hash	malicious	Unknown	Browse	34.194.69.213
FASTLYUS	Proof Of Payment.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFgXXvv2-2BWxavJhSFh1X9YeE09JxYfGZOrfNXpE1b1zMSec6V_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZNvtRLmuq9nwTUBLvlyUQLSTjA0dDcTtmNJHz5AQBzdlGtncKRz08-2BYDBtkpKhh0KX17i2fmd5it7ecx-2FWvhsbD-2BwYBTTPKQ3j-2FAyMvTur79Dsx-2FPO7GwMrKARE8VWDjAjvStKY75qeeBLXHuDipEV3KKO3k4ABqkQG2RlytfHIDieNQv9UnoJapwQuVaik0jLuTXarvnnfl3sa3LYFT4h4hVVagLZJwfqoXYBXcReN-2F1X4eM9FZF-2BvVOXIZ-2BqDy2Q-3D	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	Request For Quotation.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	Proof Of Payment.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	https://files.fm/u/vtrxvgdh6w	Get hash	malicious	GuLoader	Browse	151.101.65.229
	https://github.com/VioletteChiara/AnimalTA/releases/download/v3.2.2/AnimalTA_installer_v3.2.2.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	http://journalscene.secondstreetapp.com/api/organization_user_email_verifications?token=npv0kjeneci&opid=1033948&lrt=rmsqe55tykx&bf=bc07ae1cf7bbffb3bcd5bc7a10f031b8&ip=207.144.57.39&redirect=https://unsus3.ru/oth/chameleon/#mloomans@securustech.net	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://www.empoweryourretirement.com	Get hash	malicious	Unknown	Browse	151.101.194.137
	adobe_document.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	http://o62arw.dsjpropertymanagementllc.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	151.101.1.229

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.222608429036346
Encrypted:	false
SSDEEP:	6:N7Zq2Pwkn2nKuAl9OmbnIFUt887mXZmw+87mFkwOwkn2nKuAl9OmbjLJ:N7ZvYfHAahFUt887G/+8765JfHAaSJ
MD5:	355301E7F33B13822A83DDFB33D102F5
SHA1:	8BBEB66968EA777307B01D40F98032E376E6C4D7
SHA-256:	CC6436F999FA3651DACCDF7F77BBB53AE420A5195209EA6376A41211910D60C9
SHA-512:	EAC59B29E7A823613B01C1DC950D29AAB96886940098201229E21057C3B79A130B4851A1C5DAFE9CA8CEC1CFDA77BACCC0CC52B42EF54ADDEBBB0388F4523FE1
Malicious:	false
Reputation:	low
Preview:	2024/08/27-11:24:05.524 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/27-11:24:05.526 1db0 Recovering log #3.2024/08/27-11:24:05.526 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	107348
Entropy (8bit):	5.264039514215191
Encrypted:	false
SSDEEP:	1536:ReqhZjvnk1z3vrsja9cxEf6+6Glby/XJ42qbVTE4wLyPe9VAs:R1hZjKJ1y/Z4rbrwLPVAs
MD5:	114785899CEB423273FCC17AAAD202E9
SHA1:	CE53389286218FE6D7CE1EB86208074C024ACCA5
SHA-256:	C8C302716CF94980A0D77E614D9FB6C430F166B5EF7C42B7C382771955E52BA6
SHA-512:	6E357A327420598542BFFEDF8F03F7F4C327469CDC6CC52B39C0B542DA4EF09C6739F46161C8D2796BFA05193D94B47420308CF4F2A50A2F0DF73EE9712544A4
Malicious:	false
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[50],{"7nmT":function(e,t,n){"use strict";!function checkDCE(){if("undefined"!==typeof __REACT_DEVTOOLS_GLOBAL_HOOK__&&"function"===typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE)try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(checkDCE)}catch(e){console.error(e)}}(),e.exports=n("w/UT")},"w/UT":function(n,r,a){"use strict";var i=a("ERkP"),o=a("maj8"),u=a("jiMj");function x(e){for(var t=arguments.length-1,n="https://reactjs.org/docs/error-decoder.html?invariant="+e,r=0;r<t;r++)n+="&args[]="+encodeURIComponent(arguments[r+1]);!function ba(e,t,n,r,l,a,i,o){if(!e){if(e=void 0,void 0===t)e=Error("Minified exception occurred; use the non-minified dev environment for the full error message and additional helpful warnings.");else{var u=[n,r,l,a,i,o],c=0;(e=Error(t.replace(/%s/g,function(){return u[c++]}))).name="Invariant Violation"}throw e.framesToPop=1,e}}(!1,"Minified React error #"+e+"; visit %s for the full message or use the non-minified dev

File type:	PDF document, version 1.4, 2 pages
Entropy (8bit):	7.710718231854466
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Vertexgroup#Signature.pdf
File size:	87'334 bytes
MD5:	1783219408e9aecb46085991db36d438
SHA1:	5bb12f3c99f4a4e929e123e5947bc21d0425980d
SHA256:	3437bd9fbe5dacfb17e33c8d9cf4e416d483583500e4fe0c565753adc9331248
SHA512:	e856375740332b4d711c05454392ea1b96987655121ebd61e1c9632303b9f78b3e96e3016dd27c330921a2c627a4e7090b05292bfc7a747aa303811d283c5c40
SSDEEP:	1536:nk9LkPY+EzsO8a33UNHLSRcBZLHbb1mqaOvZBIw9w7HCl/JrA3NOy1DY+OI:YKVO8a33UNr+cBZzIqxvTP9w7HGr6NTd
TLSH:	87836D6DF88E8C4CD843DA1DC1AA388E5B5DF51BA9CDB884013D0A15F642ED5A7A33C7
File Content Preview:	%PDF-1.4.%.....1 0 obj.<</Creator (Chromium)./Producer (Skia/PDF m126)./CreationDate (D:20240827094154+00'00')./ModDate (D:20240827094154+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.4 0 obj.<</CA 1./ca 1./LC 0./LJ 0./LW 1./ML 4./SA true./BM /Nor

General
Header:	%PDF-1.4
Total Entropy:	7.710718
Total Bytes:	87334
Stream Entropy:	7.993926
Stream Bytes:	63588
Entropy outside Streams:	5.201786
Bytes outside Streams:	23746
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	128
endobj	128
stream	12
endstream	12
xref	1
trailer	1
startxref	1
/Page	2
/Encrypt	0
/ObjStm	0
/URI	30
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Vertexgroup#Signature.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c0568dab-78cd-4061-9a21-c37ebcda3a99.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240827152410Z-198.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Windows Analysis Report
Vertexgroup#Signature.pdf

ID	DHASH	MD5
7	0000000000000000	16140a074be700d27f788bf1cc05211c
8	0823232b24341400	82ff70ad7ff0b20ad3c25d6e566974bc
10	0000000000000000	4d9b55987c0dba5ca3b00dc10fb9aa37

Target ID:	0
Start time:	11:24:04
Start date:	27/08/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Vertexgroup#Signature.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	11:24:05
Start date:	27/08/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	11:24:07
Start date:	27/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ceo.ca/api/banner_redirect?channel=g&url=https://watercolorjourney.net/afew/ribs.html&banner=824
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	11:24:08
Start date:	27/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2244,i,805177385167841147,1461457387704447815,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	11:24:29
Start date:	27/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11VQwcdQDkV4Ht24MUUNIkE_oWzh6NqDfIc5-ouG_AuVvziiFx_Gx1dTh955Vh9mM4K5iaxlPz2CmmuLvPGoYL-lfW5fbEmFGmRWH8cOP2J5UVOL52LSWmoJd310j6cVa-JTDbcLEsqPxVdFR1SPpTE3cbk0DxU-5_3BcQPrasTDI-3hJcz4ZSyylwlwhgXyMiYdEPvzwwZ3jAmh3pXPhtruxVopO7oZDT_KCsfyB2LztgATvic3IfYW9M4-sNipqFBWdRMnWnlH9vwfZU6KMC0VgUfTTW_zxL3rJ4T6wc3lkaiFnqvn3bnNG8OrCYbn7wz9SxtMRgRqBNcl3Mg99IyoAOQXm-29gvg-bO7Kzl6QKPE9x1jPGObDJLUugnDsRajJC3vyvqK3dDS_KER6lRHDuWL52NdeSg4HO0D8Lf5Ng&lang=en"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	13
Start time:	11:25:13
Start date:	27/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5104 --field-trial-handle=2028,i,835848995580459791,17264038142937124725,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre