Windows Analysis Report
https://na4.docusign.net/Signing/EmailStart.aspx?a=c1ee55e8-d253-4731-bf85-5377494446fc&etti=24&acct=c49653d8-ee55-4f22-afc9-287006261d0b&er=251e9446-3fcb-4714-8d01-feee559625a8

Overview

General Information

Sample URL: https://na4.docusign.net/Signing/EmailStart.aspx?a=c1ee55e8-d253-4731-bf85-5377494446fc&etti=24&acct=c49653d8-ee55-4f22-afc9-287006261d0b&er=251e9446-3fcb-4714-8d01-feee559625a8
Analysis ID: 1541405

Detection

HTMLPhisher
Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

AI detected phishing page
Yara detected HtmlPhish54
Phishing site detected (based on favicon image match)
Phishing site detected (based on image similarity)
Phishing site or detected (based on various text indicators)
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
Stores files to the Windows start menu directory
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Phishing
barindex
AI detected phishing page
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev' does not match the legitimate domain 'microsoft.com'., The URL contains suspicious elements such as misspellings ('ciient' instead of 'client', '1ndex' instead of 'index', 'authonilne' instead of 'authonline')., The use of 'secure-protect-docs-ms' is misleading and attempts to mimic Microsoft-related services., The domain extension '.workers.dev' is unusual for Microsoft and not typically associated with their official services., The presence of input fields for 'Email, phone, or Skype' is common in phishing attempts targeting Microsoft accounts. DOM: 3.9.pages.csv
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev' does not match the legitimate domain 'microsoft.com'., The URL contains suspicious elements such as misspellings ('ciient' instead of 'client', '1ndex' instead of 'index', 'authonilne' instead of 'authonline')., The use of 'secure-protect-docs-ms' is misleading and attempts to mimic Microsoft-related services., The domain extension '.workers.dev' is unusual for Microsoft and suggests a potential phishing attempt., The presence of input fields for 'Email, phone, or Skype' aligns with common phishing tactics to harvest personal information. DOM: 3.10.pages.csv
Yara detected HtmlPhish54
Source: Yara match File source: 0.72.i.script.csv, type: HTML
Source: Yara match File source: 2.6.pages.csv, type: HTML
Source: Yara match File source: 3.7.pages.csv, type: HTML
Phishing site detected (based on favicon image match)
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true Matcher: Template: microsoft matched with high similarity
Phishing site detected (based on image similarity)
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true Matcher: Found strong image similarity, brand: MICROSOFT
Phishing site or detected (based on various text indicators)
Source: Chrome DOM: 1.4 OCR Text: Drag and drop fields from the left panel onto the document OTHER ACTIONS FINISH FIELDS Docusign Envelope agcgcBD-aaoo-4387-cB-6521522oocF5 Signature IS) docusign DS Initial Stamp Date Signed Name O First Name Last Name Email Address Company Title Text T Checkbox ACCOUNTS PAYABLE DEPARTMENT SHARED PDF VIA DOCUSIGN OR-CODE ELECTRONIC TRANSFER CONFIRMATION RECEIPT PDF SCAN OR-CODE TO VIEW DOCUMENT docusign Cl-jcnge Language - English (LIS) Y' Terms Of & Privacy Y I Copyright Z Oocvsignlnc: V2R
HTML body contains low number of good links
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: Number of links: 0
HTML page contains hidden javascript code
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/ HTTP Parser: Base64 decoded: abb668c1-2000-41bd-951b-9a6ee8a4a7d91e6d3b00-cbf2-4902-95a4-48b1e5942e64
HTML title does not match URL
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: Title: Sign in to your account does not match URL
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)
Source: https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.10.26-8/signing-conversations.js?cs=7aa34814 HTTP Parser: /*! for license information please see signing-conversations.js.license.txt */!function(){var e,t,n,r,o,i={57279:function(e,t,n){"use strict";var r=n(5946);object.defineproperty(t,"__esmodule",{value:!0}),t.default=void 0;var o=r(n(61240)),i=r(n(20271)),a=r(n(43563)),u=r(n(70533)),s=function(){function e(){(0,i.default)(this,e),(0,u.default)(this,"queue",new array),(0,u.default)(this,"workingonpromise",!1)}return(0,a.default)(e,[{key:"enqueue",value:function(e){var t=this;return new o.default((function(n,r){t.queue.push({worker:e,resolve:n,reject:r}),t.dequeue()}))}},{key:"dequeue",value:function(){var e=this;if(this.workingonpromise)return!1;var t=this.queue.shift();if(!t)return!1;try{this.workingonpromise=!0,t.worker().then((function(n){e.workingonpromise=!1,t.resolve(n),e.dequeue()})).catch((function(n){e.workingonpromise=!1,t.reject(n),e.dequeue()}))}catch(e){this.workingonpromise=!1,t.reject(e),this.dequeue()}return!0}}]),e}();t.default=s},74087:function(e,t,n){"use strict";var r=n(50697);object.definep...
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: Iframe src: https://portal.microsoftonline.com/Prefetch/Prefetch.aspx
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: Iframe src: https://portal.microsoftonline.com/Prefetch/Prefetch.aspx
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: <input type="password" .../> found
Source: https://na4.docusign.net/Signing/?ti=8a834ae1b85749e4afdf6b47323f40e3 HTTP Parser: No favicon
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/ HTTP Parser: No favicon
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: No favicon
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: No favicon
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: No <meta name="author".. found
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: No <meta name="author".. found
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: No <meta name="copyright".. found
Source: https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49856 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: global traffic DNS traffic detected: DNS query: na4.docusign.net
Source: global traffic DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic DNS traffic detected: DNS query: a.docusign.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic DNS traffic detected: DNS query: cdn.optimizely.com
Source: global traffic DNS traffic detected: DNS query: qrco.de
Source: global traffic DNS traffic detected: DNS query: ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev
Source: global traffic DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic DNS traffic detected: DNS query: portal.microsoftonline.com
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49856 version: TLS 1.2
Source: classification engine Classification label: mal68.phis.win@25/80@38/223
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1940,i,18273831505888259367,3071314893996205044,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na4.docusign.net/Signing/EmailStart.aspx?a=c1ee55e8-d253-4731-bf85-5377494446fc&etti=24&acct=c49653d8-ee55-4f22-afc9-287006261d0b&er=251e9446-3fcb-4714-8d01-feee559625a8"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1940,i,18273831505888259367,3071314893996205044,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://qrco.de/bfVQto
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1972,i,5479482500097163730,10502286885727628499,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1972,i,5479482500097163730,10502286885727628499,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: Window Recorder Window detected: More than 3 window changes detected
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.6.156
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
130.211.34.183
 api.mixpanel.com United States
15169 GOOGLEUS false
52.35.199.106
 arya-1323461286.us-west-2.elb.amazonaws.com United States
16509 AMAZON-02US false
2.16.238.157
 unknown European Union
20940 AKAMAI-ASN1EU false
142.250.186.174
 unknown United States
15169 GOOGLEUS false
108.138.233.118
 qrco.de United States
16509 AMAZON-02US false
2.19.126.143
 unknown European Union
16625 AKAMAI-ASUS false
162.248.184.187
 unknown United States
62856 DOCUS-6-PRODUS false
2.16.238.136
 unknown European Union
20940 AKAMAI-ASN1EU false
162.248.184.189
 unknown United States
62856 DOCUS-6-PRODUS false
172.217.18.10
 unknown United States
15169 GOOGLEUS false
142.250.186.99
 unknown United States
15169 GOOGLEUS false
142.250.184.196
 www.google.com United States
15169 GOOGLEUS false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
108.177.15.84
 unknown United States
15169 GOOGLEUS false
104.18.65.57
 cdn.optimizely.com United States
13335 CLOUDFLARENETUS false
216.58.212.138
 unknown United States
15169 GOOGLEUS false
172.217.16.206
 unknown United States
15169 GOOGLEUS false
20.190.159.75
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
2.19.126.84
 unknown European Union
16625 AKAMAI-ASUS false
35.190.25.25
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.185.195
 unknown United States
15169 GOOGLEUS false
188.114.96.3
 ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev European Union
13335 CLOUDFLARENETUS true
152.199.21.175
 sni1gl.wpc.omegacdn.net United States
15133 EDGECASTUS false

Private

IP
192.168.2.16

Contacted Domains

Name IP Active
ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev 188.114.96.3 true
cdn.optimizely.com 104.18.65.57 true
sni1gl.wpc.omegacdn.net 152.199.21.175 true
s-part-0017.t-0009.t-msedge.net 13.107.246.45 true
www.google.com 142.250.184.196 true
api.mixpanel.com 130.211.34.183 true
qrco.de 108.138.233.118 true
arya-1323461286.us-west-2.elb.amazonaws.com 52.35.199.106 true
identity.nel.measure.office.net unknown unknown
portal.microsoftonline.com unknown unknown
na4.docusign.net unknown unknown
a.docusign.com unknown unknown
aadcdn.msftauth.net unknown unknown
docucdn-a.akamaihd.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/ false
    		unknown
    https://ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev/?sso_reload=true true
      		unknown
      https://na4.docusign.net/Signing/?ti=8a834ae1b85749e4afdf6b47323f40e3 false
        		unknown