Windows Analysis Report
https://eu.docusign.net/Signing/EmailStart.aspx?a=fda42e60-d786-47e1-bd4d-cefd28143f0a&etti=24&acct=ac54d6d4-2396-463d-a7b0-d065df9f63da&er=d553e8f2-760d-4734-ac30-816baca506d7

Overview

General Information

Sample URL:	https://eu.docusign.net/Signing/EmailStart.aspx?a=fda42e60-d786-47e1-bd4d-cefd28143f0a&etti=24&acct=ac54d6d4-2396-463d-a7b0-d065df9f63da&er=d553e8f2-760d-4734-ac30-816baca506d7
Analysis ID:	1545400

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Submit button contains javascript call

Classification

Signatures

HTML body contains low number of good links

Source: https://eu.docusign.net/Signing/ActivateSecurityChecks.aspx?a=d77b1698-e8d2-4089-8a86-748f8fc409db&ti=a168a2f13c0848abadc581c399ffa05b

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://eu.docusign.net/Signing/ActivateSecurityChecks.aspx?a=d77b1698-e8d2-4089-8a86-748f8fc409db&ti=a168a2f13c0848abadc581c399ffa05b

HTTP Parser: Base64 decoded: celeBtnHeight40 Btnsecondaryd&font-weight:normal;white-space:nowrap;submitd`if(event){if(typeof(IsEnterOrSpaceKey)!=='undefined'&&IsEnterOrSpaceKey(event)){this.onclick()}}#0A1428dhdFont15RddFont15...

Submit button contains javascript call

Source: https://eu.docusign.net/Signing/ActivateSecurityChecks.aspx?a=d77b1698-e8d2-4089-8a86-748f8fc409db&ti=a168a2f13c0848abadc581c399ffa05b	HTTP Parser: On click: SMSAuthCallClicked()
Source: https://eu.docusign.net/Signing/ActivateSecurityChecks.aspx?a=d77b1698-e8d2-4089-8a86-748f8fc409db&ti=a168a2f13c0848abadc581c399ffa05b	HTTP Parser: On click: SMSAuthCallClicked()

Source: https://eu.docusign.net/Signing/ActivateSecurityChecks.aspx?a=d77b1698-e8d2-4089-8a86-748f8fc409db&ti=a168a2f13c0848abadc581c399ffa05b

HTTP Parser: <input type="password" .../> found

Source: https://eu.docusign.net/Signing/ActivateSecurityChecks.aspx?a=d77b1698-e8d2-4089-8a86-748f8fc409db&ti=a168a2f13c0848abadc581c399ffa05b	HTTP Parser: No <meta name="author".. found
Source: https://eu.docusign.net/Signing/ActivateSecurityChecks.aspx?a=d77b1698-e8d2-4089-8a86-748f8fc409db&ti=a168a2f13c0848abadc581c399ffa05b	HTTP Parser: No <meta name="author".. found

Source: https://eu.docusign.net/Signing/ActivateSecurityChecks.aspx?a=d77b1698-e8d2-4089-8a86-748f8fc409db&ti=a168a2f13c0848abadc581c399ffa05b	HTTP Parser: No <meta name="copyright".. found
Source: https://eu.docusign.net/Signing/ActivateSecurityChecks.aspx?a=d77b1698-e8d2-4089-8a86-748f8fc409db&ti=a168a2f13c0848abadc581c399ffa05b	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.17:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.17:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.10.254:443 -> 192.168.2.17:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.10.254:443 -> 192.168.2.17:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.17:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.179:443 -> 192.168.2.17:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49770 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: eu.docusign.net
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: rpxnow.com
Source: global traffic	DNS traffic detected: DNS query: d29usylhdk1xyu.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: quilt-cdn.janrain.com
Source: global traffic	DNS traffic detected: DNS query: docj27ko03fnu.cloudfront.net

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.17:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.17:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.10.254:443 -> 192.168.2.17:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.10.254:443 -> 192.168.2.17:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.17:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.179:443 -> 192.168.2.17:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49770 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@17/28@26/212

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1964,i,6401566266122679399,13245475541568404218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eu.docusign.net/Signing/EmailStart.aspx?a=fda42e60-d786-47e1-bd4d-cefd28143f0a&etti=24&acct=ac54d6d4-2396-463d-a7b0-d065df9f63da&er=d553e8f2-760d-4734-ac30-816baca506d7"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1964,i,6401566266122679399,13245475541568404218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
18.172.112.38	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
35.186.241.51	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
34.194.220.181	rpxnow.com	United States	14618	AMAZON-AESUS	false
216.58.206.74	unknown	United States	15169	GOOGLEUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
173.194.76.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
13.224.189.58	unknown	United States	16509	AMAZON-02US	false
2.19.126.135	unknown	European Union	16625	AKAMAI-ASUS	false
35.190.25.25	api.mixpanel.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.172.112.60	docj27ko03fnu.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
18.164.52.68	d29usylhdk1xyu.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
2.18.64.4	unknown	European Union	6057	AdministracionNacionaldeTelecomunicacionesUY	false
185.81.100.28	unknown	Germany	62856	DOCUS-6-PRODUS	false
2.20.245.140	unknown	European Union	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
rpxnow.com	34.194.220.181	true
www.google.com	142.250.185.132	true
d29usylhdk1xyu.cloudfront.net	18.164.52.68	true
api.mixpanel.com	35.190.25.25	true
docj27ko03fnu.cloudfront.net	18.172.112.60	true
quilt-cdn.janrain.com	unknown	unknown
eu.docusign.net	unknown	unknown
docucdn-a.akamaihd.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://eu.docusign.net/Signing/ActivateSecurityChecks.aspx?a=d77b1698-e8d2-4089-8a86-748f8fc409db&ti=a168a2f13c0848abadc581c399ffa05b	false		unknown

ID:	1545400
Product:	CloudBasic
Start time:	14:12:29
Start date:	30.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 12:13:00 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	097C31057A2B6985E6DE1115D56C1510	335FFED7A52B2E1F21A9C0921A7E271BA5D1361A	5AF09F12E3B0600E8BDDF99B49D1DEA68A6F124DA0426EC6E406CCBF57167A78
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 12:13:00 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	147DEE9AE7678888C298CC810EEDE936	8DE28E24E3D0726A65C5F1912A9D7327390ED468	EE13F56AF93F48D541D940AE2AB24E25898106E701ED03586317E73C1340431A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	EE3774B00E8AD883BFCEDF248321312E	ECE450E1C7BCA869578208ADCB92383483415F2D	B85F053837B85D035341414374E9F14B198206A99BFDE45D0C26D13A414A437F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 12:13:00 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	313104D0A560C998F1E6DB31EEA58A02	788D1CC9CEA5B0D01BAE86FFF8FA68B3C27F52CB	2C39723D2D016DC902557EBD1D289DEA537B9625DF82DFFF3FF9646FBF41055A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 12:13:00 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	E0AB4A8DA3E2F8D0EF796C41B0DC5D07	EEF2C491DF8BF790E51E193F0D24FAB56302B562	BD1E7D040D9B6A9697B98FEBFB91425D4B472CCE64B9C8584F3DFF0A7928705F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 12:13:00 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	742FD37A9465323F10FCF7BF7E56EFCD	71CA0F9C5E80E09E0412DE0B5C5ADBF25B7D21E0	D7FC1026E82361F143DD36D18A79B9033FE2C33D7688617FDA1BBFF3FBE726CE
Chrome Cache Entry: 102	SVG Scalable Vector Graphics image	855476199961A10981ADCA7432CEC048	7995725A0CAC73EB6A2A1B5A8D5B162DBF47988E	6DD60FAA0E35F2DFE342C452ED414A084D384D11793BD0F0EB03C2B1C6F1405C
Chrome Cache Entry: 103	ASCII text	ECE7A224F69AB2205D90900589AE1D05	3D861B816A5DA892C8A88D5755A5537C036239DE	FFA8C6A4CE199BFD9E32B05E0E4DECE330C6A577FB3A0E8518291619C658C486
Chrome Cache Entry: 104	gzip compressed data, from Unix, original size modulo 2^32 464380	B12CCFEA1EC61935954ACCE8396FCEA1	497BD93881D12309A71C40FD52BEC2B6C64965DE	F4E35E9CC17BAAB26C94389FC8703F555084AFE8B19A15B8C12F5997F98B931E
Chrome Cache Entry: 107	PNG image data, 79 x 79, 8-bit/color RGB, non-interlaced	C87DA3413DAD0BC57D3F6C42C3848657	5F307E843AE7B61DBB541B55CC159386664A40F4	AE8E67BAA196F0D1A50103804DA7CC8EA1B30F97A3878F044D2EE03902D9925E
Chrome Cache Entry: 108	Web Open Font Format, CFF, length 33752, version 0.0	4DE7535F6F5DF8D5437C21C068DDB0EC	3553204B4624CA41CF1C4F3BD9B37D8C968CBA23	8F6A520A392FF62149E5FC5AA87BFAB9B3816CD6010D4D4FCA194E8683CA498B
Chrome Cache Entry: 109	PNG image data, 45 x 40, 8-bit/color RGBA, non-interlaced	CA320B5A928109755FFA12D7388506E1	F237244628CA41165081F70F3987120C003AAE7F	8A25CB9589C976773DEA150AAEF2DDED6DB6381E2F51FCF34ABE6D5C1A1D2ACF
Chrome Cache Entry: 110	ASCII text, with very long lines (14047), with CRLF line terminators	2DF506C66BFCE9CB2060DE8963D8D8A6	6A953FD27DD87FC6CF7927C74E3B210AC8182DA9	316EDC0BF34BD527C50793EB5C134AD5582060F7743AE28B6EE2C07AC391DE93
Chrome Cache Entry: 111	ASCII text, with very long lines (65536), with no line terminators	8121AE33F00D45B74C7801A544E8C08D	DC46A1A035D85F09FDFFE9284B455054E1DA731E	66A55BD8F6EA7923BF41E71E84ADCD50C4EA4976ED7228DCA2704EC71F8A5B54
Chrome Cache Entry: 112	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	AFE00DB89CE086B91A541C227EDBF136	961B2EE6FB39C4D515BDC49EC1BA688B0916F104	E11827C678AF8519E702F364E525AC34509CAD49F8D839677E089949EDDA060E
Chrome Cache Entry: 113	GIF image data, version 89a, 60 x 60	07C429B126D443CF5FBD80E08AC61939	FA928667AFBF4D34B104FDE08536589D87D3EF8F	F3A25B79FD41F1B6EC6B0A679892C87A1445BC0BE089099AAC6D6D5956E355C2
Chrome Cache Entry: 115	ASCII text, with very long lines (32029), with CRLF line terminators	2B6294333DB8EEB65BC7717144357D23	74EF185A3CBA75AF7F4E1B3DCAF1B32B0DB5C1AF	4946FCF019E50CF850A0344E45B3A8F93D5EAD5E1DADE33695025EF732913AF1
Chrome Cache Entry: 119	Web Open Font Format, CFF, length 34820, version 0.0	FD117C9EB999E35D64BE1515D5B2192D	B0FAE4091AC17A28C47AF531A9D5B73B4C35F6BD	553582BE8A5D2779D1A9E9C3A6698FD4D365E01353D8876A7204DB68FCD1D12D
Chrome Cache Entry: 120	PNG image data, 28 x 31, 8-bit/color RGBA, non-interlaced	17C96FC4B9C8464D1C95CD785DD3120B	561ACE8E4B5FE53D23CF02C4DD6ABF6099D618C6	3051AD5E11115EC4C89769159F719EA0F43A2557749EAA5DA3E1955EBC5DFF1D
Chrome Cache Entry: 123	ASCII text	CB4FD3AF4DEEBD7277FCD75A576BF633	71A7BC5DE0F92581F2A9F8DCED86578E01B4856C	F6C29AE65E37D866FEFB836DB488C4D044414798EC995B2B69CD067949938DD9
Chrome Cache Entry: 125	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	5F84956EE22160FF2BAEC2035234A7D4	F9CE8F109CBA3F9C253C02A5C4274930F01F3582	8FBDC57DADDB25026195ED010F855392D9E0C0F3BF3528B284F57E5C1016E581
Chrome Cache Entry: 89	ASCII text, with very long lines (3196), with CRLF line terminators	2403A507DB3BEC351FF6982A66EF17F8	EF50995B9594A66A78E8CAD364DC907D634B22C2	71D87C7D8573D220079013552A187C9B08884C83D70F51CEBCB5CA4EF2D7960F
Chrome Cache Entry: 91	ASCII text, with no line terminators	EFAC30A8E225EA004DA05F31C701732D	4D8871774233878046CC11567E70B0F3D6EC3870	56B4E766B8BE69CE923F1BB4C1B0D82522FEAB6221FAFC9EDEB8B65EB05063E9
Chrome Cache Entry: 93	PNG image data, 1696 x 1294, 8-bit/color RGBA, interlaced	FB78456DE1AD22E5884E8DFAF560A7F2	62DEE26C982A61413C883B6E37AD48B8262FC61A	BB1ED3D6B50A1675B90F48B19E64F7BA614B26D5CA6DF8FDA64FA1EF5CC30ED1
Chrome Cache Entry: 94	ASCII text	CB2C566A95361D2A63BB49DEFE5017D7	1653DEA71F2F6DDC35A407DC4394F9D119FCFEAC	462212100F197888C46A04E8E11F51764A6AC3A66FB8F3A508ECBDFE482BBD1C
Chrome Cache Entry: 95	ASCII text, with very long lines (4056), with no line terminators	0EE255C8B0FD4ABCB7623AD802944099	79613A2B93AD81BBBEDAD0EFEC9B0CC06E3389EE	FE5664E2F1099E3DC83E07A4B65E7B7407A7852A03C979642ACE652D947C01C7
Chrome Cache Entry: 96	ASCII text, with CRLF line terminators	4B86605C4B80FA75342703878E7DFF13	6EF59F904C58E88B3E143BA3DA464AFE63FDC188	2F186CDFA13B6CA51F69D44BAC8A7D5B69E1D5409A68D21F5768A87C6DFDB3A1
Chrome Cache Entry: 99	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced	C863DB426897325CB4805B2C20F51F30	A426FE43F0CE1A489CE091CC27768CDCC2991210	2A5179B8851C8E3DFC77D7DCB33B3963AFA037608336D6AE412ACAA38AD59D22

Windows Analysis Report
https://eu.docusign.net/Signing/EmailStart.aspx?a=fda42e60-d786-47e1-bd4d-cefd28143f0a&etti=24&acct=ac54d6d4-2396-463d-a7b0-d065df9f63da&er=d553e8f2-760d-4734-ac30-816baca506d7

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://eu.docusign.net/Signing/EmailStart.aspx?a=fda42e60-d786-47e1-bd4d-cefd28143f0a&etti=24&acct=ac54d6d4-2396-463d-a7b0-d065df9f63da&er=d553e8f2-760d-4734-ac30-816baca506d7

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://eu.docusign.net/Signing/EmailStart.aspx?a=fda42e60-d786-47e1-bd4d-cefd28143f0a&etti=24&acct=ac54d6d4-2396-463d-a7b0-d065df9f63da&er=d553e8f2-760d-4734-ac30-816baca506d7