IOC Report
https://account.docusign.com/oauth/auth?client_id=9f87e104-a483-405b-ab66-d0bcad57bf62&scope=signature%20admin_consent%20manage_app_keys%20connect_hmac_api%20user_read%20account_read%20user_write%20cors_manage%20manage_system_signing_groups%20account_write%20admin_communication_read%20admin_communic

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:47:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:47:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:47:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:47:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:47:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 67
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 68
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 69
Unicode text, UTF-8 text, with very long lines (42039), with LF, NEL line terminators
downloaded
Chrome Cache Entry: 70
Web Open Font Format (Version 2), TrueType, length 29516, version 1.0
downloaded
Chrome Cache Entry: 71
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 72
JSON data
dropped
Chrome Cache Entry: 73
Web Open Font Format (Version 2), TrueType, length 31436, version 1.0
downloaded
Chrome Cache Entry: 74
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 75
Unicode text, UTF-8 text, with very long lines (42039), with LF, NEL line terminators
dropped
Chrome Cache Entry: 76
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 77
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 78
Web Open Font Format (Version 2), TrueType, length 31644, version 1.0
downloaded
Chrome Cache Entry: 79
ASCII text, with CRLF line terminators
dropped
There are 10 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1976,i,12408937537895223525,5792875283717638676,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://account.docusign.com/oauth/auth?client_id=9f87e104-a483-405b-ab66-d0bcad57bf62&scope=signature%20admin_consent%20manage_app_keys%20connect_hmac_api%20user_read%20account_read%20user_write%20cors_manage%20manage_system_signing_groups%20account_write%20admin_communication_read%20admin_communication_write%20organization_write%20organization_read%20account_product_read%20group_management_read%20group_management_write%20me_profile%20search_read%20search_write%20organization_data_feed_config_read%20organization_data_feed_config_write%20organization_monitor_config_read%20organization_monitor_config_write%20organization_monitor_events_read%20notary_read%20notary_write%20click.manage%20service_protection_limit_manage_api%20eis_subscriptions_read%20eis_subscriptions_write%20provision_asset_group_account_read%20provision_asset_group_read%20provision_asset_group_account_clone_read%20provision_asset_group_account_clone_write%20act_read%20act_write%20valmod_manage%20account_assets_info%20account_asset_read%20asset_group_read%20asset_group_account_read%20asset_group_subscription_read%20asset_group_asset_read%20organization_sub_account_read%20organization_sub_account_write%20account_asset_write%20addon_management_api%20pup_read%20ad_seat_read%20ad_seat_write%20brand_service_read%20brand_service_write&response_type=code&redirect_uri=https%3A%2F%2Fadmin.docusign.com%2Fauth%2Fcallback&state=CfDJ8G-P_dpK_pFIhSwi7mM5lVuiiqz1T0PXeECPxAEf842rG6TOjdLiQHzogjjX3yY_85Ck4rQhS7kkeoX_mNyO7OJaOtyKvPFAqmpjNNpAOTo_RGDfQGXqry_YxF5xACPt6vtOpYqT5rJj1_Z6ibIIlNP2B8XNr07h8NtAE9ij-mlSkicRteBJAjjpns5nHOGK3s7_iF8OGtoM2-IyZMOdYTbr2XdEv_bp9amyoGfa9r9vuzoaxYqXFt-kQ_ziBQF6gm17mXlhzc8RJ0GJLXy5gdoPTznmiseoCB3f-sc2whOr0HAv0aTruLg9u_Cjx8wilyL8suFuYH6MBlLbHUmJkYEtVr0jFKYU28wvMeY4Oyu55WyFkzka7bbj3I49SkLpqqGMWypE4hQR0TTHHPwI3rE9bx-s55gixcEG9y6Gy-wWFulGTssNWsXWJCq3qBkPFFigC9CrFkpvALdr3XyOZLQIa-iqUp6cPSFgBi-JHcb54rFHPtdZGY_ckkfJ70TQcd34UnQPEzTcVAVwRA55xN2eyRTO5lLBx4umL9NN9hziO8mXaNZfb0Oax1VteoL7ctWVLqvzpIXcuSEwZ"

URLs

Name
IP
Malicious
https://account.docusign.com/oauth/auth?client_id=9f87e104-a483-405b-ab66-d0bcad57bf62&scope=signature%20admin_consent%20manage_app_keys%20connect_hmac_api%20user_read%20account_read%20user_write%20cors_manage%20manage_system_signing_groups%20account_write%20admin_communication_read%20admin_communication_write%20organization_write%20organization_read%20account_product_read%20group_management_read%20group_management_write%20me_profile%20search_read%20search_write%20organization_data_feed_config_read%20organization_data_feed_config_write%20organization_monitor_config_read%20organization_monitor_config_write%20organization_monitor_events_read%20notary_read%20notary_write%20click.manage%20service_protection_limit_manage_api%20eis_subscriptions_read%20eis_subscriptions_write%20provision_asset_group_account_read%20provision_asset_group_read%20provision_asset_group_account_clone_read%20provision_asset_group_account_clone_write%20act_read%20act_write%20valmod_manage%20account_assets_info%20account_asset_read%20asset_group_read%20asset_group_account_read%20asset_group_subscription_read%20asset_group_asset_read%20organization_sub_account_read%20organization_sub_account_write%20account_asset_write%20addon_management_api%20pup_read%20ad_seat_read%20ad_seat_write%20brand_service_read%20brand_service_write&response_type=code&redirect_uri=https%3A%2F%2Fadmin.docusign.com%2Fauth%2Fcallback&state=CfDJ8G-P_dpK_pFIhSwi7mM5lVuiiqz1T0PXeECPxAEf842rG6TOjdLiQHzogjjX3yY_85Ck4rQhS7kkeoX_mNyO7OJaOtyKvPFAqmpjNNpAOTo_RGDfQGXqry_YxF5xACPt6vtOpYqT5rJj1_Z6ibIIlNP2B8XNr07h8NtAE9ij-mlSkicRteBJAjjpns5nHOGK3s7_iF8OGtoM2-IyZMOdYTbr2XdEv_bp9amyoGfa9r9vuzoaxYqXFt-kQ_ziBQF6gm17mXlhzc8RJ0GJLXy5gdoPTznmiseoCB3f-sc2whOr0HAv0aTruLg9u_Cjx8wilyL8suFuYH6MBlLbHUmJkYEtVr0jFKYU28wvMeY4Oyu55WyFkzka7bbj3I49SkLpqqGMWypE4hQR0TTHHPwI3rE9bx-s55gixcEG9y6Gy-wWFulGTssNWsXWJCq3qBkPFFigC9CrFkpvALdr3XyOZLQIa-iqUp6cPSFgBi-JHcb54rFHPtdZGY_ckkfJ70TQcd34UnQPEzTcVAVwRA55xN2eyRTO5lLBx4umL9NN9hziO8mXaNZfb0Oax1VteoL7ctWVLqvzpIXcuSEwZ
https://www.docusign.fr/conditions-generales-d-utilisation
unknown
https://www.docusign.com/company/privacy-policy
unknown
https://www.docusign.ca/company/privacy-policy
unknown
https://www.docusign.mx/compania/politica-de-privacidad
unknown
https://www.docusign.es/empresa/condiciones-de-uso/web
unknown
https://www.docusign.de/unternehmen/agb
unknown
https://github.com/zloirock/core-js
unknown
https://www.docusign.com/company/terms-and-conditions/web
unknown
https://www.docusign.com.au/company/terms-and-conditions/web
unknown
https://www.docusign.jp/company/privacy-policy
unknown
https://www.docusign.com.br/termos-uso
unknown
https://www.docusign.fr/societe/politique-de-confidentialite
unknown
https://github.com/zloirock/core-js/blob/v3.36.1/LICENSE
unknown
https://www.docusign.ca/company/terms-and-conditions/web
unknown
https://github.com/zloirock/core-js/blob/v3.25.0/LICENSE
unknown
https://gist.github.com/1129031
unknown
https://www.docusign.es/empresa/politica-de-privacidad
unknown
https://www.docusign.de/unternehmen/datenschutz
unknown
https://account.docusign.com/oauth/auth?client_id=9f87e104-a483-405b-ab66-d0bcad57bf62&scope=signature%20admin_consent%20manage_app_keys%20connect_hmac_api%20user_read%20account_read%20user_write%20cors_manage%20manage_system_signing_groups%20account_write%20admin_communication_read%20admin_communication_write%20organization_write%20organization_read%20account_product_read%20group_management_read%20group_management_write%20me_profile%20search_read%20search_write%20organization_data_feed_config_read%20organization_data_feed_config_write%20organization_monitor_config_read%20organization_monitor_config_write%20organization_monitor_events_read%20notary_read%20notary_write%20click.manage%20service_protection_limit_manage_api%20eis_subscriptions_read%20eis_subscriptions_write%20provision_asset_group_account_read%20provision_asset_group_read%20provision_asset_group_account_clone_read%20provision_asset_group_account_clone_write%20act_read%20act_write%20valmod_manage%20account_assets_info%20account_asset_read%20asset_group_read%20asset_group_account_read%20asset_group_subscription_read%20asset_group_asset_read%20organization_sub_account_read%20organization_sub_account_write%20account_asset_write%20addon_management_api%20pup_read%20ad_seat_read%20ad_seat_write%20brand_service_read%20brand_service_write&response_type=code&redirect_uri=https%3A%2F%2Fadmin.docusign.com%2Fauth%2Fcallback&state=CfDJ8G-P_dpK_pFIhSwi7mM5lVuiiqz1T0PXeECPxAEf842rG6TOjdLiQHzogjjX3yY_85Ck4rQhS7kkeoX_mNyO7OJaOtyKvPFAqmpjNNpAOTo_RGDfQGXqry_YxF5xACPt6vtOpYqT5rJj1_Z6ibIIlNP2B8XNr07h8NtAE9ij-mlSkicRteBJAjjpns5nHOGK3s7_iF8OGtoM2-IyZMOdYTbr2XdEv_bp9amyoGfa9r9vuzoaxYqXFt-kQ_ziBQF6gm17mXlhzc8RJ0GJLXy5gdoPTznmiseoCB3f-sc2whOr0HAv0aTruLg9u_Cjx8wilyL8suFuYH6MBlLbHUmJkYEtVr0jFKYU28wvMeY4Oyu55WyFkzka7bbj3I49SkLpqqGMWypE4hQR0TTHHPwI3rE9bx-s55gixcEG9y6Gy-wWFulGTssNWsXWJCq3qBkPFFigC9CrFkpvALdr3XyOZLQIa-iqUp6cPSFgBi-JHcb54rFHPtdZGY_ckkfJ70TQcd34UnQPEzTcVAVwRA55xN2eyRTO5lLBx4umL9NN9hziO8mXaNZfb0Oax1VteoL7ctWVLqvzpIXcuSEwZ
https://www.docusign.com.br/politica-de-privacidade
unknown
https://www.docusign.com.au/company/privacy-policy
unknown
https://www.docusign.co.uk/company/privacy-policy
unknown
https://www.docusign.mx/compania/condiciones-de-uso/web
unknown
https://www.docusign.co.uk/company/terms-and-conditions/web
unknown
https://www.docusign.jp/company/terms-and-conditions/web
unknown
http://eligrey.com
unknown
There are 16 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.210.172
s-part-0017.t-0009.t-msedge.net
13.107.246.45
www.google.com
142.250.185.196
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
217.20.57.41
fp2e7a.wpc.phicdn.net
192.229.221.95
account.docusign.com
unknown
telemetry.docusign.net
unknown
docucdn-a.akamaihd.net
unknown

IPs

IP
Domain
Country
Malicious
192.168.2.5
unknown
unknown
239.255.255.250
unknown
Reserved
142.250.185.196
www.google.com
United States

DOM / HTML

URL
Malicious
https://account.docusign.com/oauth/auth?client_id=9f87e104-a483-405b-ab66-d0bcad57bf62&scope=signature%20admin_consent%20manage_app_keys%20connect_hmac_api%20user_read%20account_read%20user_write%20cors_manage%20manage_system_signing_groups%20account_write%20admin_communication_read%20admin_communication_write%20organization_write%20organization_read%20account_product_read%20group_management_read%20group_management_write%20me_profile%20search_read%20search_write%20organization_data_feed_config_read%20organization_data_feed_config_write%20organization_monitor_config_read%20organization_monitor_config_write%20organization_monitor_events_read%20notary_read%20notary_write%20click.manage%20service_protection_limit_manage_api%20eis_subscriptions_read%20eis_subscriptions_write%20provision_asset_group_account_read%20provision_asset_group_read%20provision_asset_group_account_clone_read%20provision_asset_group_account_clone_write%20act_read%20act_write%20valmod_manage%20account_assets_info%20account_asset_read%20asset_
https://account.docusign.com/oauth/auth?client_id=9f87e104-a483-405b-ab66-d0bcad57bf62&scope=signature%20admin_consent%20manage_app_keys%20connect_hmac_api%20user_read%20account_read%20user_write%20cors_manage%20manage_system_signing_groups%20account_write%20admin_communication_read%20admin_communication_write%20organization_write%20organization_read%20account_product_read%20group_management_read%20group_management_write%20me_profile%20search_read%20search_write%20organization_data_feed_config_read%20organization_data_feed_config_write%20organization_monitor_config_read%20organization_monitor_config_write%20organization_monitor_events_read%20notary_read%20notary_write%20click.manage%20service_protection_limit_manage_api%20eis_subscriptions_read%20eis_subscriptions_write%20provision_asset_group_account_read%20provision_asset_group_read%20provision_asset_group_account_clone_read%20provision_asset_group_account_clone_write%20act_read%20act_write%20valmod_manage%20account_assets_info%20account_asset_read%20asset_