Edit tour

Windows Analysis Report
https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a

Overview

General Information

Sample URL:	https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a
Analysis ID:	1538484

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=1944,i,15766038114611442975,6622158521713803456,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6596 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.100.72:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.100.72:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49745 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.100.72
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.76
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.76
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.76
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: global traffic	DNS traffic detected: DNS query: eu.docusign.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.100.72:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.100.72:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49745 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@16/18@10/50

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=1944,i,15766038114611442975,6622158521713803456,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=1944,i,15766038114611442975,6622158521713803456,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.186.132	true	false	unknown
eu.docusign.net	unknown	unknown	false	unknown
docucdn-a.akamaihd.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://eu.docusign.net/Signing/Error.aspx?e=2bc40c4c-42f4-41a3-ab10-b43acba97a92&scope=f5acd408-933f-44fb-8be4-1fd9f8354c81&la=en-GB	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
2.16.164.115	unknown	European Union	20940	AKAMAI-ASN1EU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.19.126.140	unknown	European Union	16625	AKAMAI-ASUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
185.81.100.28	unknown	Germany	62856	DOCUS-6-PRODUS	false
216.58.206.35	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538484
Start date and time:	2024-10-21 11:51:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@16/18@10/50

Warnings

Exclude process from analysis (whitelisted): TextInputHost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.35, 142.250.184.206, 142.250.110.84, 185.81.100.28, 34.104.35.123, 2.16.164.115, 2.16.164.83
Excluded domains from analysis (whitelisted): eu.docusign.net.akadns.net, a1737.b.akamai.net, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, eu-northeast.docusign.net.akadns.net, clientservices.googleapis.com, clients.l.google.com, docucdn-a.akamaihd.net.edgesuite.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a

LLM Input / Output

Input	Output
URL: https://eu.docusign.net/Signing/Error.aspx?e=2bc40c4c-42f4-41a3-ab10-b43acba97a92&scope=f5acd408-933f-44fb-8be4-1fd9f8354c81&la=en-GB Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "To continue, request a new link or log in to your Docusign account", "prominent_button_name": "SEND NEW LINK", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://eu.docusign.net/Signing/Error.aspx?e=2bc40c4c-42f4-41a3-ab10-b43acba97a92&scope=f5acd408-933f-44fb-8be4-1fd9f8354c81&la=en-GB Model: claude-3-haiku-20240307	```json { "brands": [ "Docusign" ] }
	```json { "brands": [ "Docusign" ] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:51:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9870927552862017
Encrypted:	false
SSDEEP:
MD5:	7DD80E15EF595F24A626D42C6C2D6AD9
SHA1:	7E68CE0F0467E5E92F60C3B900E54260F214F1C7
SHA-256:	EEEA45B8C645F97F65D531D834B6AACA3B3AE5B59D77E2B71AA0E235A0F7ACC5
SHA-512:	8519711ADE1A064F6AC720AA4307F7BE1CC8D1FE7B7ACAA6B2F660CE1BA8BD68A703CE40BE8A5BCC42DE8D06C77B44CFF79A7012F898DE3E0E0B5C813753F317
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....&...#......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYoN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUYwN....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUYwN....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUYwN...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VUYxN...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ay......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:51:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002768439961206
Encrypted:	false
SSDEEP:
MD5:	B7816EBDF4E3D542EC2EF78990CCECAE
SHA1:	0E67F74FA38A2CF824B5B77284D3726B23ADE211
SHA-256:	B220E98E6371D10BCC4AF3A4014EB6763B1613528B787CE884BB54619C8A3CE5
SHA-512:	2CAB99D8D08EEC674F5AA6B8A96FD395A71AE41BC31F19548A6DD266EBF96A1CB08AADEAF87680B7C247B1F415B167B303AD909D1AC1138A53339B6B01E657FE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....T..#......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYoN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUYwN....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUYwN....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUYwN...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VUYxN...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ay......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.01182942499489
Encrypted:	false
SSDEEP:
MD5:	EE59AA0725AAD09A397EC0424F1C4BD1
SHA1:	AD7826FCE3DB6423E3B98F8E33B57BD0C9B0C4DF
SHA-256:	AC21DB16E35A804DEB850C52DB39033CC6756A28CEB9198285C7E0F7D2AC7A8A
SHA-512:	3D6BD32493E43804622FF937C6A66A957CC5B3D1DC30B2A588CAE039043FB42712ED972CBA08FF4524E92CE858A33FB2263F2216295CBC24A77D2F5A9BEFC686
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYoN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUYwN....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUYwN....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUYwN...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ay......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:51:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.00181023285541
Encrypted:	false
SSDEEP:
MD5:	2E960C08C98222463185780B9F0CC927
SHA1:	98776802A8334CAC81623336A1C03743CFA78BE8
SHA-256:	DCBCB8636C9E928878DD174D7888719B6F7B4333037CE15CE2FD9F18972CC22A
SHA-512:	A1D0E3EFCDA2A5A2B203A492CC300057C7F8A935D7A44D6B5F30258389C164B458CB45F74C8C785A4B81E5980CCA1408303BB09EB745CE47C0C845BCBCDAE968
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........#......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYoN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUYwN....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUYwN....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUYwN...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VUYxN...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ay......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:51:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.991932945773511
Encrypted:	false
SSDEEP:
MD5:	15512ADE7DD077EED3F3635CA3A48E3F
SHA1:	B9830984B1A390EB83784BA48294F58BC5AA63B0
SHA-256:	4A9F946B5D761DFCC87109B2AC957FD64DB7002BEBF45A93D9181760D2084F98
SHA-512:	92208CEC0EBAF0C731E232BDF47A493261C0E65D8E4EE833ACFDA4E8209141541A886A2886FB2254E065831A8D680742274B324F9B5B9B05DF2CA410B6A25DEF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......#......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYoN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUYwN....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUYwN....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUYwN...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VUYxN...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ay......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:51:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.002946425734543
Encrypted:	false
SSDEEP:
MD5:	B7C5282CE4C932A33E40B35FFBAEB61C
SHA1:	D44B2E5CB0B80C49B75FAEA9ECF4972241AFD08C
SHA-256:	BA864BA3066C27F1159175F6E06D46E376E4E5A146BF48AC2C5786978D30BAB1
SHA-512:	384922F19A1F99C26C5986B2C7C775B78E4F9BD08EF667ED1821449B06F4688671F2892378F4A6F58F0943AE8660609B95CA592F8E5B55C7794C29492FF4DBBC
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....._..#......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IUYoN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUYwN....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VUYwN....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VUYwN...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VUYxN...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Ay......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4739
Entropy (8bit):	4.736490039075709
Encrypted:	false
SSDEEP:
MD5:	4B86605C4B80FA75342703878E7DFF13
SHA1:	6EF59F904C58E88B3E143BA3DA464AFE63FDC188
SHA-256:	2F186CDFA13B6CA51F69D44BAC8A7D5B69E1D5409A68D21F5768A87C6DFDB3A1
SHA-512:	B493241426AB5A1B75D1455720E84AB27A2B7E176FDF782ECB14B26004F5553FD306DCAE14C17CE788891FDBCAE9A32A5E22CB187C6BCE66486B89A0E5028AD9
Malicious:	false
Reputation:	unknown
URL:	https://eu.docusign.net/Signing/StyleSheets/Framework.css
Preview:	/-----------------------/..../* needs brackets to swallow error on dev /..{..}..../ This file contains the styles needed for the 2014 rebrand /..html {.. / Prevent font scaling in landscape while allowing user zoom /.. / Use 100% here, NEVER none. See http://blog.55minutes.com/2012/04/iphone-text-resizing/ /.. -webkit-text-size-adjust: 100%;..}..body {.. margin: 0;.. background-image: none;.. background-color: #EAEAEA;.. font-family: "Helvetica Neue", Arial, sans-serif !important;..}...Header {.. display: none;..}...scroll-area {.. position: absolute;.. overflow: auto;.. overflow-x: hidden;.. top: 0;.. left: 0;.. right: 0;.. bottom: 0;.. min-width: 1024px;..}...scroll-area, .Border.scroll-area {.. overflow-x: auto;..}...scroll-container {.. border-bottom: none;.. position: static;..}...clear {.. clear: both;..}..../ site content - centered w/ max-width and padding */...site-content {.. margin: 0 auto;.. max-wid

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2961
Entropy (8bit):	7.876188909726169
Encrypted:	false
SSDEEP:
MD5:	C863DB426897325CB4805B2C20F51F30
SHA1:	A426FE43F0CE1A489CE091CC27768CDCC2991210
SHA-256:	2A5179B8851C8E3DFC77D7DCB33B3963AFA037608336D6AE412ACAA38AD59D22
SHA-512:	90DA76303CDE0B81F183709D94DC96B5C3EA7B7766948AF5B81E1EBE4B887012FC611F6A0CFC50873E80AF7B73077F7CB8BD5F254A4F4848C632A68733522A68
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............2.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0..z..0... ..Q.f......Ml..@D...E......H..b!(.`.H.Pb0...dF.J\|yy.......g.s..{....$O../... .'..z8.W.G....x....0Y.A..@$/7.z........H..e..O...O.T...._..lN:K.."N.....3"..$..F../JP.rb.[.}..Q..d.[..S..l1..x{..#b.G...\N..o.X3I....[ql2.....$..8.x.......t..r.p../8...p...C...f.q....K.njm.{r2.8...?......).L^6..g.,.qm."[.Z[Z....~Q....7%.."....3......R..`.j...[.~.:.. w....!.$E}k...yh.y...Rm..333..........:..}.=#.v.....e...tq.X)I)B>==......<..8..X....9<QD.h..8Q.yl....sy....0.OZ.k.(...5..H....>.....yP..........:.8......p.........Lg....k.k...$.......t.!0.V..8.7....`.........2A....@.....JP..A#h.'@.8.....:....`....`......a!2D..!UH.2.. .d..A>P ..ECq...B.......Z....:.]..B..=h...~....L...2...........5p.......N..........:\|......@...QC.....!.H,.G6 .H9R.. ]H/r..A..w(......Q.(OT...JCm@..QGQ...-.(j...MF+...6h/.t.:.]..G7....w...7......Xa<1..

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3896
Entropy (8bit):	4.786686051422741
Encrypted:	false
SSDEEP:
MD5:	855476199961A10981ADCA7432CEC048
SHA1:	7995725A0CAC73EB6A2A1B5A8D5B162DBF47988E
SHA-256:	6DD60FAA0E35F2DFE342C452ED414A084D384D11793BD0F0EB03C2B1C6F1405C
SHA-512:	A9E61582FA18BCC1DD57DE8A7C194BAB0D6F733897F541A6E13B94906ADC115D65004F5A2649919FA8B8545F0C67C9313A14EAEAF42C34F630DA13CD38E17994
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1200 241.4" style="enable-background:new 0 0 1200 241.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#FFFFFF;}...st1{fill:#4C00FF;}...st2{fill:#FF5252;}.</style>.<g>..<g>...<g>....<path class="st0" d="M1169.2,109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9,10.5-27.7,28.1c-0.8,4.2-1,10.7-1,24.4.....v48.8H1060v-125h25.6c0.1,1.1,0.7,12.3,0.7,13c0,0.9,1.1,1.4,1.8,0.8c10.6-8.4,22.3-16.2,38.6-16.2.....C1153.5,60.9,1169.2,79,1169.2,109.7z"/>....<path class="st0" d="M1013.4,63.4l-0.9,14.3c-0.1,0.9-1.2,1.4-1.8,0.8c-3.5-3.3-16.4-17.5-38.3-17.5c-31.4,0-54.5,27.1-54.5,63.9.....l0,0c0,37.3,22.9,64.5,54.5,64.5c21.1,0,34-13.7,36.4-16.7c0.7-0.8,2-0.3,2,0.7c-0.3,3.8-0.8,13.3-4,21.4.....c-4,10.2-13,19.7-31.1,19.7

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, CFF, length 33752, version 0.0
Category:	downloaded
Size (bytes):	33752
Entropy (8bit):	7.984139047245452
Encrypted:	false
SSDEEP:
MD5:	4DE7535F6F5DF8D5437C21C068DDB0EC
SHA1:	3553204B4624CA41CF1C4F3BD9B37D8C968CBA23
SHA-256:	8F6A520A392FF62149E5FC5AA87BFAB9B3816CD6010D4D4FCA194E8683CA498B
SHA-512:	E2A9B45F69BD1CBCF0D5F3710BECFACF6A28AF0A9FD034262F6AF4803628DADCE4C2FCC385758F88130AB68D362F3694ED786D0971CF7FD7E8FAF6CD1C2860DE
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.9.37-8/fonts/maven-pro/MavenPro-Bold.woff
Preview:	wOFFOTTO...........x........................CFF ......Om......FFTM...h........Z...GDEF..T........ ....GPOS..TH..-....DiP}7GSUB..T(... ... l.t.OS/2.......H...`...Ccmap.......\|....#G..head...0...3...6....hhea...d... ...$.U.>hmtx.......Q...X.Xl7maxp..............P.name.......4....N...post........... .j.fx.c`d```d8...l<..W.n...8..2.F.../..)...:..&.(..v...x.c`d``../........g.2.EP.5.......P.....x.c`b.......u..1...<.f........p...).,fP`P...._....N.u05..X.@r.L.GP..x.m.1O.A.....(...XL...K....+.[...-..@.A....6..K...e#.x..\|.......^.p..PzV...s...=7q.O..z..+.xn.R=Q.....m.Y.......s..><........6n..c.lq@..klPC.....!".,AJ.`N.e.&.L....F..7g..&..w<.J...P..M-..@.Q.Kz.yn.)dRg...B..J...v:....gR.vFC..N.2....PF0..=.)V.,..{..LY.g"...;9..]p..2n!f....IW67..a.%.mO..-......iXax.c```f.`..F..8..1..,..........P..a)........L..(.(H).)().)X).QTz..........@....1.AU.+H(.UZBU2.................n...}.`...V=X.`.I...Q8.z....#..A.L.,.l...\.<.\|...B.".b...R.2.r...J..j...Z.:.z...F.&.f...V.6.v...N...n...

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 643 x 261, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	13702
Entropy (8bit):	7.8986608011417285
Encrypted:	false
SSDEEP:
MD5:	5CC1977B21BF780731B87028942FFD6D
SHA1:	80D7113EF2323BC839FC79BF43FD37C4D7E03993
SHA-256:	CDFA2C94A06FA985649F2853A1D1BC2C64CD1B487B5EB6EBB2DCFAAEA5DE2FB9
SHA-512:	601E493D5ED694D50897B17E37BE93C37A63FC4DB15E07ACE8CE1F693EDC44370061729D0C5671D5D96D6A9D7205FA7237FE00BC8E7CB50AB0BDBFB132D48962
Malicious:	false
Reputation:	unknown
URL:	https://eu.docusign.net/Signing/Images/linkExpired/linkExpired.png
Preview:	.PNG........IHDR...............z.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.6..c...4.IDATx^....\U..q...O.......#v...~PZD..Z..RV...PQA.T.@E....b.[..kh...t.-]i-.{..i.f.d&3...%....4L'..{g.9....q.J'...9'..;...DDDT>,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN,1..Q9..DDD........KLDDTN.....K.'"..KL..\.DD.`......,1Q.r....%&.C.{""{..Dy.uODd...(........!.=..=Xb.<.'"..KL..\.DD.`......,1Q.r....%&.C.{""{..Dy.uODd...(.........zzz".H4...b.x<.L.t.t.u...8..3.[...v\..J^(..KL..\.De.......Ot./......q.."\..b...(...J%...h.].Q.Le.....l..,..KL..\.D6C.b.X..1T.6.....JVS......-.Fmmmr..K.{"......'.H..)......._b.....p.....F....Yr..I.{"...~g..?.d. .G."...8 nll..O.#W...={N.<)'..'*..S(...."f...?..S..D....0...F8&f....@$.Q.1`..G...{...J.c...s.....q.`..7.+.....A.....Xb.&..P(..G.....wY.....Xb. /78..Q(;............y..d/..<"..`?&.C.....a..^,1yA$.....pC...8..g.....g....~....g.P..;.6.....5.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	dropped
Size (bytes):	89797
Entropy (8bit):	5.291128696884303
Encrypted:	false
SSDEEP:
MD5:	954F70F07F05742168ADCEBA796DDA72
SHA1:	EDF8A6A066F201B1FFAD32C585BD79C9982D4433
SHA-256:	4DA87C258ECA460D39CDB0F6158CBF69AF539D05A1D14F1BC011518511D02228
SHA-512:	66EE57172810E0002C308C1FD5FC008C1C64573602627CA0313D97742D830C72BB7D26DD3B069E1835C5E3D6F8721F856809EB9CCEF18CE8934FF7758F645717
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}func

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	788
Entropy (8bit):	4.9019698351522845
Encrypted:	false
SSDEEP:
MD5:	CB4FD3AF4DEEBD7277FCD75A576BF633
SHA1:	71A7BC5DE0F92581F2A9F8DCED86578E01B4856C
SHA-256:	F6C29AE65E37D866FEFB836DB488C4D044414798EC995B2B69CD067949938DD9
SHA-512:	1507C60248859484296F0CF5D1D0AB73BA4B2522A8D05C37773E45AE57C381BFC1FBFC1E38C2F1EE4DB626C1E4AF8C973B38FAD6C5FD74A4423FD78CFEE47E85
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.9.37-8/css/font-faces.css?cs=7aa34814
Preview:	/ mix ins /..list-no-style {. list-style: none;. padding-left: 0;.}.@font-face {. font-family: 'Maven Pro';. src: url('../fonts/maven-pro/MavenPro-Regular.eot');. src: url('../fonts/maven-pro/MavenPro-Regular.eot?#iefix') format('embedded-opentype'), url('../fonts/maven-pro/MavenPro-Regular.woff') format('woff'), url('../fonts/maven-pro/MavenPro-Regular.ttf') format('truetype');. font-weight: normal;. font-style: normal;.}.@font-face {. font-family: 'Maven Pro';. src: url('../fonts/maven-pro/MavenPro-Bold.eot');. src: url('../fonts/maven-pro/MavenPro-Bold.eot?#iefix') format('embedded-opentype'), url('../fonts/maven-pro/MavenPro-Bold.woff') format('woff'), url('../fonts/maven-pro/MavenPro-Bold.ttf') format('truetype');. font-weight: bold;. font-style: normal;.}.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, CFF, length 34820, version 0.0
Category:	downloaded
Size (bytes):	34820
Entropy (8bit):	7.982902826695778
Encrypted:	false
SSDEEP:
MD5:	FD117C9EB999E35D64BE1515D5B2192D
SHA1:	B0FAE4091AC17A28C47AF531A9D5B73B4C35F6BD
SHA-256:	553582BE8A5D2779D1A9E9C3A6698FD4D365E01353D8876A7204DB68FCD1D12D
SHA-512:	24D51DBAFDE7E5B7B1486BA3800BC8ECBAF369A2D28BBBF15096C723DC565247F9B956E8D0F28EDB535313E1B26934DFC30AF0AF700B8CB57F02926B889B2177
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.9.37-8/fonts/maven-pro/MavenPro-Regular.woff
Preview:	wOFFOTTO...........<........................CFF ......S....{..."FFTM............Z...GDEF..X4....... ....GPOS..Xt..-....DiP}7GSUB..XT... ... l.t.OS/2.......I...`.[.8cmap.......\|....#G..head...0...3...6.h..hhea...d.......$....hmtx.......Q...X.xm.maxp..............P.name.......=...1.E.Lpost........... .j.fx.c`d```d8R!.0...+.7.....\|Y...o.....v...``....MM...x.c`d``../.H.....1.F..............P.....x.c`b..8.....u..1...<.f........p...).,fp`P...._......u05..X.......,......x.m.1O.@....aP.......K.B.N..&.......^...\......G../.Dc....{....\.......c.....p...u.c.W..q....q...2...gY.g.k.8...w.u.c...9n.Vu.7q..1...[.H.`...6..p."@...L.&.X....Cfg.I}..+..[.4G.q..>..Yn.4Y..v.....[...L...~.I..Rh.......Q%..Qh...u...8.N....q.c......z.9.9.....&/O...h..mR=..........ljr.. ......T....Sw`....x.c```f.`..F..8..1..,..........P..a)........L..(.(H).)().)X).QTz..........@....1.AU.+H(.UZBU2.................n...}.`...V=X.`.I...Q8.z....#..A.L.,.l...\.<.\|...B.".b...R.2.r...J.*.j...Z.:.z...F.&.f...

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13479), with CRLF line terminators
Category:	dropped
Size (bytes):	13579
Entropy (8bit):	5.27337657330958
Encrypted:	false
SSDEEP:
MD5:	2779F5D2F1F22353C726240E530016CC
SHA1:	2B3F380F212C8C64E79DB1F47FA25C114AFE6FBB
SHA-256:	16496529F57AC8915F194E00479B04AF942C33D7897BCFD9A55DD072BBEC1411
SHA-512:	14F4E6DB8D21EFA0A01DFE6AC5C6941807B3DA8875864D736476D480167A9C7B02E60E8BE19CC2F9526B3027684661F5B11D36D3A9D44096DF86B120AF8904E6
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],a=1;a<=3;a++){if(+o[a]<+n[a])return 1;if(+n[a]<+o[a])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.4.1";var t=Object.create(null);s.migrateDisablePatches=function(){for(var e=0;e<arguments.length;e++)t[arguments[e]]=!0},s.migrateEnablePatches=function(){for(var e=0;e<arguments.length;e++)delete t[arguments[e]]},s.migrateIsPatchEnabled=function(e){return!t[e]},n.console&&n.console.log&&(s&&e("3.0.0")&&!e("5.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.x-4.x REQUIRED"),s.migrateWarning

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2048
Entropy (8bit):	4.886793296383126
Encrypted:	false
SSDEEP:
MD5:	3165AF715E6BA5CA2B00F9AB5277CC8C
SHA1:	99697540AAC85B979624E1A09483418A4C30BD11
SHA-256:	08034C30A67418DD7BFF599A0EA4ECB87315D485ADB3BD1774AFC36B33705317
SHA-512:	9B62C145664DA8EE0C6B8C719B7468848F1E1F87CBD9DAFBBF878FCCE9F72E5569A7FCA13C01FC408ADB6B8C5B4F2393BBB93B5077BA02CA816C2DE7937EFA5E
Malicious:	false
Reputation:	unknown
URL:	https://eu.docusign.net/Signing/StyleSheetsDev/ErrorExpired.css
Preview:	..btn {.. background: #111;.. border: 1px solid #111;.. border-radius: 2px;.. cursor: pointer;.. color: #fff;.. display: inline-block;.. font-family: "Maven Pro","Helvetica Neue",HelveticaNeue,Helvetica,Arial,sans-serif;.. font-size: 12px;.. letter-spacing: .6px;.. line-height: 1;.. min-width: 55px;.. margin: 0;.. padding: 7px 14px;.. position: relative;.. text-align: center;.. text-decoration: none!important;.. text-transform: uppercase;.. font-weight: bold;..}.....btn-main, .btn-main.disabled:hover, .btn-main[disabled]:hover {.. background: #ffc820;.. border-color: #ffc820;.. color: #333;..}.....btn-lg {.. font-size: 14px;.. padding: 9px 18px;..}.....expireActionDiv {.. float: left;.. width:50%;..}.....expireActionDiv .newLink {.. margin-left: 50px;..}.....expireActionAccountless{.. text-align: center;..}.....expireActionAccountless .newLink{..}.....freshLink {.. margin-top: 10px;..}.....expireActio

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	326
Entropy (8bit):	6.860674885804344
Encrypted:	false
SSDEEP:
MD5:	AFE00DB89CE086B91A541C227EDBF136
SHA1:	961B2EE6FB39C4D515BDC49EC1BA688B0916F104
SHA-256:	E11827C678AF8519E702F364E525AC34509CAD49F8D839677E089949EDDA060E
SHA-512:	85F265A917E83BA92FEDB2152FBFADA273FCFF2937A85B080641307FD2E61D0138493162883E016796C9F68062A01D79DA60F546EFC2CB1FB4078760EB3451F0
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-icons-favicon-default-16x16.png
Preview:	.PNG........IHDR................a....pHYs.................sRGB.........gAMA......a.....IDATx.....0...Uq...UP.\|..v.K.>.O`.$.[.B....'pvJ}..B..P.h...I.!.rs.%.$....O"r!.I.m....J..........U.. ..F[.....j4<...6.b6.T!x..Y..]..;._.,..........K.F..b.~.$..M.......M....,...i....*.z...x8."C.r.{.2~.~........x...B.G.6.....IEND.B`.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3728
Entropy (8bit):	4.718277261919778
Encrypted:	false
SSDEEP:
MD5:	EC396047518A7FEF11D53D1B4F6BE65B
SHA1:	E3BEC4CDAF5567641517A23019ADBFA2328B0A7F
SHA-256:	8F77CFC832517C619BC1B8D82A6A478EE18D97442B4C78B006B0286CEC91E1A8
SHA-512:	34AD62B5CC5EE5C950F340D65800102AE1CD06D34D24A611E7AC2CB9F23308AC96AC669D3B226C258DC6F862D985030EC3D5BB29609ECFEDF34E14F8F48529EB
Malicious:	false
Reputation:	unknown
URL:	https://docucdn-a.akamaihd.net/olive/images/2.63.0/global-assets/ds-logo-default.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 28.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1200 241.4" style="enable-background:new 0 0 1200 241.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#4C00FF;}...st1{fill:#FF5252;}.</style>.<g>..<g>...<g>....<path d="M1169.2,109.7v78.7h-28.9v-73.5c0-17.9-7.7-27.9-22.7-27.9s-24.9,10.5-27.7,28.1c-0.8,4.2-1,10.7-1,24.4v48.8H1060v-125.....h25.6c0.1,1.1,0.7,12.3,0.7,13c0,0.9,1.1,1.4,1.8,0.8c10.6-8.4,22.3-16.2,38.6-16.2C1153.5,60.9,1169.2,79,1169.2,109.7z"/>....<path d="M1013.4,63.4l-0.9,14.3c-0.1,0.9-1.2,1.4-1.8,0.8c-3.5-3.3-16.4-17.5-38.3-17.5c-31.4,0-54.5,27.1-54.5,63.9l0,0.....c0,37.3,22.9,64.5,54.5,64.5c21.1,0,34-13.7,36.4-16.7c0.7-0.8,2-0.3,2,0.7c-0.3,3.8-0.8,13.3-4,21.4c-4,10.2-13,19.7-31.1,19.7.....c-14.9,0-28.1-5.7-40.6-17.9L920,217.3c13.7,15.5,35

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 75

Chrome Cache Entry: 77

Chrome Cache Entry: 80

Chrome Cache Entry: 82

Chrome Cache Entry: 84

Static File Info

Windows Analysis Report
https://eu.docusign.net/Signing/EmailStart.aspx?a=282f8be7-f0da-4f2d-ae22-4f00b0ed1117&etti=43&r=04bd4ca4-2771-46aa-b9e0-2ac24c9a604a