Windows Analysis Report
https://e3ydjw2x2r2.larksuite.com/docx/BIdMdS37KokrskxNV0nuvCuRsVE?from=from_copylink

Overview

General Information

Sample URL: https://e3ydjw2x2r2.larksuite.com/docx/BIdMdS37KokrskxNV0nuvCuRsVE?from=from_copylink
Analysis ID: 1384183
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Creates files inside the system directory
Stores files to the Windows start menu directory
Uses insecure TLS / SSL version for HTTPS connection

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://e3ydjw2x2r2.larksuite.com/docx/BIdMdS37KokrskxNV0nuvCuRsVE?from=from_copylink SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49846 version: TLS 1.0
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49837 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:50232 version: TLS 1.2
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49846 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.8.114
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HDNwm3LhpoMyhvN&MD=59rRZlOL HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-drive-quic.larksuite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://e3ydjw2x2r2.larksuite.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://e3ydjw2x2r2.larksuite.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-docs-quic.larksuite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://e3ydjw2x2r2.larksuite.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://e3ydjw2x2r2.larksuite.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-drive-quic.larksuite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: swp_csrf_token=81f09437-e540-4a75-b3ea-fcae954a8cac; t_beda37=f703a093ac319bd9badd0790b0a03201eed5b1bf12385268a1508e8ad719a373; passport_web_did=7330283375955034117; QXV0aHpDb250ZXh0=9abafd2191554938a0a49a7bf7137390; session=U7CK1RF-748j9814-a19e-42db-95a4-2f63ec83debl-NN5W4; sl_session=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MDY3NTc3OTcsInVuaXQiOiJldV9lYSIsInJhdyI6eyJtZXRhIjoiQVdXNlplU2dnQUFHWmJwbDVLREJBQVZsdW1Ya2xzQkFCV1c2WmVTV3dFQUZaYnBsNUpiQVFBVUNBUUlCUVVGQlFVRkJRVUZCUVVac2RXMVlhelIzUWtGQ1VUMDkiLCJpZGMiOlsxLDJdLCJzdW0iOiJiYzYyYjk4OTE4NDRiMjE4YWQzOTBkMDNmYzVlNmVhNWQ1N2NlMzk0ZjlhZTk2MGJhOTZiNTkzMjU4N2Y4NWJiIiwibG9jIjoiZW5fdXMiLCJhcGMiOiIiLCJpYXQiOjE3MDY3MTQ1OTcsInNhYyI6bnVsbCwibG9kIjpudWxsLCJucyI6ImxhcmsiLCJuc191aWQiOiI3MzMwMjgzMzc2MTE4NTk1NTkwIiwibnNfdGlkIjoiNzMzMDI4MzM3NjEyMjg1NTQyOSIsIm90IjoxfX0.QZD9_dQZfBQ29LQOpdWxj5hYIb29KaHhncNiaIbcZ1jlWCMLE8rvgDo1ek5xQyn2gVbYK0ZGAR7qB39SHTQtCg; is_anonymous_session=1; lang=en; __tea__ug__uid=8917381706714599739; _csrf_token=e664094b3b4e21115e13b76cd964449c8de1de70-1706714601
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-docs-quic.larksuite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: swp_csrf_token=81f09437-e540-4a75-b3ea-fcae954a8cac; t_beda37=f703a093ac319bd9badd0790b0a03201eed5b1bf12385268a1508e8ad719a373; passport_web_did=7330283375955034117; QXV0aHpDb250ZXh0=9abafd2191554938a0a49a7bf7137390; session=U7CK1RF-748j9814-a19e-42db-95a4-2f63ec83debl-NN5W4; sl_session=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MDY3NTc3OTcsInVuaXQiOiJldV9lYSIsInJhdyI6eyJtZXRhIjoiQVdXNlplU2dnQUFHWmJwbDVLREJBQVZsdW1Ya2xzQkFCV1c2WmVTV3dFQUZaYnBsNUpiQVFBVUNBUUlCUVVGQlFVRkJRVUZCUVVac2RXMVlhelIzUWtGQ1VUMDkiLCJpZGMiOlsxLDJdLCJzdW0iOiJiYzYyYjk4OTE4NDRiMjE4YWQzOTBkMDNmYzVlNmVhNWQ1N2NlMzk0ZjlhZTk2MGJhOTZiNTkzMjU4N2Y4NWJiIiwibG9jIjoiZW5fdXMiLCJhcGMiOiIiLCJpYXQiOjE3MDY3MTQ1OTcsInNhYyI6bnVsbCwibG9kIjpudWxsLCJucyI6ImxhcmsiLCJuc191aWQiOiI3MzMwMjgzMzc2MTE4NTk1NTkwIiwibnNfdGlkIjoiNzMzMDI4MzM3NjEyMjg1NTQyOSIsIm90IjoxfX0.QZD9_dQZfBQ29LQOpdWxj5hYIb29KaHhncNiaIbcZ1jlWCMLE8rvgDo1ek5xQyn2gVbYK0ZGAR7qB39SHTQtCg; is_anonymous_session=1; lang=en; __tea__ug__uid=8917381706714599739; _csrf_token=e664094b3b4e21115e13b76cd964449c8de1de70-1706714601
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-docs-quic.larksuite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://e3ydjw2x2r2.larksuite.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://e3ydjw2x2r2.larksuite.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-drive-quic.larksuite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://e3ydjw2x2r2.larksuite.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://e3ydjw2x2r2.larksuite.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-drive-quic.larksuite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: passport_web_did=7330283375955034117; QXV0aHpDb250ZXh0=9abafd2191554938a0a49a7bf7137390; session=U7CK1RF-748j9814-a19e-42db-95a4-2f63ec83debl-NN5W4; sl_session=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MDY3NTc3OTcsInVuaXQiOiJldV9lYSIsInJhdyI6eyJtZXRhIjoiQVdXNlplU2dnQUFHWmJwbDVLREJBQVZsdW1Ya2xzQkFCV1c2WmVTV3dFQUZaYnBsNUpiQVFBVUNBUUlCUVVGQlFVRkJRVUZCUVVac2RXMVlhelIzUWtGQ1VUMDkiLCJpZGMiOlsxLDJdLCJzdW0iOiJiYzYyYjk4OTE4NDRiMjE4YWQzOTBkMDNmYzVlNmVhNWQ1N2NlMzk0ZjlhZTk2MGJhOTZiNTkzMjU4N2Y4NWJiIiwibG9jIjoiZW5fdXMiLCJhcGMiOiIiLCJpYXQiOjE3MDY3MTQ1OTcsInNhYyI6bnVsbCwibG9kIjpudWxsLCJucyI6ImxhcmsiLCJuc191aWQiOiI3MzMwMjgzMzc2MTE4NTk1NTkwIiwibnNfdGlkIjoiNzMzMDI4MzM3NjEyMjg1NTQyOSIsIm90IjoxfX0.QZD9_dQZfBQ29LQOpdWxj5hYIb29KaHhncNiaIbcZ1jlWCMLE8rvgDo1ek5xQyn2gVbYK0ZGAR7qB39SHTQtCg; is_anonymous_session=1; lang=en; __tea__ug__uid=8917381706714599739; _csrf_token=e664094b3b4e21115e13b76cd964449c8de1de70-1706714601; swp_csrf_token=87d78a20-31d0-4dea-8938-f5faaef217e7; t_beda37=eddc6ddfdc07e7e1c053ada301d0399e74ee2c33bb7debd91da5a051f100af15
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-docs-quic.larksuite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: passport_web_did=7330283375955034117; QXV0aHpDb250ZXh0=9abafd2191554938a0a49a7bf7137390; session=U7CK1RF-748j9814-a19e-42db-95a4-2f63ec83debl-NN5W4; sl_session=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MDY3NTc3OTcsInVuaXQiOiJldV9lYSIsInJhdyI6eyJtZXRhIjoiQVdXNlplU2dnQUFHWmJwbDVLREJBQVZsdW1Ya2xzQkFCV1c2WmVTV3dFQUZaYnBsNUpiQVFBVUNBUUlCUVVGQlFVRkJRVUZCUVVac2RXMVlhelIzUWtGQ1VUMDkiLCJpZGMiOlsxLDJdLCJzdW0iOiJiYzYyYjk4OTE4NDRiMjE4YWQzOTBkMDNmYzVlNmVhNWQ1N2NlMzk0ZjlhZTk2MGJhOTZiNTkzMjU4N2Y4NWJiIiwibG9jIjoiZW5fdXMiLCJhcGMiOiIiLCJpYXQiOjE3MDY3MTQ1OTcsInNhYyI6bnVsbCwibG9kIjpudWxsLCJucyI6ImxhcmsiLCJuc191aWQiOiI3MzMwMjgzMzc2MTE4NTk1NTkwIiwibnNfdGlkIjoiNzMzMDI4MzM3NjEyMjg1NTQyOSIsIm90IjoxfX0.QZD9_dQZfBQ29LQOpdWxj5hYIb29KaHhncNiaIbcZ1jlWCMLE8rvgDo1ek5xQyn2gVbYK0ZGAR7qB39SHTQtCg; is_anonymous_session=1; lang=en; __tea__ug__uid=8917381706714599739; _csrf_token=e664094b3b4e21115e13b76cd964449c8de1de70-1706714601; swp_csrf_token=87d78a20-31d0-4dea-8938-f5faaef217e7; t_beda37=eddc6ddfdc07e7e1c053ada301d0399e74ee2c33bb7debd91da5a051f100af15
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HDNwm3LhpoMyhvN&MD=59rRZlOL HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000003AC474551C HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: unknown DNS traffic detected: queries for: e3ydjw2x2r2.larksuite.com
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
Source: chromecache_449.1.dr, chromecache_392.1.dr String found in binary or memory: http://github.com/jonnyreeves/js-logger
Source: chromecache_449.1.dr, chromecache_392.1.dr String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_449.1.dr, chromecache_392.1.dr String found in binary or memory: http://jonnyreeves.co.uk/
Source: chromecache_449.1.dr, chromecache_392.1.dr String found in binary or memory: http://oli.me.uk/
Source: chromecache_449.1.dr, chromecache_392.1.dr String found in binary or memory: http://sheetjs.com
Source: chromecache_572.1.dr String found in binary or memory: http://underscorejs.org/LICENSE
Source: chromecache_449.1.dr, chromecache_392.1.dr String found in binary or memory: http://unlicense.org/
Source: chromecache_449.1.dr, chromecache_423.1.dr, chromecache_442.1.dr, chromecache_433.1.dr, chromecache_420.1.dr, chromecache_376.1.dr, chromecache_519.1.dr, chromecache_443.1.dr, chromecache_392.1.dr, chromecache_427.1.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_598.1.dr, chromecache_456.1.dr, chromecache_451.1.dr, chromecache_537.1.dr, chromecache_560.1.dr, chromecache_506.1.dr String found in binary or memory: https://applink.feishu.cn/client/web_url/open?width=640&height=480&mode=window&url=https%3A%2F%2Flin
Source: chromecache_544.1.dr String found in binary or memory: https://bytedance.feishu.cn/space/doc/doccnk4EDKrgoRjruOWlv0mb0cf
Source: chromecache_449.1.dr, chromecache_423.1.dr, chromecache_433.1.dr, chromecache_366.1.dr, chromecache_392.1.dr, chromecache_478.1.dr String found in binary or memory: https://feross.org
Source: chromecache_478.1.dr String found in binary or memory: https://feross.org/opensource
Source: chromecache_519.1.dr, chromecache_443.1.dr String found in binary or memory: https://github.com/emn178/js-htmlencode
Source: chromecache_574.1.dr, chromecache_597.1.dr, chromecache_366.1.dr, chromecache_478.1.dr String found in binary or memory: https://jquery.com/
Source: chromecache_574.1.dr, chromecache_597.1.dr, chromecache_366.1.dr, chromecache_478.1.dr String found in binary or memory: https://jquery.org/license
Source: chromecache_574.1.dr, chromecache_572.1.dr, chromecache_597.1.dr, chromecache_366.1.dr, chromecache_478.1.dr String found in binary or memory: https://js.foundation/
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/011c0865bf2a4dbdae13c2093647455a
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/195f87ab1ea644769368899ae6cf1152
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/1c7fd342e55d4620aabe67c2923b6601
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/2168e2fd878f458dbe6773072c220d00
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/2abd299bafe3416896fae09b32bb9dab
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/32e759571c4a4f7798c1d28f1a6a2c04
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/46e46470f1fa42fc95be214fa59e5017
Source: chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/6c3d9fd2b63e45d4a0e923e29f1ed22d
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/9f8f49a2fe744691878dcbdc84cc3e1e
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/a70364bc9b6f466f9782d92a12e0d1b5
Source: chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/a72fae8c8eb2443b86461e628953774e
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/ac73bffb28ec447cb05ddda36e9f6a94
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/cd75886cf843470ba4d690ccf4c96702
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/d3e1a593769246b59e35e312ebc4a507
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/d6ef132c3a2b42489d38751b363025e9
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/dfa428b600c5432793a459a246833372
Source: chromecache_596.1.dr String found in binary or memory: https://lf1-cdn-tos.bytegoofy.com/goofy/lark/passport/staticfiles/passport/AddEnterpriseMember.png
Source: chromecache_596.1.dr String found in binary or memory: https://lf16-oversea.goofy-cdn.com/obj/goofy-va/lark/passport/staticfiles/passport/orm_dept_count_de
Source: chromecache_596.1.dr String found in binary or memory: https://lf3-cdn-tos.bytegoofy.com/obj/goofy/lark/passport/staticfiles/passport/orm_dept_count_detail
Source: chromecache_449.1.dr, chromecache_392.1.dr String found in binary or memory: https://localforage.github.io/localForage
Source: chromecache_572.1.dr String found in binary or memory: https://lodash.com/
Source: chromecache_572.1.dr String found in binary or memory: https://lodash.com/license
Source: chromecache_423.1.dr, chromecache_433.1.dr, chromecache_420.1.dr, chromecache_427.1.dr String found in binary or memory: https://mths.be/codepointat
Source: chromecache_596.1.dr String found in binary or memory: https://sf16-scmcdn-va.ibytedtos.com/goofy/lark/passport/staticfiles/passport/AddEnterpriseMember.pn
Source: chromecache_574.1.dr, chromecache_597.1.dr, chromecache_366.1.dr, chromecache_478.1.dr String found in binary or memory: https://sizzlejs.com/
Source: chromecache_408.1.dr String found in binary or memory: https://timgsa.baidu.com/timg?image&quality=80&size=b9999_10000&sec=1594965243083&di=356d7b282289e1e
Source: chromecache_583.1.dr, chromecache_355.1.dr, chromecache_403.1.dr, chromecache_421.1.dr, chromecache_467.1.dr, chromecache_461.1.dr String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/admin_console/contacts/departmentanduser
Source: chromecache_555.1.dr String found in binary or memory: https://www.feishu.cn/base-of-terms
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/articles/360049067764
Source: chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/articles/360049067799
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.feishu.cn/hc/articles/821125695004
Source: chromecache_497.1.dr, chromecache_437.1.dr String found in binary or memory: https://www.feishu.cn/hc/articles/990851076781
Source: chromecache_556.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/academy?from=in_base_landingpage
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/081828055062
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/263283633266
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/303452241664
Source: chromecache_556.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/328843312369
Source: chromecache_556.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/342646441037
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/360024868694
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/360049067678
Source: chromecache_556.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/360049067678?from=in_base_landingpage
Source: chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/479618550246
Source: chromecache_497.1.dr, chromecache_437.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/480980460926
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/646202576650
Source: chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/746133328060?from=in-ccm-docx-bi-directional-links
Source: chromecache_556.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/874534846817
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/895547707871
Source: chromecache_556.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/988221280095?from=in-ccm-wiki-move
Source: chromecache_596.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-us/articles/360036430673
Source: chromecache_596.1.dr String found in binary or memory: https://www.feishu.cn/hc/en-us/articles/360040931334
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/081828055062
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/263283633266
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/303452241664
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/360024868694
Source: chromecache_560.1.dr, chromecache_506.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/360049067798
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/588604550568?from=from_parent_bitable
Source: chromecache_340.1.dr, chromecache_492.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/874534846817
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/895547707871
Source: chromecache_529.1.dr, chromecache_337.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/903991718360
Source: chromecache_529.1.dr, chromecache_337.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/909135942944
Source: chromecache_423.1.dr, chromecache_433.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/991220891340?from=in-base-permission-settings
Source: chromecache_423.1.dr, chromecache_433.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/991220891340?from=in-ccm-set-security-level
Source: chromecache_560.1.dr, chromecache_506.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/categories-detail?category-id=6933474571605508097
Source: chromecache_560.1.dr, chromecache_506.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/category/6933474571605508097?from=in-base-profile
Source: chromecache_560.1.dr, chromecache_506.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/category/6933474571605508097?from=in-ccm-profile
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-cn/articles/360036430673
Source: chromecache_412.1.dr, chromecache_596.1.dr String found in binary or memory: https://www.feishu.cn/hc/zh-cn/articles/360040931334
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.larksuite.com/NoticeonAIFieldGenerator
Source: chromecache_556.1.dr String found in binary or memory: https://www.larksuite.com/hc/articles/031435782012
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.larksuite.com/hc/articles/394302268326
Source: chromecache_497.1.dr, chromecache_437.1.dr String found in binary or memory: https://www.larksuite.com/hc/articles/560882006899
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/029473819058
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/035994845534
Source: chromecache_556.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/065908134469?from=in-ccm-wiki-move
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/160572343925
Source: chromecache_544.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/325406187719
Source: chromecache_556.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/338337778643
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/341122385286?from=in-base
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/360024166274
Source: chromecache_544.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/360048487978?from=in-ccm-docx-bi-directional-links
Source: chromecache_556.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/360048488189?from=in_base_landingpage
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/415325830959
Source: chromecache_556.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/639519192663
Source: chromecache_556.1.dr, chromecache_544.1.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/articles/364136562473
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/029473819058
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/035994845534
Source: chromecache_423.1.dr, chromecache_433.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/150212615307?from=in-base-permission-settings
Source: chromecache_423.1.dr, chromecache_433.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/150212615307?from=in-ccm-set-secuirty-level
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/160572343925
Source: chromecache_340.1.dr, chromecache_492.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/338337778643
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/360024166274
Source: chromecache_560.1.dr, chromecache_506.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/360048488007
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/360048488440
Source: chromecache_455.1.dr, chromecache_529.1.dr, chromecache_337.1.dr, chromecache_555.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/415325830959
Source: chromecache_529.1.dr, chromecache_337.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/492741765505
Source: chromecache_529.1.dr, chromecache_337.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/889890865633
Source: chromecache_560.1.dr, chromecache_506.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/categories-detail?category-id=7054521473087569925
Source: chromecache_560.1.dr, chromecache_506.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/category/7054521473087569925?from=in-base-profile
Source: chromecache_560.1.dr, chromecache_506.1.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/category/7054521473087569925?from=in-ccm-profile
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50232
Source: unknown Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50232 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50240
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 50101 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49837 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:50232 version: TLS 1.2
Creates files inside the system directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_BITS_6672_774309383 Jump to behavior
Source: classification engine Classification label: mal48.win@14/542@66/9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://e3ydjw2x2r2.larksuite.com/docx/BIdMdS37KokrskxNV0nuvCuRsVE?from=from_copylink
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1992,i,16837721561728751765,9892168062725491355,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1992,i,16837721561728751765,9892168062725491355,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1384183 URL: https://e3ydjw2x2r2.larksui... Startdate: 31/01/2024 Architecture: WINDOWS Score: 48 24 Antivirus / Scanner detection for submitted sample 2->24 6 chrome.exe 9 2->6         started        process3 dnsIp4 12 192.168.2.16, 138, 443, 49272 unknown unknown 6->12 14 192.168.2.6 unknown unknown 6->14 16 239.255.255.250 unknown Reserved 6->16 9 chrome.exe 6->9         started        process5 dnsIp6 18 172.217.215.138, 443, 50244 GOOGLEUS United States 9->18 20 www.google.com 172.253.124.106, 443, 49740, 50240 GOOGLEUS United States 9->20 22 33 other IPs or domains 9->22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.253.124.106
 www.google.com United States
15169 GOOGLEUS false
34.117.97.41
 direct.quic-webcast-proxy-useast4-v3.useast4.byteglb.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
34.149.173.23
 unknown United States
2686 ATGS-MMD-ASUS false
172.217.215.138
 unknown United States
15169 GOOGLEUS false
173.194.219.84
 accounts.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
74.125.138.100
 clients.l.google.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.16
192.168.2.6

Contacted Domains

Name IP Active
accounts.google.com 173.194.219.84 true
direct.quic-webcast-proxy-useast4-v3.useast4.byteglb.com 34.117.97.41 true
www.google.com 172.253.124.106 true
clients.l.google.com 74.125.138.100 true
lark-frontier.byteoversea.com unknown unknown
clients1.google.com unknown unknown
mcs-bd.larksuite.com unknown unknown
slardar-bd.larksuite.com unknown unknown
login.larksuite.com unknown unknown
lf-scm-us.larksuitecdn.com unknown unknown
lf-scm-jp.larksuitecdn.com unknown unknown
api22-eeftva-docs-quic.larksuite.com unknown unknown
api16-eeftva-gateway.larksuite.com unknown unknown
clients2.google.com unknown unknown
internal-api-lark-api.larksuite.com unknown unknown
sf16-unpkg.larksuitecdn.com unknown unknown
dm.larksuite.com unknown unknown
api22-eeftva-drive-quic.larksuite.com unknown unknown
sf16-short-va.bytedapm.com unknown unknown
e3ydjw2x2r2.larksuite.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api22-eeftva-docs-quic.larksuite.com/ies/speed/ false
  • Avira URL Cloud: safe
 unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
    		high
    https://api22-eeftva-drive-quic.larksuite.com/ies/speed/ false
    • Avira URL Cloud: safe
    		 unknown