Windows Analysis Report
https://us.docworkspace.com/d/sIALe-cabAaWesrIG?utm_source=wps_office_mac&utm_medium=comp_border_bar&utm_content=link

Overview

General Information

Sample URL:	https://us.docworkspace.com/d/sIALe-cabAaWesrIG?utm_source=wps_office_mac&utm_medium=comp_border_bar&utm_content=link
Analysis ID:	1447150
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Drops PE files

Stores files to the Windows start menu directory

Classification

Signatures

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:50970 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.135
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: us.docworkspace.com
Source: global traffic	DNS traffic detected: DNS query: us.docs.wps.com
Source: global traffic	DNS traffic detected: DNS query: docs.cache.wpscdn.com
Source: global traffic	DNS traffic detected: DNS query: www.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: us-drive.wps.com
Source: global traffic	DNS traffic detected: DNS query: us-account.wps.com
Source: global traffic	DNS traffic detected: DNS query: s-us.wps.com
Source: global traffic	DNS traffic detected: DNS query: api-ad-adapter.wps.com
Source: global traffic	DNS traffic detected: DNS query: params.wps.com
Source: global traffic	DNS traffic detected: DNS query: s.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: c.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: wdl1.pcfg.cache.wpscdn.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 50982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50978
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50970
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50972
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50987
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50980
Source: unknown	Network traffic detected: HTTP traffic on port 50987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50981
Source: unknown	Network traffic detected: HTTP traffic on port 50994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50994
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 50981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:50970 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@19/43@54/308

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us.docworkspace.com/d/sIALe-cabAaWesrIG?utm_source=wps_office_mac&utm_medium=comp_border_bar&utm_content=link
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1820,i,17613378975665727923,17014139397757708343,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1820,i,17613378975665727923,17014139397757708343,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4068 --field-trial-handle=1820,i,17613378975665727923,17014139397757708343,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4068 --field-trial-handle=1820,i,17613378975665727923,17014139397757708343,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\c1f10817-61d1-413b-a5d6-e68bc3f4aed6.tmp			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 457900.crdownload			Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
90.84.189.232	api-ad-adapter-ff.wps.com	France	2280	OCBHONEYOCBpubliccloudnetworkEU	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
52.89.38.88	alb-kae-docworkspace-wpscloud-1966683128.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
54.218.32.9	alb-kae-account-wpscloud-1322740792.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
13.107.246.45	part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.208.255.235	alb-kae-drive-wpscloud-1551734008.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
44.231.176.230	unknown	United States	16509	AMAZON-02US	false
18.239.69.119	unknown	United States	16509	AMAZON-02US	false
104.16.83.69	unknown	United States	13335	CLOUDFLARENETUS	false
13.224.222.125	unknown	United States	16509	AMAZON-02US	false
142.250.181.232	unknown	United States	15169	GOOGLEUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
68.219.88.97	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
142.250.184.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
54.218.139.120	istio-gateway.us.entry.4wps.net	United States	16509	AMAZON-02US	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
142.250.184.202	unknown	United States	15169	GOOGLEUS	false
18.66.196.119	d2y4xxvxls3ktv.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.124.68	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.133.84	unknown	United States	15169	GOOGLEUS	false
142.250.184.193	unknown	United States	15169	GOOGLEUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
104.16.84.69	wdl1-pcfg-cache-wpscdn-com.v4.cn-line.qiniudns.com	United States	13335	CLOUDFLARENETUS	false
90.84.175.86	nginx-gateway-service.default.ff.entry.4wps.net	France	5511	OPENTRANSITFR	false
142.250.185.232	unknown	United States	15169	GOOGLEUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
35.165.176.112	unknown	United States	16509	AMAZON-02US	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.173.205.36	unknown	United States	3	MIT-GATEWAYSUS	false
52.88.220.178	alb-kae-us-docs-wpscloud-1604201947.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
142.250.184.234	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
istio-gateway.us.entry.4wps.net	54.218.139.120	true
part-0017.t-0009.t-msedge.net	13.107.246.45	true
api-ad-adapter-ff.wps.com	90.84.189.232	true
d2y4xxvxls3ktv.cloudfront.net	18.66.196.119	true
nginx-gateway-service.default.ff.entry.4wps.net	90.84.175.86	true
alb-kae-us-docs-wpscloud-1604201947.us-west-2.elb.amazonaws.com	52.88.220.178	true
alb-kae-docworkspace-wpscloud-1966683128.us-west-2.elb.amazonaws.com	52.89.38.88	true
www.google.com	216.58.206.68	true
wdl1-pcfg-cache-wpscdn-com.v4.cn-line.qiniudns.com	104.16.84.69	true
alb-kae-account-wpscloud-1322740792.us-west-2.elb.amazonaws.com	54.218.32.9	true
googlehosted.l.googleusercontent.com	142.250.184.225	true
alb-kae-drive-wpscloud-1551734008.us-west-2.elb.amazonaws.com	34.208.255.235	true
docs.cache.wpscdn.com	unknown	unknown
s-us.wps.com	unknown	unknown
wdl1.pcfg.cache.wpscdn.com	unknown	unknown
us.docs.wps.com	unknown	unknown
www.clarity.ms	unknown	unknown
us-account.wps.com	unknown	unknown
lh3.googleusercontent.com	unknown	unknown
s.clarity.ms	unknown	unknown
us-drive.wps.com	unknown	unknown
api-ad-adapter.wps.com	unknown	unknown
us.docworkspace.com	unknown	unknown
c.clarity.ms	unknown	unknown
params.wps.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://us.docs.wps.com/module/common/loadPlatform/?utm_source=wps_office_mac&utm_medium=comp_border_bar&utm_content=link&sid=sIALe-cabAaWesrIG&v=v2	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 11:37:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	82E68AAA02601F99770C5D8A597355D0	388BDCFC361AAB6FFEE0B6C8BA463AC6986F2264	4BAD7F46E682914DB5A26449066B0462AA0257820349BEF24D06B666E5812CF4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 11:37:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	29C9DAD0AD4A798BB4C6375DA153563E	F59E5FAB8159C38E3E92613DFD067D2690E0D12D	ABF893850B532567C43F8C38D64576158BBAA97E4A6B792C46CFD98E9172FFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FEA7C67B3AA92BF4A106062E71447F6B	13F307D7392C0480B613CE4EE9EA964B2A54A8AE	7DE6F5F8500A6392CCD1F332BC1D66858D700B35F6F99F5D3B2A16BD420DF368
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 11:37:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B0B78E3FC79990CC0D241A3C5DA008A2	A0DA753B7F0DE6E606F333E9B1222D9D9966B845	71418D12A161A4A6247BF693A9A3DBDF34D664687DF5A5517097D3FFE4EE5C17
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 11:37:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CBD8FC44919B76C55C0A87F92CB05D48	CEFC40C9932FA3E77BEC43C08E3A3CA61D2FFA40	FC3EA893D7EB2FA57EF2CCB3CF937D055667FF72D5164868C20A6B9C7489A732
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 11:37:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	17EEEECDFA51B1C3D3034F5F5E844A3D	E6CCF95EA394E4B9029EE4102F49BA17E14C13DF	B91636DF45592CDEFEA074CA0F24D8389124BB4F8153D6399357245CF9F4D195
C:\Users\user\Downloads\Unconfirmed 457900.crdownload	PE32 executable (GUI) Intel 80386, for MS Windows	1F78F77D286823417ED1A3AEB12BA90E	7D9AF16F0C08C1805CFA16ABEE6B1C1ED2EAB23D	1F0F90D4826BA47F716DAA1176A17C3846356A160081F44849A69514D2909E6F
C:\Users\user\Downloads\c1f10817-61d1-413b-a5d6-e68bc3f4aed6.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	924FF70051B3FDACFDD6D95CBA3C6DFE	B1ACA62684F2EBBBBF2742CD8BF735EDB19D39C9	2BE1CF7294D9D84CB8EA314F285E68E6119D8B37462FED7C1BBBC6A0E98F7F8E
Chrome Cache Entry: 100	ASCII text, with very long lines (5945)	A220782D8EE3C73612D3A12C3667193A	D4EFCEE1F0F1E4B522BFAECF9E531983FE1148DA	321BA209998E069C30133B7B238A9DAD606A8125BB2E4662BEA8B4F7A27A167C
Chrome Cache Entry: 101	ASCII text, with no line terminators	53AF239EE5D3E261545DEDEDCB6FFD57	04CA7E137E1E9FEEAD96A7DF45BB67D5AB3DE190	99EB12F2AB3C4866A353E098FFA3CB7A967E617C49B98480394EC5D8EA92B094
Chrome Cache Entry: 102	SVG Scalable Vector Graphics image	98673A5A06DD303B4D60E3DB391EE885	3E0B50D727939A5E964F3AB7F78F3908456B5571	3BB8A44CCF9FCB0443D329834FC6BA9E958D0693BFFFF3B1E6A3B489AFD2012F
Chrome Cache Entry: 105	PNG image data, 264 x 288, 8-bit/color RGBA, non-interlaced	BDF2F8170FC3F50ED090FBAACB2A449E	C8B8AF204C55F444F79D488337D56A3F9321D1C0	B618065C46D4A894945516759F4CFB70CC676709B7F24A676DD18A7C35C41192
Chrome Cache Entry: 106	HTML document, Unicode text, UTF-8 text, with very long lines (1136)	32B804F982135852AF39ACF42B00A356	44040A629D00382BEF11C8042102CCD0B9307DF2	44F7B001E68CF97CC5D4EBE00412F2937171F5973460608725F26719504D4412
Chrome Cache Entry: 107	PNG image data, 96 x 96, 8-bit grayscale, non-interlaced	F4AD0CD10E81664F025DD1F5B6A5AD9F	54C9B4B9FA481F1820B088AF79F5855793A0E48D	091C0E2FE196A438759D5014383ED0F659A13E1B557EB6FA776F4F27A82ED12F
Chrome Cache Entry: 108	PNG image data, 17 x 40, 8-bit/color RGBA, non-interlaced	A83956CB86C8BAABD34903313B3EF89A	53517EBE645B070E5941EAAC9483F8EB5FB6AFF0	F852369E51AB6F90C6DAB2B29A286A29B45F6F170FA1D07C82F88490CB870907
Chrome Cache Entry: 109	HTML document, ASCII text, with very long lines (2503), with no line terminators	02BAFEB18C99E2D50AC42C503F63F038	A77EA8E5D4DACF67D08FA3F7C20028BDADE2A8FB	850DBBA3DF72DA397DFE79492F311D5DA91D264841CC38D525747ACBAFEC5D54
Chrome Cache Entry: 110	PNG image data, 269 x 153, 8-bit/color RGBA, non-interlaced	4EAFFEE8872F9E13C75B4B8DD8082CC1	45E2EF097A88941A8B6D2A108B17EE7926667F87	09AABFFA09C899A48AE3C130270F8DEFC85F00084FE179ED542FCCF30C8A2336
Chrome Cache Entry: 111	JSON data	5928675A7D500DED076650C6DD53A0F1	CDF8A58D635EA02AE825C6878C70504DDC41F5C8	31DB804EDACBA37574062367A2D45790862CCAAF060C186689578C9BE9B19AE1
Chrome Cache Entry: 112	JSON data	4AAA5D83156D8846C9BF5FEC228ACD9F	DB9FC8ACB36D9ED3799A44C4DA87CCA9A51A976B	C3954AFAD1F3F800441EAC9775ACB6D211AD673801B1E6DBBB0AB13C24423699
Chrome Cache Entry: 113	HTML document, ASCII text, with very long lines (11837)	737C4B70CEE3532CF0E6A026E6A7A29F	CD9DCFCA94B48D60B421C612D20A8EED6E9BD647	2761E6FCCD3B00C994F51F37E0EEF6A110F39D0B7F54AAE3E2556E5D7A0A7221
Chrome Cache Entry: 114	Unicode text, UTF-8 text, with very long lines (65462), with no line terminators	88BD397109EA7DBF0E9CED97E5DC4D09	E6884F0C9F1669E9DB62A6B3F4A4809BBC47A4EC	4F7F38F602796FA4C86555789EF73CA7E531074EDD8F534F3E664912E4AC7B6D
Chrome Cache Entry: 115	ASCII text, with very long lines (5945)	A5D02DF180BFE7E2F13D4DBFEB0DDD1F	429B31488A4DB622E960AFEBD822470ABEC0FF41	5719D4CBBBE90C84FA665B313780DFBC59FA7704322AF201BE6B888704DC78FE
Chrome Cache Entry: 119	ASCII text, with very long lines (4179)	EEC979F1F737DB00B4102999CB3CBB5C	7247B2C5E7B2948A248682D7E4B3C56C37DAF652	27EAC38A4C883B5AE92ACD0D2ABAAEF75ABE0AA7573A7A691081F5EE9F8CFA77
Chrome Cache Entry: 120	ASCII text, with very long lines (2694), with no line terminators	879A75A961B01CE2B192777DF1ED1501	10951D9760F4FEAD5E637B929B0A01E5BDFCC05A	9C4CA2058BEF6CDC32D3C96248F17B49D00DA51A97203EE516E2F583467C7806
Chrome Cache Entry: 121	PNG image data, 17 x 40, 8-bit/color RGBA, non-interlaced	0C5485AE009026986C1BBBD9D5923C9F	DC78751F3574723EFAE83F1C50E6530C209C04DC	52008A47A9ACACAF96DA87A39953F3AB0726A1F531F3EAB64B1BBF21BDA71F1D
Chrome Cache Entry: 122	ASCII text, with very long lines (24079), with no line terminators	208DC764153AE049BAB4B7E4206370CD	55B6BD87EECBC5EBE8D095AD971FA9822F38F068	2A2C39A3F14D45833AFB06FD0D9A8CE541DF91CFEA10E1794DCC79A1C024A070
Chrome Cache Entry: 125	SVG Scalable Vector Graphics image	274DAF61E8C5CED348D12802759B3DAA	C4975B12331B27E77F69BA966D1A4CF46F836DE4	A1B1BD0B47737C670D96D5A8C2F2B353BD469132D8AFA8CA4049137D7E42D147
Chrome Cache Entry: 126	Unicode text, UTF-8 text, with very long lines (62300), with CRLF line terminators	B31E76D22DA4399DB4B8C8ECCD35DC2B	B36D4554849D3F05DF0363366BE9133D35EACA98	5BA7B351020430E304E1C38988858E13690202831484697551E56FED5826004E
Chrome Cache Entry: 127	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced	F4DAF9E5B7CAAEEA8183BB42A49C56A8	B0B7BB5FAF449D3A3751752B815E09B9F29D16A9	4D987A2ABB4C63F18179B7FA3F9DC33C13A2F66BBD6A3F5F1B9F8FEA904080D3
Chrome Cache Entry: 128	JSON data	8C4C7804C239ACEA89A1A11804589CE5	3E4D60649634D333E02695BB657B05E6A0BFF121	DA4B1CE0A6833588F4A9BD24350C9F16C31426D439F92B3342B43BFFEC6667C2
Chrome Cache Entry: 131	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel	C5A49151188324B97A545F8E4503D425	F71A9FB7FA9E839A193A6DCC932D5397645B8D36	EECC6EB9A84ABF04B2D278A67AC92C4A025F3D365994904A6BEDB49F720B112A
Chrome Cache Entry: 132	ASCII text, with very long lines (65485)	02FE9B828C130E46292D816E28DE9176	3BAB2D9100017D7CFA1773BB1B1E39441154330F	6D8F977577A5DAF2EDA8A94E8426EADC0E458BD410CF27D99C65A8F74F24F917
Chrome Cache Entry: 133	Unicode text, UTF-8 text, with very long lines (47478), with no line terminators	6A215B6FEE5059C0FF5104DC627C85A5	405426F7C9B36776F2573DC29B9EB3F6F26279E9	32CB72CE60E0D9F124A7065BEB308F7E8D5AB1707343411BF67A12AA6E44046A
Chrome Cache Entry: 134	JSON data	A77DDCC76E5376AAF36F9339946F9253	404FF2410583485F40D40F786DA6CE73CBE77D21	57894D21B3152D2E89A052605D583AAEAFFD53D5A6B721C5C6E9130692B8DAAA
Chrome Cache Entry: 135	ASCII text, with very long lines (27700), with no line terminators	F7E9B8EDA5BC713C4D4BDFCB69D95A05	5E56E35F3504CFB20F9CC6B644D497DC300FCAF1	DD42C5154C8376E0FEF5EDDC5DCB287888A44DD3F73C2A0B037920A5E2FE7A1C
Chrome Cache Entry: 137	ASCII text, with very long lines (5945)	ADEABA1AA242BEE343ABF6D76D8B8C6D	CEAC8C2F241D122057265F6C7110918025D81153	AA26A387A579E9070DC3F16D30B36CD964A44394AF4F1C1AE81A6FA1CEB98E63
Chrome Cache Entry: 92	ASCII text, with very long lines (2343)	575B5480531DA4D14E7453E2016FE0BC	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
Chrome Cache Entry: 93	JSON data	A74E66ACDA3A202BF5FB3C4B1B416D18	CA9AEF40685CBFA626CBDA1ED206697748990A89	8229F780BE39E3995A84999BE91EEA14AA6D58ABC37899B337980277EB1E73A7
Chrome Cache Entry: 94	Unicode text, UTF-8 text, with very long lines (64612), with no line terminators	2D685F7EF9B21A4D3CD792EE1C29C89C	EF86EBCA1B96B4AFAA0C8851735B2585AFACF2F5	66911F0660E8C470FF328DFBCF28FA50E6B555328B9A282B87398D8D31817BAE
Chrome Cache Entry: 96	Unicode text, UTF-8 text, with very long lines (28144)	717C515E7A6E62314B2E17EC39230484	272632A3201A5599764A0D7F9F78DB9D1E5E18BB	C34864F00C9E1970C39E4DDD54DF88DBA1D9F572BA3BE8D4B4089054558FC875
Chrome Cache Entry: 97	ASCII text, with very long lines (65485)	36D39398833139167A2F9F2DCBD85549	E373B3F2B8D88E6A3D659ABE7394986ECE4B0950	1406B63FC5FCE598FFEFFB075220244C34C95FE478B9E8037C2E5CEF54B2592D
Chrome Cache Entry: 98	JSON data	07C831427C445CFA6718026D11AD7657	3D3225271FEA9F62C2A6D0AF42AD04AE2BDEE17D	0A2393F1F2BC99085099D2D1BE349866B97458C13D4B5747185331992456E954
Chrome Cache Entry: 99	JSON data	4BB1156AAD1C446F3294EF1C9441F120	DDD8C5DA87D432925E96D03E9600B8522B4A71C7	A8012A0CF548A0C9DC90AC8D6C43D717A767A71E5FE75B4ABD154E3F63ADF4D7

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:50970 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:50968 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.135
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: us.docworkspace.com
Source: global traffic	DNS traffic detected: DNS query: us.docs.wps.com
Source: global traffic	DNS traffic detected: DNS query: docs.cache.wpscdn.com
Source: global traffic	DNS traffic detected: DNS query: www.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: us-drive.wps.com
Source: global traffic	DNS traffic detected: DNS query: us-account.wps.com
Source: global traffic	DNS traffic detected: DNS query: s-us.wps.com
Source: global traffic	DNS traffic detected: DNS query: api-ad-adapter.wps.com
Source: global traffic	DNS traffic detected: DNS query: params.wps.com
Source: global traffic	DNS traffic detected: DNS query: s.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: c.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: wdl1.pcfg.cache.wpscdn.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 50982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50978
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50970
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50972
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50987
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50980
Source: unknown	Network traffic detected: HTTP traffic on port 50987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50981
Source: unknown	Network traffic detected: HTTP traffic on port 50994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50994
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 50981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:50970 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@19/43@54/308

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us.docworkspace.com/d/sIALe-cabAaWesrIG?utm_source=wps_office_mac&utm_medium=comp_border_bar&utm_content=link
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1820,i,17613378975665727923,17014139397757708343,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1820,i,17613378975665727923,17014139397757708343,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4068 --field-trial-handle=1820,i,17613378975665727923,17014139397757708343,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4068 --field-trial-handle=1820,i,17613378975665727923,17014139397757708343,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\c1f10817-61d1-413b-a5d6-e68bc3f4aed6.tmp			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 457900.crdownload			Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1447150
Product:	CloudBasic
Start time:	14:37:23
Start date:	24.05.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://us.docworkspace.com/d/sIALe-cabAaWesrIG?utm_source=wps_office_mac&utm_medium=comp_border_bar&utm_content=link

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://us.docworkspace.com/d/sIALe-cabAaWesrIG?utm_source=wps_office_mac&utm_medium=comp_border_bar&utm_content=link

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://us.docworkspace.com/d/sIALe-cabAaWesrIG?utm_source=wps_office_mac&utm_medium=comp_border_bar&utm_content=link