Windows Analysis Report
https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR

Overview

General Information

Sample URL:	https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8
Analysis ID:	1504854
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Signatures

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49754 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.16:49701 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67

Source: global traffic	HTTP traffic detected: GET /product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /umi.7010d9a0.css HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F60f22baa467f46929f01a3235a483b39.jpg?Signature=DQFmgKkLa1tIDDS2JUuSjBamnHwWkrfKw9fDJYpgITQ%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F73ef338c52cb486198499dba9d6e03d5.jpg?Signature=cTMknHUTPYq9OkzjDJhilr26eAlUe%2F2VuEWyRFGKw1w%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/hot.643d43d1.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/alibaba.84fa3c8d.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/contact_bg.2c30255a.png HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/umi.7010d9a0.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F60f22baa467f46929f01a3235a483b39.jpg?Signature=DQFmgKkLa1tIDDS2JUuSjBamnHwWkrfKw9fDJYpgITQ%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F73ef338c52cb486198499dba9d6e03d5.jpg?Signature=cTMknHUTPYq9OkzjDJhilr26eAlUe%2F2VuEWyRFGKw1w%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/contact_bg.2c30255a.png HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/hot.643d43d1.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/alibaba.84fa3c8d.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /umi.1961b306.js HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /umi.1961b306.js HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/favicon.png HTTP/1.1Host: waimao.office.163.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mMYM3mwhbd+3lHM&MD=SKzWEg2y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /site/favicon.png HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=first HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=OPEN_PRODUCT_DETAILS&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/16/envelope/?sentry_key=c1c4787cd71a4b3eb8c70bc6f2e1b2e0&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.69.0 HTTP/1.1Host: sentry2.lx.netease.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mMYM3mwhbd+3lHM&MD=SKzWEg2y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: site.ntesmail.com
Source: global traffic	DNS traffic detected: DNS query: cowork-storage.nosdn.127.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: waimao.office.163.com
Source: global traffic	DNS traffic detected: DNS query: sentry2.lx.netease.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Foundserver: istio-envoydate: Thu, 05 Sep 2024 12:27:58 GMTcontent-type: application/jsoncontent-length: 22x-envoy-upstream-service-time: 0lingxi-traceid: 8f1fef1fc7794ab38dd83ff4^1697545526079^629492628connection: close

Source: chromecache_134.1.dr	String found in binary or memory: https://qiye.163.com/sirius/agreement_waimao/index.html
Source: chromecache_134.1.dr	String found in binary or memory: https://qiye.163.com/sirius/privacy_waimao/index.html
Source: chromecache_143.1.dr	String found in binary or memory: https://tailwindcss.com
Source: chromecache_134.1.dr	String found in binary or memory: https://waimao.office.163.com/site/favicon.png

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49754 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/34@22/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,694644445453319614,14567216347516798064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,694644445453319614,14567216347516798064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
163.181.92.229	cowork-storage.nosdn.127.net.w.cdngslb.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
59.111.243.39	sentry2.lx.netease.com	China	45062	NETEASE-ASGuangzhouNetEaseComputerSystemCoLtdCN	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
47.246.24.224	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
139.95.8.252	hwweb.qiye.ntes53.netease.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
47.246.46.227	site.ntesmail.com.w.cdngslb.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
sentry2.lx.netease.com	59.111.243.39	true
www.google.com	142.250.185.132	true
site.ntesmail.com.w.cdngslb.com	47.246.46.227	true
cowork-storage.nosdn.127.net.w.cdngslb.com	163.181.92.229	true
hwweb.qiye.ntes53.netease.com	139.95.8.252	true
waimao.office.163.com	unknown	unknown
cowork-storage.nosdn.127.net	unknown	unknown
site.ntesmail.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://site.ntesmail.com/umi.7010d9a0.css	false	Avira URL Cloud: safe	unknown
https://site.ntesmail.com/static/contact_bg.2c30255a.png	false	Avira URL Cloud: safe	unknown
https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR	false		unknown
https://site.ntesmail.com/umi.1961b306.js	false	Avira URL Cloud: safe	unknown
https://waimao.office.163.com/site/favicon.png	false	Avira URL Cloud: safe	unknown
https://sentry2.lx.netease.com/api/16/envelope/?sentry_key=c1c4787cd71a4b3eb8c70bc6f2e1b2e0&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.69.0	false	Avira URL Cloud: safe	unknown
https://site.ntesmail.com/static/hot.643d43d1.svg	false	Avira URL Cloud: safe	unknown
https://site.ntesmail.com/static/alibaba.84fa3c8d.svg	false	Avira URL Cloud: safe	unknown
https://waimao.office.163.com/site/api/pub/site/track?opType=OPEN_PRODUCT_DETAILS&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR	false	Avira URL Cloud: safe	unknown
https://waimao.office.163.com/site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=first	false	Avira URL Cloud: safe	unknown
https://waimao.office.163.com/site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 5 11:27:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	480936FA8532EF6985CAA8AF391E8B2F	D205D17D1AD031EA17140CD97022625D3FF5558F	3E7D738C4AF54B338DD70D9102F45DCEEC35083C344F1DA58675B8D4F0888405
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 5 11:27:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	66A2C5F4F596F7F729E7418797040D7A	851D89EDE3F0A52E6E29F981D0D0D1DC879FF767	6CF2B58060B338D9DF9EE8213870FD609118394941D0D9175C82F96DB7D5FA15
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1947A3268006F80924885F0EB559A609	3389A7ACF444719DDB0BF9F46281AAD347287384	A6DE92816C4F80AF5BBE4E9A21BDE7EF0F10E7C58C3A2AB0FC5B837402CD6B86
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 5 11:27:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F19E83F11F868D4C7E3E26EBA78ACDED	637A0202E661F7CC336C9542C18E97831EE02225	941B4A65455DE037759883EF52E95B6E94DDEF595315F73B2598B8A40CFE73B8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 5 11:27:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E3A82A15D46AEA7E66F599C35A4278E3	0129E2C0DACCD0D1F9052FEB2F189F6F360492D7	A9BED24863B751EF908DD583834430C8AD5465D21D52E5CC9AE5F4C9E3617708
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 5 11:27:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	268AAA22C6D258BBC6235D9154CBC05A	38F7416B16237D7E37B551FEEE58C4AA9A4AA685	EC2030CEE4BE85B0AB5910095F71320F862A74E8587337D51DA1F2FAF739DEC2
Chrome Cache Entry: 132	JSON data	689525EE6C812E73A44B6AA1036AB53A	7350CB4703A96EA7C140BD30DA9A6D1BCFF36EB2	37EC4665A8102D115FFD1AC20DAE94C98B4DAC64B0C1A68228AA2A531CAEB35D
Chrome Cache Entry: 133	PNG image data, 528 x 528, 8-bit/color RGB, non-interlaced	939CB8ACE175C5D755E279B75A310615	13669D5F0D9443EDA91A4C925022C76F24DBF32F	F881EB301D580AC371956520D3D7C83D017C506E63D71C0A909121C4F4B111E1
Chrome Cache Entry: 134	HTML document, Unicode text, UTF-8 text, with very long lines (20403)	777CC6C48B375C239DCA7D776C7531E3	F125264134044E728DFEB8033ACF865F464BCCC2	9C4D903C07F3F5544C3357C5D2ACD26802AFD06078A5F9E03B028F1569FE8207
Chrome Cache Entry: 135	PNG image data, 532 x 532, 8-bit/color RGB, non-interlaced	1B204380E3EC3CB180BD50754CD1BE8F	AC9A3059F5FEA53073A194270E6E632A0ECB6AF7	32BCB84F6E2BB4AE0AA55CBB6E372DD18F52EF9BCF236026FAE83329A5601DBD
Chrome Cache Entry: 136	SVG Scalable Vector Graphics image	D08ACF8D76A1065F39A11EE8847558A1	CE4E976D8DAFDC33E28EBAEEC6EB546E2001CF70	DE08EB45B6008D6C2BCB25D269EF8622B23BC9D005BC9206E1DDC93AFAEB050B
Chrome Cache Entry: 137	PNG image data, 2880 x 952, 8-bit/color RGBA, non-interlaced	34CC6BF522340391F7F47F84F06FDDD6	BFC3FC0764B200A7F05AD0CF665DC1043DA37B07	3D19E2A0EBD331AA87C9DCA6B1E9A6EBF46052454358882BA7EA282C2DA46467
Chrome Cache Entry: 138	SVG Scalable Vector Graphics image	3B643F065B9C43E96E15E97B5797BF8C	63BC976B60527910359F8F989FFB9AB36E843833	D5E07C92F5DA54DACB46872A433661DA89D784C9D712A8312D057AA990A52F71
Chrome Cache Entry: 139	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	C2181CF05343E51F5B3BC44DBACFB9ED	60FF2586E52EA834831022840D5399D00072EDF0	D72B04ACACAB572EB787D45C9143CC906C9A0CB6476D706AD9D0F1FEA69332E1
Chrome Cache Entry: 140	SVG Scalable Vector Graphics image	D08ACF8D76A1065F39A11EE8847558A1	CE4E976D8DAFDC33E28EBAEEC6EB546E2001CF70	DE08EB45B6008D6C2BCB25D269EF8622B23BC9D005BC9206E1DDC93AFAEB050B
Chrome Cache Entry: 141	ASCII text, with no line terminators	778103778F831265404FAFD087EA2982	7660B70A28173E8E545AD06CDE6EC826A37FF55C	5DC853ED25A0A7369EDD97D8D6710E136209DCB46F8968E98E02A5FA52B8E162
Chrome Cache Entry: 142	PNG image data, 528 x 528, 8-bit/color RGB, non-interlaced	939CB8ACE175C5D755E279B75A310615	13669D5F0D9443EDA91A4C925022C76F24DBF32F	F881EB301D580AC371956520D3D7C83D017C506E63D71C0A909121C4F4B111E1
Chrome Cache Entry: 143	ASCII text, with very long lines (65536), with no line terminators	1B0AB8235136FE101240B53D193D1F42	04EE158B9985E481CC0E2C1E42B0F2DAC54911DA	AF723429622E97CD6051841560D8EE0EE5454E67B840C9D0BF5275FC27895903
Chrome Cache Entry: 144	PNG image data, 2880 x 952, 8-bit/color RGBA, non-interlaced	34CC6BF522340391F7F47F84F06FDDD6	BFC3FC0764B200A7F05AD0CF665DC1043DA37B07	3D19E2A0EBD331AA87C9DCA6B1E9A6EBF46052454358882BA7EA282C2DA46467
Chrome Cache Entry: 145	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	C2181CF05343E51F5B3BC44DBACFB9ED	60FF2586E52EA834831022840D5399D00072EDF0	D72B04ACACAB572EB787D45C9143CC906C9A0CB6476D706AD9D0F1FEA69332E1
Chrome Cache Entry: 146	ASCII text, with very long lines (65536), with no line terminators	79E758B6250E7FE806D7612286836259	C5A70ADACE10F05775EFA5C12061BE953EFA241A	74AB135812FBB65D150A0FBCF65BA134A6C8D70388CF7B2BE00AE4CEAB768EB0
Chrome Cache Entry: 147	SVG Scalable Vector Graphics image	3B643F065B9C43E96E15E97B5797BF8C	63BC976B60527910359F8F989FFB9AB36E843833	D5E07C92F5DA54DACB46872A433661DA89D784C9D712A8312D057AA990A52F71
Chrome Cache Entry: 148	ASCII text, with very long lines (65536), with no line terminators	79E758B6250E7FE806D7612286836259	C5A70ADACE10F05775EFA5C12061BE953EFA241A	74AB135812FBB65D150A0FBCF65BA134A6C8D70388CF7B2BE00AE4CEAB768EB0
Chrome Cache Entry: 149	PNG image data, 532 x 532, 8-bit/color RGB, non-interlaced	1B204380E3EC3CB180BD50754CD1BE8F	AC9A3059F5FEA53073A194270E6E632A0ECB6AF7	32BCB84F6E2BB4AE0AA55CBB6E372DD18F52EF9BCF236026FAE83329A5601DBD

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49754 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.16:49701 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.72.205.209
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67

Source: global traffic	HTTP traffic detected: GET /product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /umi.7010d9a0.css HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F60f22baa467f46929f01a3235a483b39.jpg?Signature=DQFmgKkLa1tIDDS2JUuSjBamnHwWkrfKw9fDJYpgITQ%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F73ef338c52cb486198499dba9d6e03d5.jpg?Signature=cTMknHUTPYq9OkzjDJhilr26eAlUe%2F2VuEWyRFGKw1w%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/hot.643d43d1.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/alibaba.84fa3c8d.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/contact_bg.2c30255a.png HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/umi.7010d9a0.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F60f22baa467f46929f01a3235a483b39.jpg?Signature=DQFmgKkLa1tIDDS2JUuSjBamnHwWkrfKw9fDJYpgITQ%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snapshot%2F2024%2F08%2F22%2F73ef338c52cb486198499dba9d6e03d5.jpg?Signature=cTMknHUTPYq9OkzjDJhilr26eAlUe%2F2VuEWyRFGKw1w%3D&Expires=3301091864&NOSAccessKeyId=5de274d3b56f4e17be4ba5a9a7ce4824 HTTP/1.1Host: cowork-storage.nosdn.127.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/contact_bg.2c30255a.png HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/hot.643d43d1.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/alibaba.84fa3c8d.svg HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /umi.1961b306.js HTTP/1.1Host: site.ntesmail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGRAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /umi.1961b306.js HTTP/1.1Host: site.ntesmail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/favicon.png HTTP/1.1Host: waimao.office.163.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://site.ntesmail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mMYM3mwhbd+3lHM&MD=SKzWEg2y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /site/favicon.png HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=first HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=OPEN_PRODUCT_DETAILS&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/16/envelope/?sentry_key=c1c4787cd71a4b3eb8c70bc6f2e1b2e0&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.69.0 HTTP/1.1Host: sentry2.lx.netease.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mMYM3mwhbd+3lHM&MD=SKzWEg2y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /site/api/pub/site/track?opType=TRACK_DATA&mid=8e88ea30-34d0-4984-8658-fa597e8623e4&productId=1184757&cid=site%255C_ngxvLcIm8CN043WgmaKV5L8RaPSew%255C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&sendType=other HTTP/1.1Host: waimao.office.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: site.ntesmail.com
Source: global traffic	DNS traffic detected: DNS query: cowork-storage.nosdn.127.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: waimao.office.163.com
Source: global traffic	DNS traffic detected: DNS query: sentry2.lx.netease.com

Source: unknown

Source: global traffic

Source: chromecache_134.1.dr	String found in binary or memory: https://qiye.163.com/sirius/agreement_waimao/index.html
Source: chromecache_134.1.dr	String found in binary or memory: https://qiye.163.com/sirius/privacy_waimao/index.html
Source: chromecache_143.1.dr	String found in binary or memory: https://tailwindcss.com
Source: chromecache_134.1.dr	String found in binary or memory: https://waimao.office.163.com/site/favicon.png

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49754 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/34@22/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,694644445453319614,14567216347516798064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,694644445453319614,14567216347516798064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1504854
Product:	CloudBasic
Start time:	14:27:02
Start date:	05.09.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://site.ntesmail.com/product/1184757.html?mid=8e88ea30-34d0-4984-8658-fa597e8623e4&bid=yKt9XNNayY6RSE0qNd-iOW-ITnKtRMrSmlFD82EPrWTl2AEuuQNDG3I4hI1dqYvXSf9sVu1aC4OB8qO77Xqqlw&cid=site%5C_ngxvLcIm8CN043WgmaKV5L8RaPSew%5C_ZtFhCGFVcL5br4ylTP5Zdst1weTlirIWGR