Windows Analysis Report
https://v2mh6l47d2l.larksuite.com/wiki/W8e1wYeNYiJ0UJkEWCtuKaqeshh?from=from_copylinkl

Overview

General Information

Sample URL: https://v2mh6l47d2l.larksuite.com/wiki/W8e1wYeNYiJ0UJkEWCtuKaqeshh?from=from_copylinkl
Analysis ID: 1426960
Infos:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

No high impact signatures.

Classification

There are no high impact signatures.

Source: unknown HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-docs-quic.larksuite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://v2mh6l47d2l.larksuite.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://v2mh6l47d2l.larksuite.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-drive-quic.larksuite.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://v2mh6l47d2l.larksuite.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://v2mh6l47d2l.larksuite.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-drive-quic.larksuite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: swp_csrf_token=86266e50-2845-48b4-a125-d8b5c8071a41; t_beda37=b879c55338ce559e596fe8e0fd5529449922ce3a9150a57b9a0d6991366ef59a; passport_web_did=7358527769208176646; QXV0aHpDb250ZXh0=d48020d4bc95435ba0fed467a8340b71; session=U7CK1RF-672i0b6f-c30f-4bca-829a-ede316418a1r-NN5W4; sl_session=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MTMzMzM5NTcsInVuaXQiOiJldV9lYSIsInJhdyI6eyJtZXRhIjoiQVdZZXZnVGpBRUFHWmg2K0JPTkFBQVptSHI0RTJZQkFCbVlldmdUWmdFQUdaaDYrQk5tQVFBWUNBUUlCUVVGQlFVRkJRVUZCUVVadFNISTBSa3d3UVVGQ1VUMDkiLCJpZGMiOlsxLDJdLCJzdW0iOiJjNzNjNDI1YjkxMzBiNzk0YTE5OTIwODM4ZDg5YzZmMzA1MjM2YjdiZjhhYmVkNmFkZWFiNGE0OGZlZmQ2OWJmIiwibG9jIjoiZW5fdXMiLCJhcGMiOiIiLCJpYXQiOjE3MTMyOTA3NTcsInNhYyI6bnVsbCwibG9kIjpudWxsLCJucyI6ImxhcmsiLCJuc191aWQiOiI3MzU4NTI3NzY5MzY3NTYwMTk4IiwibnNfdGlkIjoiNzM1ODUyNzc2OTM3MTczODExOCIsIm90IjoxfX0.A8oBNs5ILL4LSxWrKRJ9ycmLtdMdeXIIT_loZSUpCtoG3AArdT3mUiWPEvbeFt9RjjdaNHeCIEhKaSDqrCOPAw; is_anonymous_session=1; lang=en; _csrf_token=171e73f826015bae179322142390d3ccd712bd60-1713290764; __tea__ug__uid=1204471713290763796
Source: global traffic HTTP traffic detected: GET /ies/speed/ HTTP/1.1Host: api22-eeftva-docs-quic.larksuite.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: swp_csrf_token=86266e50-2845-48b4-a125-d8b5c8071a41; t_beda37=b879c55338ce559e596fe8e0fd5529449922ce3a9150a57b9a0d6991366ef59a; passport_web_did=7358527769208176646; QXV0aHpDb250ZXh0=d48020d4bc95435ba0fed467a8340b71; session=U7CK1RF-672i0b6f-c30f-4bca-829a-ede316418a1r-NN5W4; sl_session=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MTMzMzM5NTcsInVuaXQiOiJldV9lYSIsInJhdyI6eyJtZXRhIjoiQVdZZXZnVGpBRUFHWmg2K0JPTkFBQVptSHI0RTJZQkFCbVlldmdUWmdFQUdaaDYrQk5tQVFBWUNBUUlCUVVGQlFVRkJRVUZCUVVadFNISTBSa3d3UVVGQ1VUMDkiLCJpZGMiOlsxLDJdLCJzdW0iOiJjNzNjNDI1YjkxMzBiNzk0YTE5OTIwODM4ZDg5YzZmMzA1MjM2YjdiZjhhYmVkNmFkZWFiNGE0OGZlZmQ2OWJmIiwibG9jIjoiZW5fdXMiLCJhcGMiOiIiLCJpYXQiOjE3MTMyOTA3NTcsInNhYyI6bnVsbCwibG9kIjpudWxsLCJucyI6ImxhcmsiLCJuc191aWQiOiI3MzU4NTI3NzY5MzY3NTYwMTk4IiwibnNfdGlkIjoiNzM1ODUyNzc2OTM3MTczODExOCIsIm90IjoxfX0.A8oBNs5ILL4LSxWrKRJ9ycmLtdMdeXIIT_loZSUpCtoG3AArdT3mUiWPEvbeFt9RjjdaNHeCIEhKaSDqrCOPAw; is_anonymous_session=1; lang=en; _csrf_token=171e73f826015bae179322142390d3ccd712bd60-1713290764; __tea__ug__uid=1204471713290763796
Source: unknown DNS traffic detected: queries for: v2mh6l47d2l.larksuite.com
Source: chromecache_229.2.dr String found in binary or memory: http://github.com/jonnyreeves/js-logger
Source: chromecache_270.2.dr, chromecache_229.2.dr String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_229.2.dr String found in binary or memory: http://jonnyreeves.co.uk/
Source: chromecache_229.2.dr String found in binary or memory: http://oli.me.uk/
Source: chromecache_229.2.dr String found in binary or memory: http://sheetjs.com
Source: chromecache_229.2.dr String found in binary or memory: http://unlicense.org/
Source: chromecache_359.2.dr, chromecache_226.2.dr, chromecache_229.2.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_357.2.dr String found in binary or memory: https://...
Source: chromecache_243.2.dr, chromecache_238.2.dr, chromecache_314.2.dr String found in binary or memory: https://applink.feishu.cn/client/web_url/open?width=640&height=480&mode=window&url=https%3A%2F%2Flin
Source: chromecache_224.2.dr, chromecache_342.2.dr, chromecache_229.2.dr String found in binary or memory: https://feross.org
Source: chromecache_342.2.dr, chromecache_229.2.dr String found in binary or memory: https://feross.org/opensource
Source: chromecache_359.2.dr String found in binary or memory: https://github.com/emn178/js-htmlencode
Source: chromecache_353.2.dr, chromecache_342.2.dr String found in binary or memory: https://jquery.com/
Source: chromecache_353.2.dr, chromecache_342.2.dr String found in binary or memory: https://jquery.org/license
Source: chromecache_353.2.dr, chromecache_342.2.dr String found in binary or memory: https://js.foundation/
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/011c0865bf2a4dbdae13c2093647455a
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/195f87ab1ea644769368899ae6cf1152
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/1c7fd342e55d4620aabe67c2923b6601
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/2168e2fd878f458dbe6773072c220d00
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/2abd299bafe3416896fae09b32bb9dab
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/32e759571c4a4f7798c1d28f1a6a2c04
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/46e46470f1fa42fc95be214fa59e5017
Source: chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/6c3d9fd2b63e45d4a0e923e29f1ed22d
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/9f8f49a2fe744691878dcbdc84cc3e1e
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/a70364bc9b6f466f9782d92a12e0d1b5
Source: chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/a72fae8c8eb2443b86461e628953774e
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/ac73bffb28ec447cb05ddda36e9f6a94
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/cd75886cf843470ba4d690ccf4c96702
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/d3e1a593769246b59e35e312ebc4a507
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/d6ef132c3a2b42489d38751b363025e9
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://lf-apmplus.volccdn.com/obj/tos-cn-o-0000/dfa428b600c5432793a459a246833372
Source: chromecache_247.2.dr String found in binary or memory: https://lf1-cdn-tos.bytegoofy.com/goofy/lark/passport/staticfiles/passport/AddEnterpriseMember.png
Source: chromecache_247.2.dr String found in binary or memory: https://lf16-oversea.goofy-cdn.com/obj/goofy-va/lark/passport/staticfiles/passport/orm_dept_count_de
Source: chromecache_247.2.dr String found in binary or memory: https://lf3-cdn-tos.bytegoofy.com/obj/goofy/lark/passport/staticfiles/passport/orm_dept_count_detail
Source: chromecache_229.2.dr String found in binary or memory: https://localforage.github.io/localForage
Source: chromecache_247.2.dr String found in binary or memory: https://sf16-scmcdn-va.ibytedtos.com/goofy/lark/passport/staticfiles/passport/AddEnterpriseMember.pn
Source: chromecache_353.2.dr, chromecache_342.2.dr String found in binary or memory: https://sizzlejs.com/
Source: chromecache_225.2.dr String found in binary or memory: https://timgsa.baidu.com/timg?image&quality=80&size=b9999_10000&sec=1594965243083&di=356d7b282289e1e
Source: chromecache_270.2.dr, chromecache_322.2.dr, chromecache_211.2.dr, chromecache_235.2.dr, chromecache_304.2.dr String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/base-of-terms
Source: chromecache_357.2.dr String found in binary or memory: https://www.feishu.cn/hc/articles/360049067764
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/hc/articles/821125695004
Source: chromecache_263.2.dr String found in binary or memory: https://www.feishu.cn/hc/articles/990851076781
Source: chromecache_357.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/081828055062
Source: chromecache_357.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/263283633266
Source: chromecache_357.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/303452241664
Source: chromecache_357.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/360024868694
Source: chromecache_357.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/360049067727
Source: chromecache_357.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/479618550246
Source: chromecache_263.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/480980460926
Source: chromecache_357.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/646202576650
Source: chromecache_357.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/874534846817
Source: chromecache_357.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-US/articles/895547707871
Source: chromecache_247.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-us/articles/360036430673
Source: chromecache_247.2.dr String found in binary or memory: https://www.feishu.cn/hc/en-us/articles/360040931334
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/081828055062
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/263283633266
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/303452241664
Source: chromecache_287.2.dr, chromecache_307.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/328843312369
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/360024868694
Source: chromecache_238.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/360049067798
Source: chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/364198000460?from=in-ccm
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/588604550568?from=from_parent_bitable
Source: chromecache_283.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/874534846817
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/895547707871
Source: chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/903991718360
Source: chromecache_253.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/909135942944
Source: chromecache_224.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/991220891340?from=in-base-permission-settings
Source: chromecache_224.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/articles/991220891340?from=in-ccm-set-security-level
Source: chromecache_238.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/categories-detail?category-id=6933474571605508097
Source: chromecache_238.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/category/6933474571605508097?from=in-ccm-profile
Source: chromecache_238.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-CN/category/6933474572494716956-%E5%A4%9A%E7%BB%B4%E8%A1%A8%E6%A0%BC
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-cn/articles/360036430673
Source: chromecache_368.2.dr, chromecache_247.2.dr String found in binary or memory: https://www.feishu.cn/hc/zh-cn/articles/360040931334
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/NoticeonAIFieldGenerator
Source: chromecache_287.2.dr, chromecache_307.2.dr String found in binary or memory: https://www.larksuite.com/hc/articles/031435782012
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/articles/394302268326
Source: chromecache_263.2.dr String found in binary or memory: https://www.larksuite.com/hc/articles/560882006899
Source: chromecache_357.2.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/029473819058
Source: chromecache_357.2.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/035994845534
Source: chromecache_357.2.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/160572343925
Source: chromecache_357.2.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/325406187719
Source: chromecache_357.2.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/338337778643
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/341122385286?from=in-base
Source: chromecache_357.2.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/360024166274
Source: chromecache_357.2.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/360048487978
Source: chromecache_357.2.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/415325830959
Source: chromecache_357.2.dr String found in binary or memory: https://www.larksuite.com/hc/en-US/articles/articles/364136562473
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/029473819058
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/035994845534
Source: chromecache_224.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/150212615307?from=in-base-permission-settings
Source: chromecache_224.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/150212615307?from=in-ccm-set-secuirty-level
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/160572343925
Source: chromecache_283.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/338337778643
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/360024166274
Source: chromecache_238.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/360048488007
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/360048488440
Source: chromecache_309.2.dr, chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/415325830959
Source: chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/492741765505
Source: chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/866188684445?from=in-ccm
Source: chromecache_253.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/articles/889890865633
Source: chromecache_238.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/categories-detail?category-id=7054521473087569925
Source: chromecache_238.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/category/7054521473087569925?from=in-ccm-profile
Source: chromecache_238.2.dr String found in binary or memory: https://www.larksuite.com/hc/zh-CN/category/7085316334061355014
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: classification engine Classification label: clean0.win@16/326@52/7
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2124,i,12722633533119624568,1418162669468293691,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://v2mh6l47d2l.larksuite.com/wiki/W8e1wYeNYiJ0UJkEWCtuKaqeshh?from=from_copylinkl"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2124,i,12722633533119624568,1418162669468293691,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1426960 URL: https://v2mh6l47d2l.larksui... Startdate: 16/04/2024 Architecture: WINDOWS Score: 0 5 chrome.exe 1 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.4, 138, 443, 49672 unknown unknown 5->13 15 192.168.2.5 unknown unknown 5->15 17 2 other IPs or domains 5->17 10 chrome.exe 5->10         started        process4 dnsIp5 19 www.google.com 142.251.15.103, 443, 49741, 50064 GOOGLEUS United States 10->19 21 direct.quic-webcast-proxy-useast4-v3.useast4.byteglb.com 34.117.97.41, 443, 49907, 49909 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 10->21 23 24 other IPs or domains 10->23
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.117.97.41
 direct.quic-webcast-proxy-useast4-v3.useast4.byteglb.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
34.149.173.23
 unknown United States
2686 ATGS-MMD-ASUS false
142.251.15.103
 www.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false

Private

IP
192.168.2.4
192.168.2.6
192.168.2.5

Contacted Domains

Name IP Active
direct.quic-webcast-proxy-useast4-v3.useast4.byteglb.com 34.117.97.41 true
www.google.com 142.251.15.103 true
fp2e7a.wpc.phicdn.net 192.229.211.108 true
lark-frontier.byteoversea.com unknown unknown
mcs-bd.larksuite.com unknown unknown
slardar-bd.larksuite.com unknown unknown
lf-scm-us.larksuitecdn.com unknown unknown
api22-eeftva-docs-quic.larksuite.com unknown unknown
api16-eeftva-gateway.larksuite.com unknown unknown
v2mh6l47d2l.larksuite.com unknown unknown
internal-api-lark-api.larksuite.com unknown unknown
sf16-unpkg.larksuitecdn.com unknown unknown
accounts.larksuite.com unknown unknown
dm.larksuite.com unknown unknown
api22-eeftva-drive-quic.larksuite.com unknown unknown
sf16-short-va.bytedapm.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api22-eeftva-docs-quic.larksuite.com/ies/speed/ false
    		unknown
    https://v2mh6l47d2l.larksuite.com/wiki/W8e1wYeNYiJ0UJkEWCtuKaqeshh false
      		unknown
      https://api22-eeftva-drive-quic.larksuite.com/ies/speed/ false
        		unknown