Windows Analysis Report
https://ea.pstmrk.it/open?m=v3_1.bV7EYmGPAjrBi4aYJaG26Q.pCemdUWL0xochskpB-4GlhbqR_bDmCcFQMaK_Uj6hLotG9B-lhAprfT-xt5bUnPGRAnBtJiXhAEWg26Dxaw3t-AkxZtctPLWrPJ4tRNQ5xGV3GycTiG92Vrn9ke_3cBrfAds6GhJSI73VBL_yF5yepLqUZKQMwi-QQmFI2RBSyunckdjiIHygs_c-7GiUEndW_4vaj-73ksUNJ4NQ3u7OMzcmyvb3GpcNxr6LR-EGsZmp6B84pqC

ID:	1520611
Product:	CloudBasic
Start time:	16:46:37
Start date:	27.09.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 13:47:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	88B8F6AC6B0B056B43786BB33B6CB5E7	2AADB164EDEA3702B73E56DD4ECE933AC940BAD1	345673882EF726E548BED29526C557B2C8393F8472AC36884051667C1F6214BD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 13:47:15 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	72BB1BDEB82DAEDD79AA8876E7D8BCC8	A3E5CEC8911F7E32FC072B28B5892065F0E25E2D	B50D726F6801000BAF1947C0AB6B0B83CB1787B805D8C4E675879789746F13E7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B8E353BAFF10383C2A0DA5FAF245B95F	824B4997B2497F6A8E9275ED2E0305D54E609C44	77618FD1DB92C73E6E0F63835A5773E1383CCF9C313F9052D4E2EFF8C3E6145C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 13:47:15 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	9E28BCB95475B3393E1ECAE343594632	12354C90A0B87C7A5D3981C60671905EFFF64B28	DD0567EAC591BEB5BE12FC1F2DFB9D170A4FFEC2F120B30D103C9F60D6A26524
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 13:47:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	52BAE46397000B6C48D03BAAE22828CE	2D2BEF70384E4122E0B6D0E512E5D4D94B3A702A	719D5905EE190E934D9E4E5425BB6B4C765DB6FAFDBF87BA0A17AC363C1882AE
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 13:47:15 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	58FB6926E45807FA58C6ADE24AA0EF4C	2FF111FE158465210FD722DAB60C7A7F77506EF4	22CC645BA8B6616477975B5CCDF4200356EE2615AECA6C90FCFAC153EEB21A6C
Chrome Cache Entry: 63	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	226A3B111A56268B07978107172649C9	63130F353EB4E3ADAFEC644FC105B1C5B0704BCA	2AAF4CAE9BDE3FC7FC0F2F9728DBBF6805B6FFF38C6464A9A62F575EBB466CFC

Phishing

Source: https://ea.pstmrk.it/open?m=v3_1.bV7EYmGPAjrBi4aYJaG26Q.pCemdUWL0xochskpB-4GlhbqR_bDmCcFQMaK_Uj6hLotG9B-lhAprfT-xt5bUnPGRAnBtJiXhAEWg26Dxaw3t-AkxZtctPLWrPJ4tRNQ5xGV3GycTiG92Vrn9ke_3cBrfAds6GhJSI73VBL_yF5yepLqUZKQMwi-QQmFI2RBSyunckdjiIHygs_c-7GiUEndW_4vaj-73ksUNJ4NQ3u7OMzcmyvb3GpcNxr6LR-EGsZmp6B84pqCi3SAeNDKU7LiwZ-hJKu3Q2S5fOD9VXvs-zDagvOXdiQMwIEQSOcGVJFL-h3BkMowKgxcpzoQDWO7XXOPUvdhoxiMgHUOTvMA54J7p1ejXuNfEt48I23obQiU64eJUIKCphXGZKs-p35iaJmkNymxszwo9z3DwAgWflRl4M2ptzUhDOlIsYPFD8tjiALXhpP2vkoNijofJkcTyZLMBWvBm2NZqyL1C3ybEsskK9b0VfKBL60atREZHCRctXT1YDl_-c44GsBoLxtB4BprFv4fEfcZ3dStXOY2NCrpHyIEkbGqdc0vUKj9QEMqnEU_ujNQe8kra9g9-Ghly0eQxxvVbL5dAOPhzgnVyi9FQ2DBKN36b63B8gL1xw1NLypdHRK2mPAPq6R2xBIxgixekmNi_w8Z9GaFzUS9oYyZATJYC1re3IZk689_QBEEfC3IoMFd7J6oJuD_T7Az7OyCeFDEj9i_L1wqL5CUrunfKteTOTf0jrvLRCHb-YE

HTTP Parser: No favicon

Compliance

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.18:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.182:443 -> 192.168.2.18:49713 version: TLS 1.2

Software Vulnerabilities

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 32MB

Networking

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56

Source: global traffic	DNS traffic detected: DNS query: ea.pstmrk.it
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.18:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.18:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.182:443 -> 192.168.2.18:49713 version: TLS 1.2

System Summary

Source: classification engine

Classification label: clean0.win@17/7@8/122

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1960,i,16676342856287107313,17193673392059829181,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ea.pstmrk.it/open?m=v3_1.bV7EYmGPAjrBi4aYJaG26Q.pCemdUWL0xochskpB-4GlhbqR_bDmCcFQMaK_Uj6hLotG9B-lhAprfT-xt5bUnPGRAnBtJiXhAEWg26Dxaw3t-AkxZtctPLWrPJ4tRNQ5xGV3GycTiG92Vrn9ke_3cBrfAds6GhJSI73VBL_yF5yepLqUZKQMwi-QQmFI2RBSyunckdjiIHygs_c-7GiUEndW_4vaj-73ksUNJ4NQ3u7OMzcmyvb3GpcNxr6LR-EGsZmp6B84pqCi3SAeNDKU7LiwZ-hJKu3Q2S5fOD9VXvs-zDagvOXdiQMwIEQSOcGVJFL-h3BkMowKgxcpzoQDWO7XXOPUvdhoxiMgHUOTvMA54J7p1ejXuNfEt48I23obQiU64eJUIKCphXGZKs-p35iaJmkNymxszwo9z3DwAgWflRl4M2ptzUhDOlIsYPFD8tjiALXhpP2vkoNijofJkcTyZLMBWvBm2NZqyL1C3ybEsskK9b0VfKBL60atREZHCRctXT1YDl_-c44GsBoLxtB4BprFv4fEfcZ3dStXOY2NCrpHyIEkbGqdc0vUKj9QEMqnEU_ujNQe8kra9g9-Ghly0eQxxvVbL5dAOPhzgnVyi9FQ2DBKN36b63B8gL1xw1NLypdHRK2mPAPq6R2xBIxgixekmNi_w8Z9GaFzUS9oYyZATJYC1re3IZk689_QBEEfC3IoMFd7J6oJuD_T7Az7OyCeFDEj9i_L1wqL5CUrunfKteTOTf0jrvLRCHb-YE"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1960,i,16676342856287107313,17193673392059829181,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Boot Survival

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk