Windows Analysis Report
https://mdr-eu.aisaac.eviden.com:8443/SimMvc/login

ID:	1562367
Product:	CloudBasic
Start time:	14:41:26
Start date:	25.11.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 12:41:57 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	429606A97B7C49C84E9503D0EAE150B4	C302153CA61EF851097D4F4C761685EFC8A05D70	55BA74E334D9E8C95B85128C55EE5868864E35D4F4AEB30C4A49B1B7922E2C70
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 12:41:57 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	9CC3BA9C03BBA1FCDEF82D8DD7897EEA	13830A37F4D4CFCA1C59557C4A128AD37554528B	CF3E58DE59A852C259B97DA70DE6119594A93EA4586480B22D839B6C70620D02
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	C20FB565F8DF41CE65F05D0FB506E9A6	B273E0A46DF49A81985DE5634E0EA84DA66D77CF	AB324A91FBB77EFD5E201F0BA22815B0203ADD3B561049251A9FBC7CE28788F3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 12:41:57 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	4E7381BC72CF6201DC7BA83CBFF8CC0D	C8F2A1651622B250A72430FC6C492193E81C92D7	73C49038DEE734C8C6B6ADC630BEAF06B6A4C0FCCBC44AC66DD8A15CB9B30048
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 12:41:57 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	8B1063078022B36A2CBA06140C0E5BB5	0797836D80B9B2B10196565ECA8CC6889E5A9C18	48F80CD90601229CCDDA39206FAD4B7916CC8FA7B3169ADE911367B29F5AF270
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 12:41:57 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	3B7020C4367F8F4D0C4D162C61A6CB4D	81F108B8618265944E2477EC100C31544ECF3E3C	0CAFFAB2B98D666A2E97AF40691D28EF38B3EDCD52C60144C3CE7899992606A0

Compliance

Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.17:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.17:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.17:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.17:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.21.226.7:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.21.226.7:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.206.197.48:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49727 version: TLS 1.2

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	TCP traffic detected without corresponding DNS query: 40.119.249.228
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.226.7
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13

Source: global traffic	DNS traffic detected: DNS query: mdr-eu.aisaac.eviden.com
Source: global traffic	DNS traffic detected: DNS query: _8443._https.mdr-eu.aisaac.eviden.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.17:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.17:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.17:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.17:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.21.226.7:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.21.226.7:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.206.197.48:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49727 version: TLS 1.2

System Summary

Source: classification engine

Classification label: clean0.win@18/6@4/66

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1984,i,7053316065549914755,6763132464429732706,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mdr-eu.aisaac.eviden.com:8443/SimMvc/login"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1984,i,7053316065549914755,6763132464429732706,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Boot Survival

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk