Windows Analysis Report
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/#8347435238

Overview

General Information

Sample URL:	https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/#8347435238
Analysis ID:	1431701
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Classification

Signatures

Phishing

Phishing site detected (based on favicon image match)

Source: https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/#8347435238

Matcher: Template: facebook matched with high similarity

Source: unknown	HTTPS traffic detected: 104.123.200.136:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.123.200.136:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.136
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /support_case_ID/ HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/assets/index.css HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/assets/jquery.js HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/brand3.png HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/locked3.jpg HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/check.png HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/brand3.png HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/identity.png HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/loading2.gif HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/assets/index.js?ver=0.0.1 HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/check.png HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/locked3.jpg HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/identity.png HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/logo.png HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/loading2.gif HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /support_case_ID/images/logo.png HTTP/1.1Host: rro5wktwxr4n.rollout-specialist-assistance-network.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: rro5wktwxr4n.rollout-specialist-assistance-network.cfd
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_63.2.dr

String found in binary or memory: https://ezgif.com/optimize

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 104.123.200.136:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.123.200.136:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@16/26@6/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2004,i,5022309933837493830,9903495654802082009,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/#8347435238"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2004,i,5022309933837493830,9903495654802082009,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.222.163	rro5wktwxr4n.rollout-specialist-assistance-network.cfd	United States	13335	CLOUDFLARENETUS	false
108.177.122.147	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

Contacted Domains

Name	IP	Active
rro5wktwxr4n.rollout-specialist-assistance-network.cfd	172.67.222.163	true
www.google.com	108.177.122.147	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/images/logo.png	false	Avira URL Cloud: safe	unknown
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/assets/index.js?ver=0.0.1	false	Avira URL Cloud: safe	unknown
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/assets/jquery.js	false	Avira URL Cloud: safe	unknown
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/images/loading2.gif	false	Avira URL Cloud: safe	unknown
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/#8347435238	true		unknown
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/assets/index.css	false	Avira URL Cloud: safe	unknown
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/images/locked3.jpg	false	Avira URL Cloud: safe	unknown
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/images/check.png	false	Avira URL Cloud: safe	unknown
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/images/brand3.png	false	Avira URL Cloud: safe	unknown
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/images/identity.png	false	Avira URL Cloud: safe	unknown
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/	false	Avira URL Cloud: safe	unknown

ID:	1431701
Product:	CloudBasic
Start time:	16:49:57
Start date:	25.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 48	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	B1BFF5910881EEAF5D46E7A30A345D67	8B6ECE8978B08E3710FFBAFBDD9618EEC5717AB1	1BF32EEBC96D971F46D8E5DC0941375B98ECE6C2C3E9138502ED4F9D82882D9E
Chrome Cache Entry: 49	ASCII text, with very long lines (65450), with CRLF line terminators	9AC39DC31635A363E377EDA0F6FBE03F	29FA5AD995E9EC866ECE1D3D0B698FC556580EEE	9A2723C21FB1B7DFF0E2AA5DC6BE24A9670220A17AE21F70FDBC602D1F8ACD38
Chrome Cache Entry: 50	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	B1BFF5910881EEAF5D46E7A30A345D67	8B6ECE8978B08E3710FFBAFBDD9618EEC5717AB1	1BF32EEBC96D971F46D8E5DC0941375B98ECE6C2C3E9138502ED4F9D82882D9E
Chrome Cache Entry: 51	RIFF (little-endian) data, Web/P image	3DDB61BDD806C16C6AA2B1DFDB7EAEC9	5F5CBFD0F1284B09C15884A494758F8626227DD4	62EBFAB29CDF3C417EB48E9C429133D6C4D1B8DDB27FC14820A57B9D5A617AE8
Chrome Cache Entry: 52	ASCII text, with very long lines (3949), with no line terminators	E83E8FFA900BC301B191F1F438A5CC64	A15B044915BE692633C2C2BE6ECAFFC7B8F58572	2C52883DEAC4093E0E6DD93BABD65ADCFA336B0BCA56142ED59D5C55F9AE7761
Chrome Cache Entry: 53	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	9154F49EA3E194FEF598FF0AD9D85ED8	A562EB16EB9BD6EDA78512BAEA3B9DF7D3B160BA	FF07ADF92416D61FE8408504940902FAC913581B92A9947652C2F8D2DB819F2B
Chrome Cache Entry: 54	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 2000x1077, components 3	6496625B2C874CA6705CA0AC41810FB1	38ED9AF6AB1472FE219E4E2901ACDD95C1846DB9	BFDAD424A51E11EF88C6A3A32BFB78605B769FB7AF8C891E9EB6A68B4A52A7DA
Chrome Cache Entry: 55	PNG image data, 152 x 60, 8-bit colormap, non-interlaced	C133C1EA7BC90F4EBB16F71F3F096B19	AAF91BD73C0C13CC518D2995312B6518C0FBE2CD	768441FB3A2B196D8113A12DB4AEAC58C4E763299AA371F05283196ADA05BB58
Chrome Cache Entry: 56	GIF image data, version 89a, 1000 x 750	D01D5A8AC996FB249322B6049EFDB9DE	D5E1E0F7A942A58E196FDF8F8322BE8B687B66D4	4BE99519C4E42B5E733D599BA5D0D40C34E63DCF70DFDF7238E5501A943F7EF8
Chrome Cache Entry: 57	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	9154F49EA3E194FEF598FF0AD9D85ED8	A562EB16EB9BD6EDA78512BAEA3B9DF7D3B160BA	FF07ADF92416D61FE8408504940902FAC913581B92A9947652C2F8D2DB819F2B
Chrome Cache Entry: 58	HTML document, ASCII text	23FF0F74D76204BFD3A1EAD548A556A9	5CB3817AC62BAD8D60C957553C6763178A68EDF7	2E536E30AF04F4185FC59C95CFD25806C25D67D8FDAC5EE62661BF14884EEA0E
Chrome Cache Entry: 59	RIFF (little-endian) data, Web/P image	3DDB61BDD806C16C6AA2B1DFDB7EAEC9	5F5CBFD0F1284B09C15884A494758F8626227DD4	62EBFAB29CDF3C417EB48E9C429133D6C4D1B8DDB27FC14820A57B9D5A617AE8
Chrome Cache Entry: 60	PNG image data, 152 x 60, 8-bit colormap, non-interlaced	C133C1EA7BC90F4EBB16F71F3F096B19	AAF91BD73C0C13CC518D2995312B6518C0FBE2CD	768441FB3A2B196D8113A12DB4AEAC58C4E763299AA371F05283196ADA05BB58
Chrome Cache Entry: 61	ASCII text	E6B95EBEFEE9FA28B9C55F6888E2A1CA	D2F46693FAF32D2DE32A57DDEF7514C0D57EFDC5	D5F38D957553BFE8B6416617B63E4EA7F9F6F9BDEA88AB5863A358A73D7D492D
Chrome Cache Entry: 62	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 2000x1077, components 3	6496625B2C874CA6705CA0AC41810FB1	38ED9AF6AB1472FE219E4E2901ACDD95C1846DB9	BFDAD424A51E11EF88C6A3A32BFB78605B769FB7AF8C891E9EB6A68B4A52A7DA
Chrome Cache Entry: 63	GIF image data, version 89a, 1000 x 750	D01D5A8AC996FB249322B6049EFDB9DE	D5E1E0F7A942A58E196FDF8F8322BE8B687B66D4	4BE99519C4E42B5E733D599BA5D0D40C34E63DCF70DFDF7238E5501A943F7EF8

Windows Analysis Report
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/#8347435238

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/#8347435238

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/#8347435238