Windows Analysis Report
https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$

Overview

General Information

Sample URL:	https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyct
Analysis ID:	1432232

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

Signatures

URL contains potential PII (phishing indication)

Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.12:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.219.0.152:443 -> 192.168.2.17:49720 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.6.64
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112

Source: global traffic	DNS traffic detected: DNS query: clickproxy.retailrocket.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.12:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.219.0.152:443 -> 192.168.2.17:49720 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@15/6@4/97

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1776,i,11745920494594389,8939508074749307379,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1776,i,11745920494594389,8939508074749307379,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.178.50.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
74.125.26.84	unknown	United States	15169	GOOGLEUS	false
192.178.50.46	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.165.195	unknown	United States	15169	GOOGLEUS	false
142.251.35.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.217.238	unknown	United States	15169	GOOGLEUS	false
193.17.93.93	cl-ca3c00b0.edgecdn.world	Russian Federation	209418	ASN-KUKUAIT	false

Private

IP
192.168.2.17
192.168.2.4

Contacted Domains

Name	IP	Active
cl-ca3c00b0.edgecdn.world	193.17.93.93	true
www.google.com	142.251.35.228	true
clickproxy.retailrocket.net	unknown	unknown

Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$

ID:	1432232
Product:	CloudBasic
Start time:	18:01:51
Start date:	26.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 15:02:25 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	3B74BC3C4A511C8E4FA299387635BEDA	293C90E24DB6810DBB6272F8EF5D4D8286F5E299	5C10044BAC3834034198C7DDA99936E4539A6D42D099AA84448C55DBB6D1A7B8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 15:02:25 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	AB9839E6026D8B84D5FD9FD4147929F7	0A0ED6528E0209DA14627736772F8AD7AE2994A7	49BE3B12876CBC575918FB87C0AC5FB600281988E7FDD72A0C879AAC30822FE5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	2DA8E3F29B07E78D252046E41D82F1EB	867020637F4E489B136F106D7760664A8D07820F	7983E215B1A8647714AAC1935DC566B19EE8EF39980F670F3FABB935D7445F3B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 15:02:25 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F40CFEE4074C6ECE5BA7EF1F8C4E5F90	47A578857F2DBEF4D541BE58AF2CA755C6245A84	F26D43B1C74C8F7D3D83BFF644C7BB54753D77B81BE2A9F137924670EEE4A2DB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 15:02:25 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	C547F2F514482C11DF0DFCCCA15C74D6	B0183D0035DDCA3C042E2A8F0CC86D46D89D8114	2183D7DFD77051E27FFB6190CD448BF4E9CC0797797EF5BD2074F14BD925C061
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 15:02:25 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B4FB3A98640204A1AD5B91986E30D010	395D92DF14C515D27B04097DF88F1E27945D32C1	8CAFC6CB390FEAB48B3AC7F0ACD79966A29FD5C0C3D5E0AF4319109AF14C905E

Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$
Source: https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$	Sample URL: PII: https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$

Windows Analysis Report
https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report https://clickproxy.retailrocket.net/?url=https*3A*2F*2Ftocafootball.net*auth*cred*muowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report
https://clickproxy.retailrocket.net/?url=https3A2F2Ftocafootball.netauthcredmuowj5*james.laufman@automationanywhere.com__;JSUlLy8vLw!!BHlfX_zbyOAjqHI!zHvvcPnXBAkkLycQe5qD8UDSOTlGzeWMqwuayGo8vyctnqkCxBKd39LtgqPAZ3sR4XqqsS8gyKZjUckizpLqmTBUPl6ZxcUmIVb0QZWQeT0T$