Windows Analysis Report
https://railrent-railrent.powerappsportals.com/

Overview

General Information

Sample URL:	https://railrent-railrent.powerappsportals.com/
Analysis ID:	1541080

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected landing page (webpage, office document or email)

HTML page contains obfuscated javascript

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Invalid T&C link found

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected phishing page

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#

LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'railrent-railrent.angebotsecurefile.top' does not match the legitimate domain for Microsoft., The domain contains suspicious elements such as repeated words ('railrent-railrent') and an unusual domain extension ('.top')., The presence of 'angebotsecurefile' in the domain is unrelated to Microsoft and suggests a potential phishing attempt., The URL structure and domain name do not align with any known Microsoft services or subdomains. DOM: 4.4.pages.csv

HTML page contains obfuscated javascript

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: function a0_0x55f2(){var _0x26c7b6=['2866620HUWUCR','search','send','responseText','init','551
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: function a0_0x55f2(){var _0x26c7b6=['2866620HUWUCR','search','send','responseText','init','551

HTML body contains low number of good links

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: Number of links: 0
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://railrent-railrent.angebotsecurefile.top/

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

HTML title does not match URL

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: Title: 1de2bbb08e35bc887f51f2d8e37143f2671a17b0caccd does not match URL
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: Title: 1de2bbb08e35bc887f51f2d8e37143f2671a17b0caccd does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: Invalid link: get a new Microsoft account
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: Invalid link: get a new Microsoft account

Invalid T&C link found

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: Invalid link: Terms of use
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: Invalid link: Privacy & cookies
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: Invalid link: Terms of use
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: Invalid link: Privacy & cookies

Source: https://railrent-railrent.powerappsportals.com/	HTTP Parser: No favicon
Source: https://railrent-railrent.angebotsecurefile.top/	HTTP Parser: No favicon

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: No <meta name="author".. found
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: No <meta name="author".. found

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: No <meta name="copyright".. found
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49823 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56

Source: global traffic	DNS traffic detected: DNS query: railrent-railrent.powerappsportals.com
Source: global traffic	DNS traffic detected: DNS query: content.powerapps.com
Source: global traffic	DNS traffic detected: DNS query: png.pngtree.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: railrent-railrent.angebotsecurefile.top
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49823 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@22/58@28/192

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1952,i,2113892009814936825,5203670263365489659,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://railrent-railrent.powerappsportals.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1952,i,2113892009814936825,5203670263365489659,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: https://railrent-railrent.powerappsportals.com/

LLM: Page contains button: 'AUSGEFLLTE DOKUMENTE ANZEIGEN' Source: '1.0.pages.csv'

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
20.50.64.25	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
13.107.253.45	s-part-0017.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.2.157	png.pngtree.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
104.21.81.69	railrent-railrent.angebotsecurefile.top	United States	13335	CLOUDFLARENETUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.3.157	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.140.116	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.186.74	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.13
192.168.2.14

Contacted Domains

Name	IP	Active
railrent-railrent.angebotsecurefile.top	104.21.81.69	true
a.nel.cloudflare.com	35.190.80.1	true
png.pngtree.com	104.18.2.157	true
challenges.cloudflare.com	104.18.95.41	true
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true
www.google.com	142.250.186.68	true
content.powerapps.com	unknown	unknown
railrent-railrent.powerappsportals.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://railrent-railrent.angebotsecurefile.top/	false	unknown
https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	true	unknown
https://railrent-railrent.powerappsportals.com/	true	unknown
https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	true	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 08:47:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B6E4C5061D158B3E775FE7C63C1D7711	AEE873C1438E3F1525E73793EB02B3A9D6EE04FF	13124DCE48C05F367F5C1BF3C3EFAE5F08D839BFB40F54B068F077FC1B397A5B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 08:47:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C8A4C3BE9AB7478622457761A5942A2E	A49352F4EA79DBFDFC76DC292557576D5BE9C6D0	01207AF64667726687C286A9428F27F5083B188C0786A89E827807FA21EA5366
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B6DD0F61BB281AD0E31738033BFA946E	E024649C19CCD658EEC4220B3C46681C773561FB	368CAC0EAD626172206AD9BF35768733B904B30DBA1BD0894F5DF6AD592B73A3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 08:47:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2487C6A0A477FEDDC317C23F80522C87	1083B8F5B436351B5FC69957DD1FAD8CCA094011	72A33BB4B5EAD837BAEC5C5ED8BD74649D6C552C2AD14661577D061BE81EAF1F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 08:47:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C933395A98A1E00A8FBE4C2A77C604D0	B7B7AED8D6BF26A2DEA9B0D1312FE593BEC3C0C0	D4B250C0F41A030BF42E8CFB32B1885D4BE0E74EDF2E49207C3FE23FF55E43D4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 08:47:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	74C83F91F81BFF92303025613B1A0266	A1ED5C6A9400A99EEA0622BC08890CA2CBDAD870	60341CF094BE6DBF8F5B1594119044DC8D148B86F32457826F2D2C97964608B8
Chrome Cache Entry: 104	PNG image data, 1 x 84, 8-bit/color RGB, non-interlaced	FEE9BF86745FC769EF9FED774A3D7C26	21DE2D1924DFB05B6691C72CB89404C7235BA6F9	8C76010FCF42959391D860BA56E779A3F91CB7D6E7562D3156FF20BA206C7B11
Chrome Cache Entry: 106	ASCII text, with very long lines (11766), with no line terminators	2659C6F064BBDF38AFF3A3F7D33BA256	73EA787E226F755D9F57DC637AEB5A9D506338CF	E3A5A5E3432453A9CDCE2A02DD4D7F08037119C6A9AC545D010D3CF73768825A
Chrome Cache Entry: 107	data	405B7A35392116AA9748104C1DACC203	F381AC29600A2CC55651B61AF31B8C02D98C7D8D	878286895E8E842484F9D5BD056F644A80B9FA35C26B9F1F8F6B22A05204B64A
Chrome Cache Entry: 108	data	676B1EA0397891F0B732A0EEE5BDEC8E	BDBB9B73920AC3FC5D3371F4F93356C0EED1F932	A5F5CCBF7275B24B260CF7A8A33E37C8665AB815A04F9148524C70E4F5F92846
Chrome Cache Entry: 109	ASCII text, with very long lines (39862)	E303D5355313048BECBD7E9429825F82	4ECFDB3DCA8F4AD156D0A0F12FB2ABBB1DBF6D67	CED5EA5C04E6DD8807FA46B2052888EB4798E557C507FC2EC75463FEE17A9AEA
Chrome Cache Entry: 110	ASCII text, with very long lines (47531)	808A57CAE0B6FEE71F46EFDDED44B348	DD570A24C8BDA1B391AA1DDEA6004125818E579A	5B75AC6F98994352699841DFFA6E562725EBBD0005C539946AD3625EC550EB0F
Chrome Cache Entry: 111	data	1FE3B7FA22FE7118FAE69895C5CFDFC7	A2DF61150F14BD48292114A357C5ABDDECD81C52	DFB2363556DBCD46110B6B30C50ED25BAE3F06D121EBD626F643C09EA449E083
Chrome Cache Entry: 112	ASCII text, with no line terminators	011B17B116126E6E0C4A9B0DE9145805	DF63A6EB731FFCE96F79802EFF6D53D00CDA42BC	3418E6E704387A99F1611EB7BB883328A438BA600971E6D692E8BEA60F10B179
Chrome Cache Entry: 113	ASCII text, with very long lines (28287)	9183DA3D63ADCBCA9C451BB60E6E1F10	9207557A291A137EF495DCEF25900E1E5D6F33AA	66AA8F2E328C6461928C45E81A225A7C857185A6A27119BEBFD3F3C321AD555C
Chrome Cache Entry: 114	ASCII text, with very long lines (65312), with CRLF line terminators	2CE6EFB497D50E0FBD335FF651D0E961	4A644F008F5535E2B15DE5A72ACD498C2D5C59C8	37AD3F3C0DB53E8E6D68199A6DF828E7DB31ABE1DE721CB7475A840A6C10C215
Chrome Cache Entry: 115	data	6F432570BC647FB28EB749B6FF5C3D14	B3759BA41D0D70BCD0A0DD150337465243014C02	1F26E69506DA907F8C41E7D8C5E75DBCD9B8A32417B6A4067EAACEC9B6C839FC
Chrome Cache Entry: 116	data	5B787FB8E816A1EBB806ADA9083B9289	7CD9B703FC9345F6A814766F748E36045E497668	E986EC62266FA36A94FA20F9F37C5EF01A1285FD82108D9F4352F473258FCC3D
Chrome Cache Entry: 119	data	7B2322827351568025CA8419365A957F	B9FA8FB1BA4C88F13F58C25DEE57C3DE92BA05B6	24E8001056C6296D6A5111FA3DAC0223B3A50BE53C10AC742F909ED2A618D891
Chrome Cache Entry: 120	data	0E6E20757F2A29A6D10A9E908D91E73C	D0D16E8114DF296C8B7D66FFC9EECA44240C1A92	023ED9934C7E04A5AD8F9A06F2F83B0BD01A73BFEE8D532829585517286E2B1F
Chrome Cache Entry: 121	data	CD3F46D5634BD16AF264E0F571690572	65A61C4C97F8BC367B412014E1A9CC737ED93CB3	ECC065F13E836959DD0598912F76CCE677D8BA90637774DB98D203A18D174E2B
Chrome Cache Entry: 123	data	14214C017C22BD29D8C935E2D8022657	79BEB8F2B43E953F4D4093675EEFD4226085A6DC	6E6B8293DF69BA7075E3BEAC53D15AAE6B212B9FE986F986AB9BDFB0C8F0D3EF
Chrome Cache Entry: 124	gzip compressed data, from Unix, original size modulo 2^32 1864	48B5D52ECB28C0C9B69E09ECB6098F5A	639308E28C2FD96000EF7490217029F74010AA57	D47F4481C1FE273235BE44227F1EBFCF7FF7A28C0C182CC3A1735B5D0DB04044
Chrome Cache Entry: 125	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 237	A8072C336D95162892B26CC9B662619C	3F520D90E2DE962D4597D5875B97E89C1435077D	F8F02BFA48878017341752FBCB5C50862D30D7737B66F32A12ACE6924AE91BE7
Chrome Cache Entry: 126	data	46565556C449269BBE4C146EA7EF26F3	8126FED5DB395E5C56A751688F8CC79F6BFC1AEE	0418565578978A0750874C37741C81F628ED81070F95A8371BEC2837DAD9934D
Chrome Cache Entry: 127	gzip compressed data, from Unix, original size modulo 2^32 17174	70AC134D2E608EE150766B64494A192D	9B4345D6D66BA37AB058ED4EE606FF3558A93C98	F66A34884B26B0351A4F1880756EFB1389EE675E3AB8E024BFBE7DE0D81FB617
Chrome Cache Entry: 128	Unicode text, UTF-8 text, with very long lines (65300), with CRLF line terminators	30EAFD8EF153814B788EB71DB3F1B99C	3C7BD538F6307CAE3DE00D64BD2B742B9E4AFE3B	7FCFD614F45FE132CC914BEEAC10592711BF2760E3732D85DFAFEB4022A3C914
Chrome Cache Entry: 130	gzip compressed data, max compression, from TOPS/20, original size modulo 2^32 92085	3A76F66F8DC8241A2DC143453BD8129E	58A501C5D7788CBAB7217A8275E066D2D346CB51	8B663C1948B1F9EC81A29E9AD60E8C640817D5D0EDB296766E5FD03250875792
Chrome Cache Entry: 131	ASCII text, with no line terminators	F4A0E619B855697F4DB1A1B22FE37E8C	3D1CA30185839E05C6D876C7E8477604BFAC6CDA	CEC86F53B19C31BC124614007553A6EBC5434F9B1D2F03B1DB0393B22AB16EA2
Chrome Cache Entry: 132	assembler source, ASCII text, with CRLF line terminators	FA694BC0473766A8E8F1CDEFB9007BBB	7F69530F8431FA456B9C0C02B65E7C2E197A98C2	AB189E68B67A70C8B40043A6734C512439214A072F5F90C69860A5BA42E71880
Chrome Cache Entry: 135	data	F7262EFF2440429C009F892338273B88	F3352E731F08C02ED5B11121449DBC15FE258E9D	DEAD6443FBAC779C2CC2817EA21D2298B7B7837D92B9D8DEBA4F7E5EDBA4F48A
Chrome Cache Entry: 138	data	6B84C0E69494B475A26C35635506EC0F	7C79A6E6A3B923F229C3EED82CD2F47C236015A6	E2180C9D34349681A7E8A661E5F81AE159C97135088140DD0B775CA8494F0300
Chrome Cache Entry: 139	ASCII text, with very long lines (540), with no line terminators	2739C60227F87D19F5C784BFFB5991F8	42DBAC51553D7778A176E710D3CE1009884DE167	974FECBEBCF2F295348C3631FE069966EAB4B4B57CD4FCBE15FB70D0ACAB47C6
Chrome Cache Entry: 140	data	BB6B95B7D619A32D2209B3F33EB4AB09	DCA978C1DD334B57A7DB4733BA01FF7D642EAF06	3C9B585C8AA9EB8CEFA6794D34A0819811D685FBBF63D8A07B1FC631CFAF47B7
Chrome Cache Entry: 141	data	99FA4D29758E38FBE8C895E0CB623CD5	BA442252256131F776C7CD27BC4A4F7EFA531A6F	31673F275DB9F614F7754B41D8BC22C09E12D9C93CFBAFB56224C7FB40CD7F30
Chrome Cache Entry: 145	gzip compressed data, from Unix, original size modulo 2^32 3651	3F6FC8172C301B8A360C494172244130	AE972756AD83F3CBDDC79ADDEDF7B3EE4CE5263F	40737A9692E491398E4622C564BB53E842325CA1F046FB4D01CB707C12D0435D
Chrome Cache Entry: 146	JSON data	320C8BE42A19CB9DF6A5011CC4E1BC6D	2EEC673BEFEAE800B601D970B4A0E4CA46FABA93	16201845D54E6F4B48E3CBBC60B835FD7B3D31284F4D1F63BD959EE4A09986F5
Chrome Cache Entry: 147	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced	74710B068526106916E5A9AE5B70FA64	2E7344458A5EB6EFB65976EE144BBEDBA680B5AC	55B9B171BB9BC15ACDD21C7A186E1268BC774B6A7C5A6FBC2F2BFEE564890325
Chrome Cache Entry: 148	data	24D5E6582CC82964CBF2471537443280	E949F0058A58495B6C193D83A58C1707914144CE	A2A24A0120BC2CA37F59FCE58CAAFADAD0460CC9D21F8FF917B776289E6CC333
Chrome Cache Entry: 151	data	1686BFB750588A870343FC097ABD634A	B072D5D4EE60B03FCB79E8289C8EA0830B8D0F11	BC6CA6CE7BAB3336208FDC3BAE68C9BCD0928C63759EE77399863EB577EA2806
Chrome Cache Entry: 152	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 153	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 625	7B6F83EEF052A729E3220BB7CC91F1C7	9276D8C9EA4290094A20CA9E4FA0283F3C32AC9A	4C0B15E3AF19E84CCDF93009F63AF8163D5066710D49DCEF48C6A3A307207C2D
Chrome Cache Entry: 154	data	27F597B9BAA79613F0436A06456D67C5	9BB22B7C908895FA8402EDB6A6F0DA7A64C5D9B6	F9AD2A2F39FB9BB114B4FE31FF62516971AB1103CDE2679D438663A3A298F6FA
Chrome Cache Entry: 155	data	AF9DA50087E25BB7EDB86C855F8FE3D7	9CC2DF15FE0F0A0D55AA6E48D119CE81FA27E6A6	E7EBE89E66ACE8A9DF1859B7BE394FCB349C583A4927B771AF57C3655455C05A
Chrome Cache Entry: 156	gzip compressed data, max compression, from TOPS/20, original size modulo 2^32 4807	6CBF512EB242A50CE90F6F672E9353BA	3DCE8E59F835A57FA4FC31B9A060EFDE075108A6	62202118FFFCFAACBFFE0D7BBAC465288E4539315DB18CB3B68509C1D27E3C16
Chrome Cache Entry: 157	data	BE9113501F49768EF1B07AFE6EAA4929	D6C0A00218B0F5F3D44CDFBE4771EED443934CE3	14E081A1853B26D48A86EA1484C919CD7B4D59C3638E5548E0C0B9E3AE8E693A
Chrome Cache Entry: 158	data	B1DBBB0EC99260A111C7E31E86D56E89	47934C859DB9420630748A37EB148DA8EF819121	004E73C6F17B3251FF642DA7E0711B5545ABC3D8FAB788661228EEF9D21AFC97
Chrome Cache Entry: 159	data	55637444600BA1DDE8A37A346D1ACC0E	5C8A880C7338920636077CA9874FD606D01798CE	BCD9481439E9FFE1E44EC5861184F9854F527542AACFBBAB29DF4CEB1FFD5C2A
Chrome Cache Entry: 160	gzip compressed data, from Unix, original size modulo 2^32 1592	BA18073CD15FA18283956F61EB5B73C6	E5FF013632435AACFF936B7E475E10961E550147	8C54FC31C65E9DE63F9A6DFDFC027513B9BA876AD047A5A64132BC60A003BD1B
Chrome Cache Entry: 161	Unicode text, UTF-8 text, with CRLF line terminators	59380F382417BF76CCD73D0E7FC38B7E	9A1227F495EDF0331145EE9FEE187F2F0D1E00B5	2FD89992331C73B2D2383CB19D799425B42AF4EE09290B65B380C29F2412F3C8
Chrome Cache Entry: 163	ASCII text, with very long lines (25293)	805A1661B77834F61B0C8E1175DC9F90	38E8EEB48DF5906F796E4C9A4549DFBF0327D656	B37275F7C7F76430F05A20E7D0DDDAC3649467DBC0E7AF58CC3F04B1EE6DEA81
Chrome Cache Entry: 164	data	A988E7160CEB30A5E2B20644D63481D8	BDA78394C50904A4F9D411E2394A8DE418594ED4	53DB1A4D945BA78BC75B1435B55CDCE89D59A45EBD0489FA0F6EF4D87E4A4E34
Chrome Cache Entry: 167	data	75729389081B9DF7ACB0658155326074	C003E3DCAE74A0A4C9931F9DCEF8645F2D7E5141	3C4CBFC0FE66653DC9BBEF16DA7FC295D80E3B9D193E2D80C2F9BA80F917C35A
Chrome Cache Entry: 168	data	ECDA8B8B2060DD223F4D4AC9A77A4ED9	155A65187A46DB401E434F1C149B852ACBF2A040	8A232BA89D489AB47064DAA9FA43D92E707FD97F361B75174BD0E82EFFBA6F45
Chrome Cache Entry: 171	gzip compressed data, max compression, from TOPS/20, original size modulo 2^32 540048	979003E5EF52233E7C660F2E46809B2F	BDC65524517CE9B148F943BAA43EE4D78F013F37	0A30396F2BAF76951B5C880E431AAAF4F179232CF392C96FB57B2582227201BE
Chrome Cache Entry: 173	ASCII text, with very long lines (64632), with CRLF line terminators	8C396F163B2003283B54A6E105D2B395	CEE717CF5E3DE1C370C83C1C683F172117B2497B	6571F808B2D30448550E0FBCD070074A4381E3A0F5125BA532FD71DAD5824FFB
Chrome Cache Entry: 174	ASCII text, with very long lines (394), with CRLF line terminators	16F567F549BA7B4EAF0559BD527323FA	77E458F5FB123247C0104F72655F07D2CE94DC5B	7C515050A8D0D8CF2D3E17528FE0BFCC5FABC6F766C4069044F214AEE3D7A047
Chrome Cache Entry: 175	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	1CCFEA34F655127024E56A9182D069B2	F01C37FC36D6F283021BFE2021F884756ACC0830	DDEB1C61FE3FC1C4195D6AF3CA1514F8EB78DE09E6DE3DBFCC960DDFDA93EE54

Phishing

AI detected phishing page

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#

HTML page contains obfuscated javascript

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: function a0_0x55f2(){var _0x26c7b6=['2866620HUWUCR','search','send','responseText','init','551
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: function a0_0x55f2(){var _0x26c7b6=['2866620HUWUCR','search','send','responseText','init','551

HTML body contains low number of good links

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: Number of links: 0
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://railrent-railrent.angebotsecurefile.top/

HTML title does not match URL

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: Title: 1de2bbb08e35bc887f51f2d8e37143f2671a17b0caccd does not match URL
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: Title: 1de2bbb08e35bc887f51f2d8e37143f2671a17b0caccd does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: Invalid link: get a new Microsoft account
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: Invalid link: get a new Microsoft account

Invalid T&C link found

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: Invalid link: Terms of use
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: Invalid link: Privacy & cookies
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: Invalid link: Terms of use
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: Invalid link: Privacy & cookies

Source: https://railrent-railrent.powerappsportals.com/	HTTP Parser: No favicon
Source: https://railrent-railrent.angebotsecurefile.top/	HTTP Parser: No favicon

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: No <meta name="author".. found
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: No <meta name="author".. found

Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac	HTTP Parser: No <meta name="copyright".. found
Source: https://railrent-railrent.angebotsecurefile.top/&redirect=e6bb61c79c7d4e2337f9765880e5f79545c8bcdcmain&uid=f253efe302d32ab264a76e0ce65be769671a17b1241ac#	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49823 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56

Source: global traffic	DNS traffic detected: DNS query: railrent-railrent.powerappsportals.com
Source: global traffic	DNS traffic detected: DNS query: content.powerapps.com
Source: global traffic	DNS traffic detected: DNS query: png.pngtree.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: railrent-railrent.angebotsecurefile.top
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49823 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@22/58@28/192

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1952,i,2113892009814936825,5203670263365489659,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://railrent-railrent.powerappsportals.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1952,i,2113892009814936825,5203670263365489659,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: https://railrent-railrent.powerappsportals.com/

LLM: Page contains button: 'AUSGEFLLTE DOKUMENTE ANZEIGEN' Source: '1.0.pages.csv'

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1541080
Product:	CloudBasic
Start time:	11:46:47
Start date:	24.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://railrent-railrent.powerappsportals.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://railrent-railrent.powerappsportals.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://railrent-railrent.powerappsportals.com/