IOC Report
https://landsmith.ae/continue.html

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 08:40:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 08:40:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 08:40:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 08:40:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 08:40:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 72
PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 73
ASCII text, with very long lines (65451)
downloaded
Chrome Cache Entry: 74
ASCII text, with very long lines (20322)
dropped
Chrome Cache Entry: 75
ASCII text, with very long lines (50395)
downloaded
Chrome Cache Entry: 76
ASCII text, with very long lines (20322)
downloaded
Chrome Cache Entry: 77
ASCII text, with very long lines (65247)
dropped
Chrome Cache Entry: 78
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 79
HTML document, Unicode text, UTF-8 text, with very long lines (2330), with CRLF line terminators
downloaded
Chrome Cache Entry: 80
ASCII text, with very long lines (65451)
dropped
Chrome Cache Entry: 81
PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 82
PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 83
ASCII text, with very long lines (35968)
downloaded
Chrome Cache Entry: 84
PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 85
PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 86
ASCII text, with very long lines (50395)
dropped
Chrome Cache Entry: 87
ASCII text, with very long lines (6358), with no line terminators
downloaded
Chrome Cache Entry: 88
PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 89
ASCII text, with very long lines (65247)
downloaded
Chrome Cache Entry: 90
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 91
SVG Scalable Vector Graphics image
downloaded
There are 17 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2016,i,7827791726950746962,1557200008942835423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://landsmith.ae/continue.html"

URLs

Name
IP
Malicious
https://landsmith.ae/continue.html
malicious
https://www.google.com/s2/favicons?domain=
unknown
 malicious
https://landsmith.ae/continue.html
malicious
https://go.cpanel.net/ie11deprecation
unknown
https://webmail.hunaintrading.com/cPanel_magic_revision_1626882728/unprotected/cpanel/images/icon-password.png
69.175.95.50
https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
104.18.10.207
https://webmail.hunaintrading.com/cPanel_magic_revision_1626882728/unprotected/cpanel/images/notice-error.png
69.175.95.50
https://webmail.hunaintrading.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Bold-webfont.woff
69.175.95.50
https://webmail.hunaintrading.com/cPanel_magic_revision_1626882728/unprotected/cpanel/images/webmail-logo.svg
69.175.95.50
https://webmail.hunaintrading.com/cPanel_magic_revision_1626882728/unprotected/cpanel/images/notice-
unknown
https://webmail.hunaintrading.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_san
unknown
https://webmail.hunaintrading.com/cPanel_magic_revision_1626882728/unprotected/cpanel/images/icon-username.png
69.175.95.50
https://code.jquery.com/jquery-3.3.1.slim.min.js
151.101.2.137
https://getbootstrap.com/)
unknown
https://go.cpanel.net/privacy
unknown
https://webmail.hunaintrading.com/cPanel_magic_revision_1679634615/unprotected/cpanel/style_v2_optimized.css
69.175.95.50
https://fontawesome.com/license/free
unknown
https://webmail.hunaintrading.com/webmail/jupiter/index.html?mailclient=none
unknown
https://fontawesome.com
unknown
https://webmail.hunaintrading.com/cPanel_magic_revision_1679634615/unprotected/cpanel/style_v2_optim
unknown
https://webmail.hunaintrading.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Bold-webfont.ttf
69.175.95.50
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
104.17.24.14
https://github.com/twbs/bootstrap/graphs/contributors)
unknown
https://webmail.hunaintrading.com/cPanel_magic_revision_1626883681/unprotected/cp_pngbehavior_login.
unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
https://webmail.hunaintrading.com/cPanel_magic_revision_1626882728/unprotected/cpanel/images/webmail
unknown
https://api.telegram.org/bot7678670729:AAFElka9JqIWfv8076B7C-XK_xA8X2eK_VQ/sendMessage
unknown
https://webmail.hunaintrading.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Semibold-webfont.ttf
69.175.95.50
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js
unknown
http://opensource.org/licenses/MIT).
unknown
https://webmail.hunaintrading.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/open_sans.min.css
69.175.95.50
https://webmail.hunaintrading.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Regular-webfont.ttf
69.175.95.50
There are 21 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
stackpath.bootstrapcdn.com
104.18.10.207
code.jquery.com
151.101.2.137
webmail.hunaintrading.com
69.175.95.50
cdnjs.cloudflare.com
104.17.24.14
www.google.com
172.217.16.196
landsmith.ae
103.53.42.223
fp2e7a.wpc.phicdn.net
192.229.221.95
ajax.aspnetcdn.com
unknown

IPs

IP
Domain
Country
Malicious
104.17.24.14
cdnjs.cloudflare.com
United States
104.18.10.207
stackpath.bootstrapcdn.com
United States
103.53.42.223
landsmith.ae
India
192.168.2.5
unknown
unknown
151.101.2.137
code.jquery.com
United States
104.18.11.207
unknown
United States
239.255.255.250
unknown
Reserved
192.168.2.13
unknown
unknown
69.175.95.50
webmail.hunaintrading.com
United States
151.101.194.137
unknown
United States
172.217.16.196
www.google.com
United States
104.17.25.14
unknown
United States
There are 2 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
https://landsmith.ae/continue.html
 malicious
https://landsmith.ae/continue.html
 malicious