IOC Report
ATT368092.htm

loading gif

Files

File Path
Type
Category
Malicious
ATT368092.htm
HTML document, ASCII text, with very long lines (19156), with CRLF line terminators
initial sample
 malicious
Chrome Cache Entry: 140
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 142
ASCII text, with very long lines (61112)
downloaded
Chrome Cache Entry: 144
ASCII text, with very long lines (65451)
downloaded
Chrome Cache Entry: 145
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
Chrome Cache Entry: 146
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
downloaded
Chrome Cache Entry: 147
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 148
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 149
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 150
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
dropped
Chrome Cache Entry: 151
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 152
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 153
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
downloaded
There are 3 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1720,i,15796333073258949012,17433781827397569583,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\ATT368092.htm

URLs

Name
IP
Malicious
file:///C:/Users/user/Desktop/ATT368092.htm
malicious
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1
142.250.203.110
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js
104.17.25.14
https://cdn-jm-tools.web.app/d..p/others/mi..cro---t/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
199.36.158.100
https://cdn-jm-tools.web.app/d..p/others/mi..cro---t/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
199.36.158.100
https://cdn-jm-tools.web.app/d..p/others/mi..cro---t/Converged_v21033_U7M7Fc-d_yiO2hIJng7nRg2.css
199.36.158.100
https://cdn-jm-tools.web.app/d..p/others/mi..cro---t/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
199.36.158.100
https://cdn-jm-tools.web.app/d..p/others/mi..cro---t/favicon.ico
199.36.158.100
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
142.250.203.109

Domains

Name
IP
Malicious
accounts.google.com
142.250.203.109
cdnjs.cloudflare.com
104.17.25.14
part-0032.t-0009.fdv2-t-msedge.net
13.107.237.60
www.google.com
142.250.203.100
clients.l.google.com
142.250.203.110
cdn-jm-tools.web.app
199.36.158.100
clients2.google.com
unknown

IPs

IP
Domain
Country
Malicious
199.36.158.100
cdn-jm-tools.web.app
United States
192.168.2.1
unknown
unknown
239.255.255.250
unknown
Reserved
142.250.203.100
www.google.com
United States
142.250.203.110
clients.l.google.com
United States
13.107.237.60
part-0032.t-0009.fdv2-t-msedge.net
United States
104.17.25.14
cdnjs.cloudflare.com
United States
127.0.0.1
unknown
unknown
142.250.203.109
accounts.google.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
ahfgeienlihckogmohjhadlkjgocpleb
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gdaefkejpgkiemlaofpalmlakkmbjdnl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
mhjfbmdgcfjbbpaeojofohoefgiehjai
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
S-1-5-21-3853321935-2125563209-4053062332-1002
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
gdaefkejpgkiemlaofpalmlakkmbjdnl
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
kmendfapggjehodndflmmgagdbamhnfd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
neajdppkdcdipfabeoofebfddakdcjhd
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nkeimhogjdpnpccoofpliimaahmaaome
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
nmmhkkegccagdldgiimedpiccmgmieda
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
dr
HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
media.cdm.origin_data
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.reporting
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
media.storage_id_salt
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.account_id
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
module_blocklist_cache_md5_digest
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_seed
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
default_search_provider_data.template_url_data
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
safebrowsing.incidents_sent
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
pinned_tabs
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
browser.show_home_button
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
search_provider_overrides
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.last_triggered_for_default_search
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
prefs.preference_reset_time
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
software_reporter.prompt_version
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
google.services.last_username
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.startup_urls
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
session.restore_on_startup
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
settings_reset_prompt.prompt_wave
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
homepage_is_newtabpage
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
lastrun
HKEY_USERSS-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry
TraceTimeLast
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
S-1-5-21-3853321935-2125563209-4053062332-1002
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
StatusCodes
HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
state
There are 42 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
DC2A28B000
stack
page read and write
2A7E2264000
heap
page read and write
FFF70FE000
stack
page read and write
19400122000
heap
page read and write
F3DD47B000
stack
page read and write
245F5A41000
heap
page read and write
8A30B0C000
stack
page read and write
2A7E2272000
heap
page read and write
25BDE470000
trusted library allocation
page read and write
245F5A55000
heap
page read and write
2261A300000
heap
page read and write
DC2A87E000
stack
page read and write
2A7E2284000
heap
page read and write
1B2BC428000
heap
page read and write
2DA9991C000
heap
page read and write
22619AE2000
heap
page read and write
FFF6EFC000
stack
page read and write
2DA997A0000
trusted library allocation
page read and write
F3DD97E000
stack
page read and write
29613190000
heap
page read and write
193FFC00000
heap
page read and write
1B2BC413000
heap
page read and write
20898DD0000
heap
page read and write
DC2A30E000
stack
page read and write
1B2BC370000
heap
page read and write
29613950000
trusted library allocation
page read and write
25BDE250000
trusted library allocation
page read and write
19400200000
heap
page read and write
29613213000
heap
page read and write
25BDD6D0000
trusted library allocation
page read and write
25BDD767000
heap
page read and write
19400100000
heap
page read and write
F3DD77B000
stack
page read and write
D2BFFFF000
stack
page read and write
20899013000
heap
page read and write
DC2A97F000
stack
page read and write
193FFDE6000
heap
page read and write
2DA99918000
heap
page read and write
22619990000
heap
page read and write
25BDD76F000
heap
page read and write
D2BFCFD000
stack
page read and write
2A7E226A000
heap
page read and write
20898E40000
heap
page read and write
2A7E226B000
heap
page read and write
2DA997E0000
remote allocation
page read and write
2DA99913000
heap
page read and write
193FFC67000
heap
page read and write
2A7E2261000
heap
page read and write
FFF6CFF000
stack
page read and write
2DA995F0000
heap
page read and write
208995D0000
remote allocation
page read and write
25BDD764000
heap
page read and write
19400213000
heap
page read and write
FFF6FFC000
stack
page read and write
22619A00000
heap
page read and write
19400002000
heap
page read and write
8A3127F000
stack
page read and write
2DA99848000
heap
page read and write
193FFC26000
heap
page read and write
245F58C0000
heap
page read and write
F19577C000
stack
page read and write
F19528B000
stack
page read and write
2DA99858000
heap
page read and write
2A7E227D000
heap
page read and write
1B2BC402000
heap
page read and write
2261A339000
heap
page read and write
245F59C0000
trusted library allocation
page read and write
25BDD700000
heap
page read and write
787F79000
stack
page read and write
29613279000
heap
page read and write
2DA99800000
heap
page read and write
193FFA00000
heap
page read and write
F2EE87E000
stack
page read and write
245F5A87000
heap
page read and write
1B2BC443000
heap
page read and write
787DFF000
stack
page read and write
2DA9982A000
heap
page read and write
8A31079000
stack
page read and write
29613200000
heap
page read and write
2A7E2213000
heap
page read and write
25BDE460000
trusted library allocation
page read and write
194001AE000
heap
page read and write
2A7E2302000
heap
page read and write
8A3117E000
stack
page read and write
F2EE1DB000
stack
page read and write
22619AC1000
heap
page read and write
193FFC54000
heap
page read and write
2A7E2246000
heap
page read and write
D2BFBFE000
stack
page read and write
25BDD708000
heap
page read and write
2A7E2200000
heap
page read and write
20899000000
heap
page read and write
20899055000
heap
page read and write
193FFA60000
heap
page read and write
FFF71FE000
stack
page read and write
29613A02000
trusted library allocation
page read and write
19400202000
heap
page read and write
7878DB000
stack
page read and write
2A7E20F0000
heap
page read and write
2261A150000
trusted library allocation
page read and write
2A7E2274000
heap
page read and write
25BDD751000
heap
page read and write
22619ACF000
heap
page read and write
29613313000
heap
page read and write
29613277000
heap
page read and write
22619A13000
heap
page read and write
2A7E223C000
heap
page read and write
D2C00FE000
stack
page read and write
2DA997E0000
remote allocation
page read and write
20898DE0000
heap
page read and write
226199F0000
heap
page read and write
F2EEB7C000
stack
page read and write
245F5A76000
heap
page read and write
29613228000
heap
page read and write
2DA99858000
heap
page read and write
245F5860000
heap
page read and write
2DA99750000
trusted library allocation
page read and write
25BDD965000
heap
page read and write
1B2BC3D0000
heap
page read and write
25BDD767000
heap
page read and write
193FFC3C000
heap
page read and write
F195A7E000
stack
page read and write
F19530E000
stack
page read and write
193FFDBA000
heap
page read and write
245F5A2A000
heap
page read and write
2089905C000
heap
page read and write
2A7E2A02000
trusted library allocation
page read and write
193FFC85000
heap
page read and write
193FFC13000
heap
page read and write
FFF6BFF000
stack
page read and write
193FFC6C000
heap
page read and write
245F5A77000
heap
page read and write
245F5A37000
heap
page read and write
FFF6A7C000
stack
page read and write
2089903D000
heap
page read and write
20899602000
trusted library allocation
page read and write
1B2BCC02000
trusted library allocation
page read and write
2961323E000
heap
page read and write
DC2A77E000
stack
page read and write
1B2BCB30000
trusted library allocation
page read and write
AF3B07A000
stack
page read and write
2A7E223A000
heap
page read and write
2DA9B202000
trusted library allocation
page read and write
D2C01FE000
stack
page read and write
2A7E2257000
heap
page read and write
2A7E2267000
heap
page read and write
1B2BC400000
heap
page read and write
29613302000
heap
page read and write
2A7E2260000
heap
page read and write
25BDD970000
trusted library allocation
page read and write
2DA995E0000
heap
page read and write
2261A202000
heap
page read and write
25BDD960000
heap
page read and write
2A7E2160000
heap
page read and write
20899102000
heap
page read and write
2A7E2265000
heap
page read and write
208995A0000
trusted library allocation
page read and write
2DA99848000
heap
page read and write
22619AD2000
heap
page read and write
245F6202000
trusted library allocation
page read and write
F1959FD000
stack
page read and write
2A7E225A000
heap
page read and write
245F5A02000
heap
page read and write
25BDD6C0000
trusted library allocation
page read and write
2DA99650000
heap
page read and write
2A7E226F000
heap
page read and write
25BDE4C0000
trusted library allocation
page read and write
245F5A7F000
heap
page read and write
22619A44000
heap
page read and write
25BDD500000
trusted library allocation
page read and write
193FFB60000
trusted library allocation
page read and write
2A7E227E000
heap
page read and write
29613180000
heap
page read and write
FFF687B000
stack
page read and write
2DA99902000
heap
page read and write
AF3B1F9000
stack
page read and write
2A7E225E000
heap
page read and write
2A7E2256000
heap
page read and write
2A7E2231000
heap
page read and write
193FFC8A000
heap
page read and write
193FFC8F000
heap
page read and write
2DA99861000
heap
page read and write
2DA99900000
heap
page read and write
25BDD650000
heap
page read and write
193FFC8F000
heap
page read and write
F2EE8FC000
stack
page read and write
29613300000
heap
page read and write
194001BC000
heap
page read and write
F2EE5FB000
stack
page read and write
F2EEA7B000
stack
page read and write
25BDD6E0000
trusted library allocation
page read and write
1B2BC446000
heap
page read and write
193FFD13000
heap
page read and write
F2EE77E000
stack
page read and write
2A7E227B000
heap
page read and write
19400122000
heap
page read and write
2A7E2240000
heap
page read and write
245F5A00000
heap
page read and write
2A7E2100000
heap
page read and write
1B2BC452000
heap
page read and write
2A7E2255000
heap
page read and write
2A7E2263000
heap
page read and write
2A7E225D000
heap
page read and write
19400108000
heap
page read and write
29613264000
heap
page read and write
2A7E2229000
heap
page read and write
29613202000
heap
page read and write
245F5A13000
heap
page read and write
193FFC76000
heap
page read and write
22619B13000
heap
page read and write
1B2BC42F000
heap
page read and write
D2BFA7B000
stack
page read and write
193FFC2C000
heap
page read and write
2261A313000
heap
page read and write
22619AC8000
heap
page read and write
2A7E2190000
trusted library allocation
page read and write
193FF9F0000
heap
page read and write
78827E000
stack
page read and write
2A7E226D000
heap
page read and write
193FFC73000
heap
page read and write
19400102000
heap
page read and write
7882FF000
stack
page read and write
2A7E2277000
heap
page read and write
25BDD950000
heap
page readonly
19400223000
heap
page read and write
F2EEC7E000
stack
page read and write
F2EEE7F000
stack
page read and write
2A7E2259000
heap
page read and write
208995D0000
remote allocation
page read and write
D2BFEFD000
stack
page read and write
2DA99847000
heap
page read and write
D2C03FE000
stack
page read and write
78807A000
stack
page read and write
22619B02000
heap
page read and write
F3DDA7F000
stack
page read and write
25BDD4F0000
heap
page read and write
22619A80000
heap
page read and write
193FFC29000
heap
page read and write
D2C02FE000
stack
page read and write
29613257000
heap
page read and write
AF3AD5E000
stack
page read and write
1940010C000
heap
page read and write
1B2BC41E000
heap
page read and write
2DA9987F000
heap
page read and write
208995D0000
remote allocation
page read and write
787EFB000
stack
page read and write
AF3B0F9000
stack
page read and write
2DA997E0000
remote allocation
page read and write
22619A29000
heap
page read and write
1B2BC43C000
heap
page read and write
AF3ACDC000
stack
page read and write
1B2BC380000
heap
page read and write
25BDD710000
heap
page read and write
296131F0000
heap
page read and write
F1957FC000
stack
page read and write
F1958FE000
stack
page read and write
D2BF87B000
stack
page read and write
2A7E2241000
heap
page read and write
245F5850000
heap
page read and write
193FFB80000
trusted library allocation
page read and write
193FFC3C000
heap
page read and write
1B2BC458000
heap
page read and write
20899029000
heap
page read and write
2A7E225F000
heap
page read and write
787CFB000
stack
page read and write
2DA99802000
heap
page read and write
193FFD8F000
heap
page read and write
2A7E224D000
heap
page read and write
FFF6DFF000
stack
page read and write
245F5B13000
heap
page read and write
AF3ADDE000
stack
page read and write
AF3B27D000
stack
page read and write
F195B7D000
stack
page read and write
7883FF000
stack
page read and write
20899002000
heap
page read and write
245F5B02000
heap
page read and write
DC2A38E000
stack
page read and write
2A7E2262000
heap
page read and write
245F5A80000
heap
page read and write
2DA99770000
trusted library allocation
page read and write
19400154000
heap
page read and write
1940016D000
heap
page read and write
2A7E2268000
heap
page read and write
2A7E2275000
heap
page read and write
19400143000
heap
page read and write
DC2AA7F000
stack
page read and write
25BDD630000
heap
page read and write
F2EED7C000
stack
page read and write
F3DD87F000
stack
page read and write
2DA99857000
heap
page read and write
F2EE9FE000
stack
page read and write
19400190000
heap
page read and write
2DA99889000
heap
page read and write
22619AE7000
heap
page read and write
78817F000
stack
page read and write
25BDD969000
heap
page read and write
25BDD751000
heap
page read and write
2A7E2258000
heap
page read and write
25BDD940000
trusted library allocation
page read and write
245F5A77000
heap
page read and write
22619980000
heap
page read and write
25BDD763000
heap
page read and write
2DA9B1A0000
trusted library allocation
page read and write
193FFC61000
heap
page read and write
2DA9987C000
heap
page read and write
AF3B17F000
stack
page read and write
1B2BC502000
heap
page read and write
2DA99813000
heap
page read and write
8A30F7E000
stack
page read and write
19400228000
heap
page read and write
2A7E225C000
heap
page read and write
25BDD751000
heap
page read and write
25BDD753000
heap
page read and write
19400231000
heap
page read and write
245F5A5B000
heap
page read and write
2DA9983D000
heap
page read and write
There are 306 hidden memdumps, click here to show them.

DOM / HTML

URL
Malicious
file:///C:/Users/user/Desktop/ATT368092.htm
 malicious