hxxps://en[.]exloader[.]net/tree/download_installer/

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
900s
max time network
885s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://en.exloader.net/tree/download_installer/
Sample260628-rxea7ahw9v

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ipapi.co
11	ipapi.co
1	ipapi.co

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4468	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271308751368635"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5632	chrome.exe
5632	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 716	5060	chrome.exe	89
PID 5060 wrote to memory of 4784	5060	chrome.exe	90
PID 5060 wrote to memory of 4784	5060	chrome.exe	90
PID 5060 wrote to memory of 4468	5060	chrome.exe	91
PID 5060 wrote to memory of 1224	5060	chrome.exe	92
PID 5060 wrote to memory of 1224	5060	chrome.exe	92
PID 5060 wrote to memory of 5864	5060	chrome.exe	93
PID 5060 wrote to memory of 5864	5060	chrome.exe	93
PID 5060 wrote to memory of 1960	5060	chrome.exe	94
PID 5060 wrote to memory of 1960	5060	chrome.exe	94
PID 5060 wrote to memory of 1464	5060	chrome.exe	96
PID 5060 wrote to memory of 1464	5060	chrome.exe	96
PID 5060 wrote to memory of 2816	5060	chrome.exe	97
PID 5060 wrote to memory of 5272	5060	chrome.exe	99
PID 5060 wrote to memory of 5272	5060	chrome.exe	99
PID 5060 wrote to memory of 4224	5060	chrome.exe	100
PID 5060 wrote to memory of 4224	5060	chrome.exe	100
PID 5060 wrote to memory of 6124	5060	chrome.exe	104
PID 5060 wrote to memory of 1968	5060	chrome.exe	103
PID 5060 wrote to memory of 6124	5060	chrome.exe	104
PID 5060 wrote to memory of 1968	5060	chrome.exe	103
PID 5060 wrote to memory of 5348	5060	chrome.exe	105
PID 5060 wrote to memory of 5360	5060	chrome.exe	106
PID 5060 wrote to memory of 5348	5060	chrome.exe	105
PID 5060 wrote to memory of 5360	5060	chrome.exe	106
PID 5060 wrote to memory of 1276	5060	chrome.exe	107
PID 5060 wrote to memory of 1276	5060	chrome.exe	107
PID 5060 wrote to memory of 4604	5060	chrome.exe	108
PID 5060 wrote to memory of 4604	5060	chrome.exe	108
PID 5060 wrote to memory of 1504	5060	chrome.exe	109
PID 5060 wrote to memory of 1504	5060	chrome.exe	109
PID 5060 wrote to memory of 5888	5060	chrome.exe	111
PID 5060 wrote to memory of 3968	5060	chrome.exe	112
PID 5060 wrote to memory of 3940	5060	chrome.exe	113
PID 5060 wrote to memory of 5632	5060	chrome.exe	114
PID 5060 wrote to memory of 704	5060	chrome.exe	115
PID 5060 wrote to memory of 704	5060	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://en.exloader.net/tree/download_installer/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ffb11cfc728,0x7ffb11cfc734,0x7ffb11cfc740
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,12995733561940153353,8511683200916915121,262144 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,6322620949053289579,10903001511701773722,524288 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,13065438835480468691,9898461077705912090,524288 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,7577265175995938180,14564527790780956033,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,106593276643042055,414099922514388319,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4972,i,1818258518023289044,15973286298255708225,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,7619364594619683585,571240734847059365,524288 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5760,i,15364480431603846358,1545828090181224080,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5812,i,10284694320903466727,17938322571849865102,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5768,i,3150364625744815269,4547097350257152685,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6100,i,10454528215629683687,8514233132647869341,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5808,i,7363352635196939660,12837459130259768513,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6116,i,16493123376815336969,15093585348672238825,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4752,i,1445166221503411167,16164052235020192613,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5800,i,11336250164660186356,11963443917037184829,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6060,i,16562400249247548,10495621504709198976,2097152 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5080,i,4458349288448808784,18383724188509589710,524288 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5064,i,15670801750515719623,3040165841847313139,524288 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,2107344643541270293,12172816960360348422,524288 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5896,i,5781559951193023560,17757708539155009552,262144 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,11953529059893277127,6698320053887238837,524288 --field-trial-handle=1876,i,10354472567239085521,10302563541456329530,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5188

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 1d34f75518e80c3dd994bc4b9106592d885b63a0f456d105dccb2a55b84309d2
MD5 1be0ab3c6d7605d11f54abbc43d0a26e
SHA1 ac51cdc666dc08f08d82d282f71b9ab44441e053
SHA512 d4fcaf01212badc0057357b8fc90192a218c98e42af6ef74abe3aae29c2ec11125a685c15032204fa8a093c24f6f3613a7e91995693d87cdb3f95b48906a9b3b
TLSH
T1D2E02B5394DC3844CF8C2D3068E06DF1FF645418B6B6076320BD48F8D87F6E5A247054
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 f09e320859cf9afb567fe699ac391eb08499890d3f08e0d14034e7121687c767
MD5 2702af832d75e2fdb5ccffc2eb6558b3
SHA1 b2bda07b7a7891203fae1edea51327fd8909e617
SHA512 61ed0e1e985205cfa283387064e2b07e7a7c30aed246b4039cd1946601ed97239d20cdbb7faea1578145c01d2f816a511d3211bd7810bbdfa425d52e5b102b7d
SSDEEP 96:DmJwJiJgJy/txrfrSDJ1GtIXBxuZBbeK8dxPiwbq+PiuPiP/:DmJwJiJgJ8txLrSDJ1GtIXrGFeK8dxP6
TLSH
T110B16CF7D3E8866D9D2152F6A6252F1FCD2D0928435C3C6A89D49E0BE3E1971F28064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f09de8d3a0fb8db404c4bdcc510cd7b70bc0a465aa39dd08f2ada2a9762f8b65
MD5 32bf59f259211dc83487d826c1bef825
SHA1 c3ef9f328f1e80a811c48ca7f6d5b5bbf0188379
SHA512 cfc0bc9de1b15eb22afc3a0effe10359f11f44a0d6bcd971102366d835e09a75ab24095c1faaf4577e11901cf6dbe552dd3bc6ef0992d94503dbe29c4cc160ec
SSDEEP 192:DhJEJaGJuLtxLrSDJ1GtIXrWFeK8dxPr8N+P3uPiS/:DPgaGJuLtxLrSDJ1GtIXrWAK8dxDw+PM
TLSH
T1B3D15AF7D3E88A6E8D2552F6A6252E1FCD1D0928435C3D6A89D49F0BE3E1970F24054F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 fe08bb6ae23e6a37d24f4c31e86ddf5ef4c0343fb94c94b43728ea4747518713
MD5 6846b12ef10451bbafaf409efc8b98fc
SHA1 e0d7ef08c22d795b67e99f36251aa04366d809fc
SHA512 fdcb5c7d280424b8e4a292a9c1a07ad19eaaa21625a9b67390566196a4285090187bf36c778ecd9ce2a65ce39fc7d463bed6353d45af9cabe6b07a7536f2ed04
SSDEEP 96:DmJwJmiJgT/txrfrSDJ1GtIXBxuZBbeK8dxPiwbq+PiuPir/:DmJwJmiJgLtxLrSDJ1GtIXrGFeK8dxPi
TLSH
T148B17BF7D3E88A6D9D2152F6A6252F1FCD290928435C3C6A89D49E0BE3E1971F28054F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6eabac3156906bb027b0fc0fae49abf2b9ade703005e59dbbbf2859b7758c353
MD5 912778e24ce0f98450090bfb4b77a272
SHA1 7ea20ab76e974d5578029643a40b6fc5aac8745e
SHA512 18da4cde7350fec7f6829fab6d9f1bb81373c134614726066884ed6af84011d78efbf8fd38c198615d3b1077bac51cf493b5643a0aa1adfe1ac15a066e978b01
TLSH
T164417BB7C3D4997D8A4156F8AB156F2ACE290A15531C3C17CDD4AF0F53E2872D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 efc5efbc330cba7f5b40fba76ce2202c4feed5b10eccd6d34c02b3e2e4a957eb
MD5 b92f9131057e94a6031e875ed9382dea
SHA1 8c61b0438f9b5b725165810f30bf2b0f3271dcd4
SHA512 7f7f3200fe7a85c36527fcc229ce7f52e9c3798453c334d054283e7bdc0d04ee8e9b354d1f81df38ea31970d8d9c0e4c40d11b74be29d567cfe4d7ca00026d53
TLSH
T12F215AD7B17FB82F106F587B1F44784A59BBB432068268F4DEA6413CB0C28B71B06456
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b7c55ba2924fb5db0fa3e54c677618347cd0dfed53a547439040dad69470adbb
MD5 3c1075374a284e768f30dbf2503a9f83
SHA1 bc344cd9fdc2a75575d56da44df87c145aa1de6a
SHA512 3e35304985c38bddf6ee1504bce8759dfc183f1f20c382e75cff0fdc7846dd737b1a0040b5b54373d602140b39eb9a765983bd7b2b4efecbf23c797cfc00c81c
SSDEEP 192:7R0qLqQCv7+vAPRp2XS9mHsb+WNn1rCoZ2vsep2uFVyIsnAUgR:7R0qTO66X3Qw132P26R
TLSH
T11532A62EEA10693B5CDBD61AFD627757E6F5102131D42D84E7FC8A2C11E79CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f1bf307e1ab2ee54b8c60a2ab18b7127d84001aa2261aebefe77853f85a5b8d3
MD5 b7d90872fc12050c437906cfbb19309b
SHA1 56170aa629a022fc70e4c89f4f3cb356f061c0d7
SHA512 40c6997f52fd15dc92a0ec1c3ef6a7f11db194d119330e17ae20496b9a16520f625a4b87d4ddba2e969ec066b37fd046b68ee730dc2cd92215c04d64cf57a128
SSDEEP 192:7R0qLqQCv7+vLPRppXS9mHsb+WNn1rCoZ2psep2u2VyIsnAUgE:7R0qTO6bXQQw132B2ZE
TLSH
T14342952EEA10693B9CDBD619F9667B57E6F5102131D02E84E7FCCA2C15E79CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f49ad26f-59f3-4248-a6a6-28df11b074c0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f49ad26f-59f3-4248-a6a6-28df11b074c0.tmp
Size 11KB
SHA256 12992408d1e77aa847dd8bcf626a41abb69123e736fe559154b64dcc42ccef96
MD5 73f3f91ca65e816ba073ed8862d0b9f7
SHA1 6b3ff202d0096c19d901bb81c2f8d0bd73ba9181
SHA512 056823b6d4b0f09492b2a90665c31eb1d65d4e0142173ff21bec780b577cf12f3c09f314b83ebee917e5c54426074676accbd5c0e50012a7f56ec50a62bcfa3f
SSDEEP 192:e8z4K66Q7KxkXqK4I40pUZNCgVLHrKHfFKslEx0kSXzKD/tQ+ErUkKN935o8CUXB:ZzjlQ7KxkXqKf/pUZNCgVLH2HfgslcPR
TLSH
T1D432D827A58D9A7F0FD8E90DCC526F8B6CB5019676680C2492FF9D0803A5BCA114E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8075ad33ace730d76ad07e0d023d410097fac1f5c0bdf7f2f08b41cfc2d4df9b
MD5 1dad464d104e31661f75009c6bd7f309
SHA1 d06d1ea712faeb73e910813077515d8d13b27b5b
SHA512 baaaaaaae97840c656dfae250fef397ce80fa1cb43b9a4d051550674bb36d1101fc20cbdb7b4fae3a81b10c2ac781b87dbd6fcc512f5466a142719ef974811e4
SSDEEP 96:4C0d+kaO2Zqk3kfIbEOERDotok5uvD6B6iGyv0mEEshSmbx4+v4a:4C0PGZqk3fYNDUDEqWmErhSmbx4g
TLSH
T1DAA10C32A46ECD779471E585B5832F03CE686167A5529F84EDEE4F0C21A70EC1346637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bc85608febeb64f10e1ca9c6adeb2cba7094be3d13a83199f2911a28f30e83f3
MD5 719e172df2857fafd01aa7009522ae50
SHA1 ea417c54b7ccd16beee2db665049c37faf2fbe7e
SHA512 77f3576fe3a48da07f7913e0e6115dde94f53fae1423b62bdd3d97b38d39dc6253a06550dd48778406516907dcc41881a54128c9530f74ae1807f5275ea9eecc
SSDEEP 96:4C0d+kaO2Zqk3kfIqREOpSl8h4otop5u/D6B65Gyv0mEcAlMlQS9D0j9IpqoT4t/:4C0PGZqk3fjKiU2UqJmEcAylQS9DUOqX
TLSH
T11EC12B72E4AD9C7355B2E682F4432B03CDA8516BD955AF54DAEA0F0C11E70EC1387637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f1f6a1dd11d8e9052c572634df62179453ea6f5af4676a7bb2430f9af481466e
MD5 e65b73bda7c5807e0eb8fd31df6eccbe
SHA1 92d259cf40a7008c1b710cea40aa4a773395e5ee
SHA512 838d36bcb2235fe4b0401f7f27a136bdb158496c81031e48bb84d32da3af960af2e5b39759149944ad7eca30fad3b59b74d0108b6b8ef0e6e47f838410204d05
SSDEEP 96:aC0d+kaO2Zqk3kfIqREOpSl8h4otop5u/D6B65Gyv0mEcADM6QS9D0j9IpqoT4t/:aC0PGZqk3fjKiU2UqJmEcAA6QS9DUOqX
TLSH
T196C11972E8ADDC7355B2E682B4432B03CDA851ABD951AF54DAEA0F0C11E70EC1387637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 5f1b010ec9730ec0f7f9b52a5ff4aed1adfe3f95d52863acf7418ba0ae6da45f
MD5 7ed39c4b173ac31d44372a96824ac662
SHA1 14d1e06f97fac029a70277e0a78e5b152e11aa3f
SHA512 63015fcd501796ceb9f58be6514f1dae5ffde4a8d5d1123e5067527de685a9385c1624f93253ccc6715a07d0a93e9857e0ff77281aee57601758be711c382e09
SSDEEP 768:8O6PvMnAg3HJ1NyDICl2X5ha+5K4G0Z9t6GedeXve0sb5CmI7hpo9qeHtTlGMh:96tNDICl0h/fZ9t1edkWl5Ctpo9qeN84
TLSH
T14013E139809DCA5F0E78F2C2B092BE874EF565D3A0A63C949C5F198E01856ED1317773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e7fc0d936594a69270bbb55f1c4f5aa68051e076b11ddac3723dab130bfd68e1
MD5 c416e67a24867908a4392d8d64f04c52
SHA1 937c52bd970376e2a473e9d67f15c82f6ed54fbc
SHA512 a67939002b93f49c91fe2e1031bd8790f1bd300a3146781dbc6a543f868399097f454c5c52421defe4872f4be2ee1f31417942b0689a0d97a6104d42cd5ed934
SSDEEP 96:abJ0d+kaO2Zqk3kfIqREOpSl8h4otop5u/D6B65Gyv0mEcADM6QS9D0j9IpqoT4l:at0PGZqk3fjKiU2UqJmEcAA6QS9DUOqX
TLSH
T116C12A71E8ADDC7355B2E682B4432B03CDA8516BD955AF54DAEA0F0C11E70EC1387637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8da8f0f-ea78-480d-9ca0-f13a31b98c0a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b8da8f0f-ea78-480d-9ca0-f13a31b98c0a.tmp
Size 5KB
SHA256 a3c1b38a7e1dca542ed3b75b132817b1b70810cd3399b03d1e4b9f5d5ddf7e32
MD5 09e60cdeb1f448203dd3689ba22ca11c
SHA1 9a077e8d7e14e15a7b019346f9a582e3ce9b560d
SHA512 7baf5b789df0ede8dba1b2b885943c7f96a5c3af38c28cb91a992ad9a91bccbf478c3905dce8f4aa374f7e1b00820c72eec25c80429afc34c09e46c9a7ff7234
SSDEEP 96:abJod+kaO2Zqk3kfIqREOpSl8h4otop5u/D6B65Gyv0mEcpMcQSrRNC39ISyVNlc:atoPGZqk3fjKiU2UqJmEcucQSruCPMow
TLSH
T197C1F872D45E9D7798B2F945B0432E43CDA8516BA955BE58EDEA0F0C01E70EC1383237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download