hxxp://67speed[.]com

Analysis

user interaction
yes
max time kernel
71s
max time network
73s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://67speed.com
Sample260702-qvtgnaft21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
924	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274729972440666"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe
Token: SeShutdownPrivilege	6112	chrome.exe
Token: SeCreatePagefilePrivilege	6112	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 2532	6112	chrome.exe	88
PID 6112 wrote to memory of 924	6112	chrome.exe	90
PID 6112 wrote to memory of 1420	6112	chrome.exe	91
PID 6112 wrote to memory of 1420	6112	chrome.exe	91
PID 6112 wrote to memory of 4748	6112	chrome.exe	89
PID 6112 wrote to memory of 4748	6112	chrome.exe	89
PID 6112 wrote to memory of 2060	6112	chrome.exe	93
PID 6112 wrote to memory of 2060	6112	chrome.exe	93
PID 6112 wrote to memory of 4468	6112	chrome.exe	94
PID 6112 wrote to memory of 4468	6112	chrome.exe	94
PID 6112 wrote to memory of 4532	6112	chrome.exe	95
PID 6112 wrote to memory of 4532	6112	chrome.exe	95
PID 6112 wrote to memory of 1020	6112	chrome.exe	96
PID 6112 wrote to memory of 1020	6112	chrome.exe	96
PID 6112 wrote to memory of 5452	6112	chrome.exe	98
PID 6112 wrote to memory of 4888	6112	chrome.exe	99
PID 6112 wrote to memory of 2280	6112	chrome.exe	100
PID 6112 wrote to memory of 3988	6112	chrome.exe	101
PID 6112 wrote to memory of 2736	6112	chrome.exe	103
PID 6112 wrote to memory of 2736	6112	chrome.exe	103
PID 6112 wrote to memory of 760	6112	chrome.exe	104
PID 6112 wrote to memory of 760	6112	chrome.exe	104
PID 6112 wrote to memory of 3348	6112	chrome.exe	105
PID 6112 wrote to memory of 3348	6112	chrome.exe	105
PID 6112 wrote to memory of 5168	6112	chrome.exe	108
PID 6112 wrote to memory of 3404	6112	chrome.exe	109
PID 6112 wrote to memory of 5168	6112	chrome.exe	108
PID 6112 wrote to memory of 3404	6112	chrome.exe	109
PID 6112 wrote to memory of 5456	6112	chrome.exe	110
PID 6112 wrote to memory of 724	6112	chrome.exe	111
PID 6112 wrote to memory of 5456	6112	chrome.exe	110
PID 6112 wrote to memory of 724	6112	chrome.exe	111
PID 6112 wrote to memory of 1760	6112	chrome.exe	112
PID 6112 wrote to memory of 1760	6112	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://67speed.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff84c36c728,0x7ff84c36c734,0x7ff84c36c740
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,10394922971912730664,15863287593329176686,262144 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,1603421530843319801,6916947011304570,524288 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
  2⤵
  - System Time Discovery
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,16781873288994994937,15647300270622652890,524288 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:13
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,6312083462241030910,6167938166590113816,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,693332671503547413,14999903155157865178,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,17437457172812401219,8707899322164556818,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,8744927173659728157,13031884383017340339,524288 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:12
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,8603055283000450512,11711810901452144499,524288 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,17003682828784108126,8319727332109624491,524288 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,13294033267943534259,10192566932419537797,524288 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,18428673197115637681,11191044100330216927,524288 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5228,i,2601875761553687481,16989707516693912859,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5740,i,13652112798643760839,12649991287157077106,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5716,i,6006127824869605065,9788230312242170762,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5244,i,17063276821945201658,16849124905123315633,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5232,i,17021574341876741232,650886339374302750,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5904,i,5591209881837873558,16270526378604281590,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6004,i,14966336456303119688,17665536577434188055,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5908,i,12496870433969219752,17187994543909506804,2097152 --field-trial-handle=1932,i,10034916764771627628,2883040625585980048,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 1024KB
SHA256 eea63c989757faed0ede23cdecceac1fa3d398ffda6b4af43efc950220a029a3
MD5 9ea535b3d140ddcad95a1ba12c764af0
SHA1 a648250c1821814ecd98e4147127d70acaf3fde5
SHA512 94a28c5aa6a83bf7d1e42cd42a367c71825af1ea01e51183c3fdadcbd88da6e78098e522acd33b170b54b3310798f67c2f216361c0f0305cad46c7d1619ac9a9
SSDEEP 24576:tw1htalgTbeCjbYQk1+CUa3Dbz0WNM9enTdHy5BbZgEixKQR1u40Ehd:t+hjkQC9UKa9+TgZgWQNJhd
TLSH
T1952533817DD56947686264337839E3DC25C121D0ADCBFD18EA922A7DCC16DE86EFBE00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 1024KB
SHA256 b4608b5d136c3da628204f6451cf02c149efdf3a5fad2c713dc3014533ed00a6
MD5 719d70986a87c83e411eac79303602a1
SHA1 9ab6672195b51364f3d4f9562813fdea25eb6eb8
SHA512 4d70ef4985ed9b2ceda5e554d5238ac79132e4a5103ce1afe182b978fe82f13862e0756cc40da859b14670daaab9b07fef4ee4f6e51beac4f0dd4d4bb6d3bf4a
SSDEEP 24576:+oq5b1i6LF5MpQpZN6Z7dF27QcQZlteUvQNT1Yw28+2:dqR1OQ5wdF2Ilte0YJc2
TLSH
T1AE253369AE15E43A29741D5BCDB8F15BF198D061F122007E7AA5DE478BF070B2270BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 42b281f55de1e568ae1f839124ee035726e506850c6508248beb6bab2e534d2d
MD5 4198dc10905f34599c7204ff6199dd71
SHA1 32e8f0237b6ee53006511ac5d01c2a9a80309b65
SHA512 2b85fa956e7b6615e28dbbff67085ea39834a6a46ed782e7cc473f3cf5a18342b954c97902a09e2211a52b9d54abbb991e9484a5ab39d233a7d53ac66c0b54ff
TLSH
T1FFD01247B2901B82DBCA32B15BC668042834270B4E461B03409041A8AB297E1F145016
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a46ff4671c40f2609d619be7b18bb4ec4d78e5cd1a1c431f7c649d8075d81f1b
MD5 68e083ec003471cac25c1e80d2926f31
SHA1 c86a6e52fd5fd22be6335a55895cdec67e2f91c7
SHA512 b6ba984caed663e26fdf59e15f9277a91bbb9cce7a1199215bc964e7d4b561454115775c80758bd303ac83ba10295ac53587fd83e4f4a8870bfa99cce47772e8
SSDEEP 96:Dubunueu3KYZNo/NjuLuQaufuIuMusjuaVyu0Mu9WuuHu5:DiSh0KYZNmNjqpaYDnTzVyVMKWHH2
TLSH
T1A7B1A0F7C3E8867DC81255F5AB142E1FCE290924A32C3C26C9D5AF4F63E18B1D24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7cab13e93830fac12ec5ede28f0695bc81026328ee49c0b082be9c5f81348225
MD5 e0c0ac983fc9b2a0c10d4387d1f68b47
SHA1 916ebd80ce52b49d9fb8d8769fa36d0f5e49440f
SHA512 aa4f2ab9764d7410a4100ab770e3a7aefe2c6ac695660ad77c902c8a205baced620cd9621a7c1a4281eec1bff0b6d59879242b67cea3ed4887eadb956de048a1
SSDEEP 192:ORhQlbov722u/vePRpA5vJ9gHsb+WNnZSTUAQf8efn7mVyIsnAUgL:ORhQp0aTYXOywsrQt+L
TLSH
T1E232A76EA91465779CCBD71DFD257B63E3F5202125E01E88DAFC8A2C16E75CC621302B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8987cb7ada86b7c0d12884502af983ba496ecbab54a07fe7c49705f1bdbc62b4
MD5 62d83a5e23e2ae174ada6667dfc1de87
SHA1 e04ebdd001767d92eb7c6a51e7ad674bc47dcb92
SHA512 028e4dfa6929e726fe699d675cc79feed1fe9c00fc34d8c3bc092bc18e55c58da9cb81bcce17eed5ef3701dfe5f227a2123f471e33373c01481c760bcf054551
SSDEEP 192:eO94K67b7KxkXqK4I40pUZNCgVLHrKHfFKslE6ZXXzKD/QX+ErUkKN9CUS1vG6QB:T9jYb7KxkXqKf/pUZNCgVLH2HfgslNXy
TLSH
T1FA32DA27948D9A3F4FD8D50DDC166F8B6DB4029673780C24A6FB9C0803A57CE215A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2023f66-93f4-4ed0-8a1e-d36b6b02bc07.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d2023f66-93f4-4ed0-8a1e-d36b6b02bc07.tmp
Size 10KB
SHA256 c61f85bf4dd4f14176a0bb9594738373cb6351c05ddb8492ae7961583d2ca00b
MD5 a87ce1de21734c9a6d857b505efe5e26
SHA1 5cc02a8877998e43d630029dad14f8d7645a54bc
SHA512 5fdfcc43b864ef5a9de2e923fb79f954d4e17a34134c96bc5c77890d93fd4ac3a3fb1044b81bb4faedc62a208166e6c3606a859e1aefbab4e73386bfb7482f2e
SSDEEP 192:ORhQlbov722u/vAPRp25vJ9gHsb+WNnZST9B2e8ef9mVyIsnAUgR:ORhQp0aT6Xkywsf2q+R
TLSH
T18C32846EA914653B5CCBD729FD257763E3F5102121E02E88EAFC8A2C16E75CC621342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 8b085c2bef9f30861876ea343e3c8463f2aca282669f8850494e6725d6cc6094
MD5 e5472191ca38c78e44b4e76f49d6ff7a
SHA1 9da7cb2ad7d0c63905e7824693a0bb5e4dbeb723
SHA512 327afa4f9a495c9d11f3cb819d0354535716edbc0ebf4eee29b2614f0efe6fb11d7f33517c86eca3f7f86bf9ca3502db0bcee96f19bc745b5cc9d77b3dccf0e3
SSDEEP 768:eC0PoG2h//aOhbFuNA/3lwIPt4kw8zoT6af/oExE09IsE1iBg119P+4X8n:l0CRCOhbFumoR6yRE0WRQg1G4Xu
TLSH
T10F13F130BC6DBDF729B6614BB002794B1D1D1296AA61F60AFCCE3B4C18971CA530967B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 fdba47382b82fa5fbc70b17b12e182e242d3800595ba6c9ed782e796d8611876
MD5 63a40bf1a710e8dc3eb11cda96996a1b
SHA1 92970adedac4e2b28ee136c66d2582ce27db242c
SHA512 e577705dcd974dc076a57efdb17808c88a9d49456940658aeaf78299bb01f41505471350ba14c6a4bdbe1b9a06377298d0ac3d1cc78789dccc0a8ae139e7420e
SSDEEP 96:eC6v1d+6YI1dEYQHofAK8WyrQdYSl8h4otop5ZsD2B6tGyvS6XbxwHLeOf4Ey9QQ:eCC1YIcYkVK8Wy9iU2Ym9ULx4efEy9QQ
TLSH
T1A2C1087168BC6DB35EF6DA4676073A53CFB4616B5A64AF58DEDA0F0C01EB0EC1342212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a54569fb6c81b14b520abaa449d1f480bab0e35641f9d7aae548de55d9a4ab91
MD5 19b58997b9cd39368cfe499b16fb839e
SHA1 b24698b322abc899d6edf17118365ee1cdf1e15d
SHA512 d685288e82040dbc074f62db9e4213013851071607da0216c72bde9309a7d4817c655a39f42e6bfdf00fb63941f3dc7cce4b4c92411f005ac1c12654943a7d12
SSDEEP 96:8bJ6v1d+6YI1dEYQHofAK8WyrQdYSl8h4otop5ZsD2B6tGyvS6XbxwHLeOf4Ch9f:8tC1YIcYkVK8Wy9iU2Ym9ULx4efCh9QQ
TLSH
T1A7C1087168AD5CB35EF6DA4676023A53CFB4616B5B649F58DEDA0F0C01EB1EC1342222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 abf389b54e68dab75cc8983bdbcb4010a6430cc067beb4f0c9fe137481b5ff6d
MD5 8786ccc8b7f219a0c9d0f60ce6797509
SHA1 ae0af8e24169cd4b1be9208e22d93175cb7aaaee
SHA512 0de3835ef83304ef1951730aeff549f0816f945aec9025e75bc310a7942e0c43b24e1b3ade41e3c6b5cd38c370ef0cdab80a31892e9b84d6979c427eaaf23594
SSDEEP 96:eC6v1d+6YI1dEYQHofAK8WyoCdPRDotok5ZgD2B6XGyvSO8Q9PEtvZF9v4a:eCC1YIcYkVK8Wyo8DUDAmv88Q9sthFh
TLSH
T1F1A1F731696C4DB358B6C68976023B43CF68B06B6A71EF88DEDD5A0C11BB0F91302223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download