hxxp://url6002[.]wordsmith[.]ai/wf/open?upn=u001[.]ROfWac9jK8tu2pZGpfDWWX-2BoN1eEQy7HMAjQ30kZXIw4kNZnaftJ26ciy2c4FuPSzpIEVFk0wJUeB1rotliEcw0tZYy29WJ3oj1Z4E4lerJVe4g5cziFruE5j09mauBctHRWMvjppWp1T4MIkiN8DApejwtp6sjQ4sGrdhLjBwuatlFoEPCzmenFl5Osj9VJcSJs41frpJDsMkUCj1iBYEXABKkGPFUerwfe6fHRuL0-3D

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
149s
max time network
142s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/09/2026, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url6002.wordsmith.ai/wf/open?upn=u001.ROfWac9jK8tu2pZGpfDWWX-2BoN1eEQy7HMAjQ30kZXIw4kNZnaftJ26ciy2c4FuPSzpIEVFk0wJUeB1rotliEcw0tZYy29WJ3oj1Z4E4lerJVe4g5cziFruE5j09mauBctHRWMvjppWp1T4MIkiN8DApejwtp6sjQ4sGrdhLjBwuatlFoEPCzmenFl5Osj9VJcSJs41frpJDsMkUCj1iBYEXABKkGPFUerwfe6fHRuL0-3D
Sample260922-3mnbwsaa38

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2068	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345938948867375"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
2660	chrome.exe
2660	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeCreatePagefilePrivilege	1928	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 5072	1928	chrome.exe	83
PID 1928 wrote to memory of 2068	1928	chrome.exe	85
PID 1928 wrote to memory of 2128	1928	chrome.exe	84
PID 1928 wrote to memory of 2128	1928	chrome.exe	84
PID 1928 wrote to memory of 2512	1928	chrome.exe	86
PID 1928 wrote to memory of 2512	1928	chrome.exe	86
PID 1928 wrote to memory of 1064	1928	chrome.exe	87
PID 1928 wrote to memory of 2120	1928	chrome.exe	88
PID 1928 wrote to memory of 1064	1928	chrome.exe	87
PID 1928 wrote to memory of 2120	1928	chrome.exe	88
PID 1928 wrote to memory of 2784	1928	chrome.exe	90
PID 1928 wrote to memory of 2784	1928	chrome.exe	90
PID 1928 wrote to memory of 4232	1928	chrome.exe	91
PID 1928 wrote to memory of 4232	1928	chrome.exe	91
PID 1928 wrote to memory of 2768	1928	chrome.exe	92
PID 1928 wrote to memory of 2768	1928	chrome.exe	92
PID 1928 wrote to memory of 1616	1928	chrome.exe	93
PID 1928 wrote to memory of 4496	1928	chrome.exe	99
PID 1928 wrote to memory of 4496	1928	chrome.exe	99
PID 1928 wrote to memory of 4180	1928	chrome.exe	104
PID 1928 wrote to memory of 4588	1928	chrome.exe	105
PID 1928 wrote to memory of 3608	1928	chrome.exe	106
PID 1928 wrote to memory of 3976	1928	chrome.exe	107
PID 1928 wrote to memory of 3976	1928	chrome.exe	107
PID 1928 wrote to memory of 2676	1928	chrome.exe	108
PID 1928 wrote to memory of 2676	1928	chrome.exe	108
PID 1928 wrote to memory of 2660	1928	chrome.exe	109

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url6002.wordsmith.ai/wf/open?upn=u001.ROfWac9jK8tu2pZGpfDWWX-2BoN1eEQy7HMAjQ30kZXIw4kNZnaftJ26ciy2c4FuPSzpIEVFk0wJUeB1rotliEcw0tZYy29WJ3oj1Z4E4lerJVe4g5cziFruE5j09mauBctHRWMvjppWp1T4MIkiN8DApejwtp6sjQ4sGrdhLjBwuatlFoEPCzmenFl5Osj9VJcSJs41frpJDsMkUCj1iBYEXABKkGPFUerwfe6fHRuL0-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffc59eac728,0x7ffc59eac734,0x7ffc59eac740
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,1575205231845118862,15122018242376331304,262144 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,843426465837230685,5457275308582781310,524288 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,9782028848365641195,4404069656038547659,524288 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,6781443609142112996,956170900073915583,2097152 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,17665174219192464584,17524112082009211521,2097152 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,3380583623157089840,14875496756494348436,2097152 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,12081101941039454851,13241385219886107894,2097152 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3160,i,15846111837245309702,4374315058417867905,2097152 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,5847529814011874397,9234807173343595144,524288 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5444,i,10213244870261182194,6015031367218238667,2097152 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,1834931708568953641,1600490556716072929,524288 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,5293591540998946561,2869798378793645029,524288 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,7901379700386361750,4826277530133502607,524288 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4300,i,16349545203247855410,3099676541988884812,2097152 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4756,i,4172894286774362429,15366557951797604111,2097152 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4300,i,5379346486884508050,12343233886762857325,262144 --field-trial-handle=2036,i,13300823262624339516,2895409873564856328,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 6bf5bd9c05fdf795611aa967feeb4e90c71a03e85d4652ade3d2cbfc46cd41a2
MD5 f9a53382f6a1b4f6cf6946a09b8a3102
SHA1 f0f972626c7b2ef4951b882f203bebb2adbe3864
SHA512 e5c6c29f147e9e688ae55334228ad2656a8c9f86864113d971dd5c99ec94f4bd789c1006a4b07bc71e25b62c0cd95350d3e34eb7fd59bd1e59b98fc57947ed50
TLSH
T135F0F4B9C821EC771CFC5B2960A44B47E751135B2640585B3A3C910D8FB1A3B868681C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1791210d437984399cb483f46e0ed75b0ed3947fc3ffc1b63465b11fc580ef6a
MD5 3f2ddf71c800e0651a0da48e9ea7b20d
SHA1 e3708b6197f929af98fc7a240b77f98c09454153
SHA512 8697d3ef7c8e403b55a116519cf02d8cbaf53ce1c408dcb1a301960ae11afa964f5375da3b1682f98f7d09e3d8d9f0083ec4f34459f8ad5907cf1bce30fec063
TLSH
T13B51AFF3C3E8867EC91156F8A7156E1BCE2D0A14532D3C56C8D8AF5F53E28B1D24064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 00f75695ad8ac158a34a4e4c7d024e39fd2c2c8ed1b923ec584b5b87965e67d0
MD5 aebab8e74eb1893c20fc98e5e5ed7cc5
SHA1 37ec259e5b81317b22e9d9d8aa467a6290b0ad70
SHA512 36e1963e4112dbc4cddd53c58eccde43e336475f9062499cbf9585317b1044aa5912d4d79321e874db3f8f7de397feffb564290507fac7611c946b2a63c6f7c1
SSDEEP 192:VRZUjALVVLv7TpAPRp2MW9AHyAb+WNnA2P4Uex2EIoC+VyIsnAUge:VRZUEzzfUXwWN5Pi2EDC2e
TLSH
T19B42962DAD20797B5CDBD21AFA257F93D6F5102131942E44E6FC8A3C14EB6CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 825e6b89b8469681ab3913d31f35e2ef225e4dc5513297f72a50a392fcb57654
MD5 381c0b6ed66f344b880d905ce8ed5536
SHA1 4bf16119542a559354423ca283da00c408af0cbc
SHA512 1942b61c7e8514242bd139c01e1f9d56d625532940645354120c75465ef401add71389162894b545533493ca83a1253affaca918791848f7e83a4dc824d8bd90
SSDEEP 384:wqjcv7KxkXqKf/pUZNCgVLH2HfgslDj7pLuLceSa7XODcz+ErU3JaHGuC4JVLkLW:w6cv7KxkXqKf/pUZNCgVLH2Hfgsxj7ps
TLSH
T1CD7208676C489A370F94DACCDC17BE4FACB9015B61ED886443FA982603D5BDF110A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f9ac3ad09fb23c8a160ca2850339217467d5cbbb6bccc7b19e5984cd098121c8
MD5 60ced0790168095767eca041b4b8c205
SHA1 79806e86e9a40f4f997ea6d3ac70daed4c6ef3ec
SHA512 92c80ba969cb358885d396535af6f29a7a60d0f742b05a73cb88b4cbd1fcb2bfe70ce51e7685ba19ff96858564f8ed3dcb7c47558ccb19e4f0f87f2b9229a2fb
TLSH
T1DAB0120580429741C08602B115581D9872589F14A705130642F41D01DC35161801B098
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c0ab.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c0ab.TMP
Size 96B
SHA256 e63ca48e985c3372a589544f673fbad9e8934fc672d97a1ed4d5943e112af1b9
MD5 a46f60afe2585e393e122e5f61099b24
SHA1 dc9d3e78e4fbac631c3d21b5cb45c5acbdb40dd4
SHA512 4c5a5a66458887d30475f7de6dcf0c92008b0a3fca88ebf1aefe5b5f5e8df116864d2e242e3ea089c7d3e26dfa3ebb0ec2af60c0d2481841b42a6af5a6575f4a
TLSH
T194B02208C00222A2C0820BF033EC88C830A0EF3CC20303228AE02A22EC222300020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 173KB
SHA256 339defbf27664b096d5718d191aa9dc9ee9aa3b3069cec0e2d92fb991b29d4bd
MD5 fde82dbb877c804c4ca9c5f64f1324d3
SHA1 48f33c8d4c2992fca6654f8446e590535e3d1d19
SHA512 028cbf028f7f93d5927255d280237e18feb53e1f41bd4461288bfe3265c6786eec895b3211265208107d97a4f37da0979dba0991194805ad1ff2f608a88585d1
SSDEEP 3072:bAkdEvICS+yLIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:skMpyzPtbmf1K49XLWbEPi4NTKlLz8
TLSH
T13D0412717C04BCBCD89ED121F1806E069DB9D50B967D7AE659DE2F4887E769CC308813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 7a5678ba5342d72104a1ee2e6668df488413c922cb01d111b75155c89f958d18
MD5 ac1d9dc1bc33abcab77f79474cb51a10
SHA1 e0b69ab817f7df4f18648999c2dcd43183eb059f
SHA512 c58b623f95c2fbad69fb0611baf5bcf9a4739507a7527ec31bb53c799083342a3d2978b93e683a7ac0fb7256dbd30566423e0aec4f4b10ab8652fb53bdc0b7e8
SSDEEP 3072:2IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:2Ptbmf1K49XLWbEPi4NTKlLz8
TLSH
T1BAD312217D41BCB8E9EFDB21A1905E15AAB8C94B96397BE61CDE3F4C05A36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 ee012b869ff42dc0acbb938536396f2e5b5e53e32e0f98553db1e1d99ab1fd42
MD5 293428169b2ae92d4b170e4c2b99eaa7
SHA1 d005bb32d486d187eeb0798843057008ef64adb0
SHA512 1eb3ac533c0c4d3532e16384ecac40ee205de53e5c7dcf322ccf2d29564d789a15dd3d5dfea838581277fa36deb2ca3e9f64e989e8da68208f1aabc3e5836393
SSDEEP 3072:6IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:aPtbmf1K49XLWbEPi4NTKlLz8
TLSH
T15CD312217D01BCB4A9EFDB31A1901A16AAF8D94B953D7BE61CDE3F4806E3699C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 5dc417149a76fa2651432c1d6284089b096d563532f8a06b97713db6185bff9e
MD5 f979ada70114ca5b5833b9acf26a57ad
SHA1 f29609e9e84cd3ee0d6a9a944897c621136bfa3c
SHA512 e620ee9dd36dbe5035748a58a7c14e3bb78b8651b75f8ca42b6bc097243e4d7094bc7ad9cf89061d8b4d0db8c4d011968139bac6fc0c955fb85c0a4e39183ec2
SSDEEP 3072:nIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:vPtbmf1K49XLWbEPi4NTKlLz8
TLSH
T1DFD302617D01BCB4A9EFDB31A1901A16AAF8D94B953D7BE61CDE3F4806E3699C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download