hxxp://url6002[.]wordsmith[.]ai/wf/open?upn=u001[.]ROfWac9jK8tu2pZGpfDWWX-2BoN1eEQy7HMAjQ30kZXIw4kNZnaftJ26ciy2c4FuPSzpIEVFk0wJUeB1rotliEcw0tZYy29WJ3oj1Z4E4lerJVe4g5cziFruE5j09mauBctHRWMvjppWp1T4MIkiN8DApejwtp6sjQ4sGrdhLjBwuatlFoEPCzmenFl5Osj9VJcSJs41frpJDsMkUCj1iBYEXABKkGPFUerwfe6fHRuL0-3D

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url6002.wordsmith.ai/wf/open?upn=u001.ROfWac9jK8tu2pZGpfDWWX-2BoN1eEQy7HMAjQ30kZXIw4kNZnaftJ26ciy2c4FuPSzpIEVFk0wJUeB1rotliEcw0tZYy29WJ3oj1Z4E4lerJVe4g5cziFruE5j09mauBctHRWMvjppWp1T4MIkiN8DApejwtp6sjQ4sGrdhLjBwuatlFoEPCzmenFl5Osj9VJcSJs41frpJDsMkUCj1iBYEXABKkGPFUerwfe6fHRuL0-3D
Sample260922-3mnbwsaa38

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345938961824720"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
2672	chrome.exe
2672	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe
Token: SeShutdownPrivilege	3280	chrome.exe
Token: SeCreatePagefilePrivilege	3280	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe
3280	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 5800	3280	chrome.exe	89
PID 3280 wrote to memory of 6048	3280	chrome.exe	90
PID 3280 wrote to memory of 6048	3280	chrome.exe	90
PID 3280 wrote to memory of 3360	3280	chrome.exe	92
PID 3280 wrote to memory of 1576	3280	chrome.exe	93
PID 3280 wrote to memory of 1576	3280	chrome.exe	93
PID 3280 wrote to memory of 804	3280	chrome.exe	94
PID 3280 wrote to memory of 804	3280	chrome.exe	94
PID 3280 wrote to memory of 2568	3280	chrome.exe	95
PID 3280 wrote to memory of 2568	3280	chrome.exe	95
PID 3280 wrote to memory of 4404	3280	chrome.exe	96
PID 3280 wrote to memory of 4404	3280	chrome.exe	96
PID 3280 wrote to memory of 5644	3280	chrome.exe	97
PID 3280 wrote to memory of 5644	3280	chrome.exe	97
PID 3280 wrote to memory of 5792	3280	chrome.exe	98
PID 3280 wrote to memory of 5984	3280	chrome.exe	100
PID 3280 wrote to memory of 5984	3280	chrome.exe	100
PID 3280 wrote to memory of 996	3280	chrome.exe	101
PID 3280 wrote to memory of 996	3280	chrome.exe	101
PID 3280 wrote to memory of 1948	3280	chrome.exe	104
PID 3280 wrote to memory of 4112	3280	chrome.exe	105
PID 3280 wrote to memory of 4112	3280	chrome.exe	105
PID 3280 wrote to memory of 1948	3280	chrome.exe	104
PID 3280 wrote to memory of 3748	3280	chrome.exe	106
PID 3280 wrote to memory of 3748	3280	chrome.exe	106
PID 3280 wrote to memory of 1936	3280	chrome.exe	107
PID 3280 wrote to memory of 1936	3280	chrome.exe	107
PID 3280 wrote to memory of 4660	3280	chrome.exe	108
PID 3280 wrote to memory of 4660	3280	chrome.exe	108
PID 3280 wrote to memory of 1220	3280	chrome.exe	109
PID 3280 wrote to memory of 1220	3280	chrome.exe	109
PID 3280 wrote to memory of 5216	3280	chrome.exe	110
PID 3280 wrote to memory of 5216	3280	chrome.exe	110
PID 3280 wrote to memory of 4480	3280	chrome.exe	112
PID 3280 wrote to memory of 5040	3280	chrome.exe	113
PID 3280 wrote to memory of 5076	3280	chrome.exe	114
PID 3280 wrote to memory of 1712	3280	chrome.exe	115
PID 3280 wrote to memory of 1712	3280	chrome.exe	115
PID 3280 wrote to memory of 4820	3280	chrome.exe	116
PID 3280 wrote to memory of 4820	3280	chrome.exe	116
PID 3280 wrote to memory of 2672	3280	chrome.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url6002.wordsmith.ai/wf/open?upn=u001.ROfWac9jK8tu2pZGpfDWWX-2BoN1eEQy7HMAjQ30kZXIw4kNZnaftJ26ciy2c4FuPSzpIEVFk0wJUeB1rotliEcw0tZYy29WJ3oj1Z4E4lerJVe4g5cziFruE5j09mauBctHRWMvjppWp1T4MIkiN8DApejwtp6sjQ4sGrdhLjBwuatlFoEPCzmenFl5Osj9VJcSJs41frpJDsMkUCj1iBYEXABKkGPFUerwfe6fHRuL0-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff97657c728,0x7ff97657c734,0x7ff97657c740
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,5918770814045288445,5646045192875727086,262144 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,3729074469530665751,12337828998779245109,524288 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,8358327070373963919,13727876778972519195,524288 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2884,i,16007459868273620775,6479667669748267697,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2876,i,18339384911713201325,11557252134632371298,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,6183724839737693494,18226653462741035792,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3160,i,11901400845646582873,11268515236935585892,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,1028881589007970146,7281880540979904122,524288 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4712,i,15347464862335540291,11031773024727695240,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5292,i,13059697676572385907,3423077626500039629,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5612,i,9420938559773793309,3308876905093552745,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5740,i,6048701447078274035,4621425407054490735,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5780,i,2759270272997775619,18367994344098109290,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5324,i,14476588646363143314,4255429998883555899,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5736,i,2148246825500238892,6421045032801766486,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5908,i,2335116663904394154,14214428337740321369,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4732,i,12517710490837197153,16519663802724711102,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,8978516382080881285,4367143945185865771,524288 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,3336761840432550542,2399036036421173758,524288 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,338046078051685016,7137409180671853287,524288 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6056,i,8523945245988694037,3828829140410556837,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5000,i,13499409983732862312,3257394426429843526,2097152 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6080,i,3822160152629990388,3898084819313788469,262144 --field-trial-handle=1908,i,14718273026811884809,6460677321480724450,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ad6690356624d899f0d0cdd4587c1e8382058a3c6790d991293610be592a9fcc
MD5 212ab8ad01b4e0dd404eec555a4a47cf
SHA1 74c7f987da370bc4c849b4909be25cd5e6507158
SHA512 ed5e5b46b6d6573eb6c03f1eb712c96531c84c6bf399880e519f9835055b0a157c29738ea4acd13a5e8784f2d93ef959d76aa86a478f91c932fdcf925c0c9b81
TLSH
T195417BF7C3D8867D891156F8AB156F1BCE2A0A18532D3C26C9D8AF5B57E28B1D20064F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 381c2feea463aae84ccd0d0cc8c9a6286e44e4e0881ffbd0ba73c89035dfe8a8
MD5 9c57afa8d8cfc8b9d36cdf11d4310a4d
SHA1 3d514828945299b0867c045f208e60fae447efed
SHA512 60627c93751f25985509842fb951db79d205d423e3408f8081d396b8b0d9de642467aba08de63512758a4e968bbffca94994b96430aa872418c6a7b3bd5f292d
SSDEEP 192:/RvqXonv7NvAPRp2HZk9zHy8b+WNn2NPdpW2pYkwJVyIsnAUge:/RvqYvZ6XRlJgPd426Pe
TLSH
T16432822DEE24747B9CDBD22AF925BB53E7F5102121952E84EAFC893C14EB5CC221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ff46c4353ad9925cb83d834a3e30caca2f2c67d3749ff1c6795063593184adf1
MD5 40e593e868cf29f94f4b7399fe08149f
SHA1 dc54f3b2c255d09691a4e893210265eaa106d220
SHA512 0e8f34ca0e94f22674b9751ff2ecda7e636ea816e3f4dabecb2d0a452b1e1d47a9290e745b1d1caf766313d792efdaff627b1cfdc9d86beabc163c0137f36539
SSDEEP 192:/RvqXonv7NvpPRpBHZk9zHyob+WNn2NPxW2pYkwMVyIsnAUgE:/RvqYvZZXoltgPQ26IE
TLSH
T19A42932DEE24387B9CDBD66AF915BB53E6F5102121912E84E7FC893C14EB5CC2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 e4a6798a5a3ac5bfcdca0be1de7c1ba068de128e43648674a2965116a3931261
MD5 c2e8f234a92abc64bc610b7387f9806c
SHA1 f391f849e102e728082921cd7df078c80707f1ed
SHA512 1c7b51743330bbd656e783f6581c9cb403cd9fe0dbd23cc414c76dfc22d081a5d17455cd1f856f26622876f41f28b2b2204584121c65fd63978ca7f2e5db05fb
SSDEEP 192:e/k4K6dF7KxkXqK4I40pUZNCgVLHrKHfFKslEoHNXzKD/SF+ErUkKN9RK5Fc3DoU:GkjKF7KxkXqKf/pUZNCgVLH2HfgslVNS
TLSH
T1A732FA27A44DAA7F4FD8D50DCC136F8B7DF5029262780C28A6FB9C0803E978A51595BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 7a840599e2404730f13cd71b9acd45c2a7fc40a38945ebb6cb4cb20e14663da9
MD5 9473bbcc322434404b670e576a9aceee
SHA1 219f4af896b5c6f58564a2a4db7127b9d5e07503
SHA512 d94a3c8cfdeec0d3d2a404767e5958634612cdd5410289755624e083e9fb200931a1eccf7e09265cfe5accbd203db18e92d3d1f7305dd32581948917071f3437
SSDEEP 768:I8QJ380wdvyuPpvVzmWDWQ8ZnN7Ca/NuuzBCdGMaHuvJM41HLMPFcRCEU175:bQJ+vxPFB7ARhluuNGbaHHcJCH5
TLSH
T14F13E1E4C47CDA1854ED9051F543BF922C8603AA6E8BE57EDF6B5C0C017687C868E133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bd7177dbe4c3bc6a9c87ed0a52baf094778f145a7ebbab198f9ee68de58ad2f6
MD5 4378005184b287c32f1805b05722ffbb
SHA1 efbfbe56b31aa37d2900477bc85e560348ab2172
SHA512 3ce506bdeae445fea4bd80a807a24e618441b03667cf0f319f155000e15bbea22d6a44c17dc6efed24181a076e06c9900493be1d5b1b69761fb580135b50019f
SSDEEP 96:OC0d+2+07WJ3aJPWyqgfdfKAg1Sl8h4otop54sD5B6RddGyvQClg7cOqW/SNJu+T:OC0d57WJ3aJ+yhyiU2Hf0dwlBqXNJBDX
TLSH
T1A1C10AB1B47DAC7B55E79851F6033D43CDE862EB5910AE54DADA0F1A01FB4EC1382123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 4a38eb4c6419a8ac896b609c7b935829231b38e2bbc2c374f4aee068df296275
MD5 e6dd72ccfbc3621496a2701334bfd626
SHA1 6487336e2067b63308ee5ee9c7b68660808e47ec
SHA512 8be638f63f2cceedb32c9f60e669c2290c32f29a086fa7ff15e1eb804d25606222f2a7b12c5e1f41d9dc0338a65a2263fd5e493fb70b29776a37d9e940bc3d17
SSDEEP 96:8C0d+2+07WJ3aJPWyqgfdfrgnRDotok544D5B6FJGyvQCl47Yu+ZPE4/Rv4a:8C0d57WJ3aJ+yhYDUDrfS0rYBZsM
TLSH
T1ECA10970F47D5D7795F6C986F9023A07DEE8A29BA960AF84D8D91F0920F74E80342123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 427634d989806d9af5639757242e0ee974c7add7e1da99e10e9ad8e0855e8cc0
MD5 1c6e6743f4c9cb9681bcf910d0583287
SHA1 9925c3a4e96834117d1528c5e9c3e3b4286c5606
SHA512 d8ef4912ed426715f4a45cb3668faf6551b4c72cd8010fca841cd604380ec293da1dbfc18c2ca5cc10cee83a9e3209a4bbc0b4ec94c948564efda0fd9582c9eb
SSDEEP 96:ObJ0d+2+07WJ3aJPWyqgfdfKAg1Sl8h4otop54sD5B6RddGyvQClg7cOqW/SNJuK:Ot0d57WJ3aJ+yhyiU2Hf0dwlBqXNJBDX
TLSH
T1BCC10AB1B47DAC7B55E79851F6033D43CDE862EB5910AE54DAEA4F1A01FB4EC1382123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download