hxxps://www[.]artstation[.]com/theartverse1

Analysis

user interaction
yes
max time kernel
90s
max time network
94s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.artstation.com/theartverse1
Sample260727-vvq4raysa1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3260	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296463944618569"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4120	4240	chrome.exe	88
PID 4240 wrote to memory of 3260	4240	chrome.exe	90
PID 4240 wrote to memory of 984	4240	chrome.exe	91
PID 4240 wrote to memory of 984	4240	chrome.exe	91
PID 4240 wrote to memory of 3264	4240	chrome.exe	92
PID 4240 wrote to memory of 3264	4240	chrome.exe	92
PID 4240 wrote to memory of 2616	4240	chrome.exe	94
PID 4240 wrote to memory of 4624	4240	chrome.exe	95
PID 4240 wrote to memory of 2616	4240	chrome.exe	94
PID 4240 wrote to memory of 4624	4240	chrome.exe	95
PID 4240 wrote to memory of 4684	4240	chrome.exe	96
PID 4240 wrote to memory of 4684	4240	chrome.exe	96
PID 4240 wrote to memory of 3472	4240	chrome.exe	97
PID 4240 wrote to memory of 3472	4240	chrome.exe	97
PID 4240 wrote to memory of 4588	4240	chrome.exe	98
PID 4240 wrote to memory of 4588	4240	chrome.exe	98
PID 4240 wrote to memory of 4232	4240	chrome.exe	100
PID 4240 wrote to memory of 3960	4240	chrome.exe	101
PID 4240 wrote to memory of 3020	4240	chrome.exe	102
PID 4240 wrote to memory of 3236	4240	chrome.exe	103
PID 4240 wrote to memory of 2824	4240	chrome.exe	105
PID 4240 wrote to memory of 2824	4240	chrome.exe	105
PID 4240 wrote to memory of 4176	4240	chrome.exe	106
PID 4240 wrote to memory of 4176	4240	chrome.exe	106
PID 4240 wrote to memory of 3864	4240	chrome.exe	107
PID 4240 wrote to memory of 3864	4240	chrome.exe	107
PID 4240 wrote to memory of 1080	4240	chrome.exe	110
PID 4240 wrote to memory of 704	4240	chrome.exe	111
PID 4240 wrote to memory of 1080	4240	chrome.exe	110
PID 4240 wrote to memory of 704	4240	chrome.exe	111
PID 4240 wrote to memory of 5756	4240	chrome.exe	112
PID 4240 wrote to memory of 5756	4240	chrome.exe	112
PID 4240 wrote to memory of 3084	4240	chrome.exe	113
PID 4240 wrote to memory of 3084	4240	chrome.exe	113
PID 4240 wrote to memory of 5852	4240	chrome.exe	114
PID 4240 wrote to memory of 5852	4240	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.artstation.com/theartverse1
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8bfc4c728,0x7ff8bfc4c734,0x7ff8bfc4c740
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,1575448208986664332,12627006665711631241,524288 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,12676611945109380881,11880090763464266029,524288 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:13
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,13731708003391557212,1484225995330783724,262144 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,4108089250150923817,6960572467647009170,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,298377452101961576,14143193267280523516,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4612,i,14829296011660534352,13448753941032479628,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4992,i,8477129977909883803,17574493787913749403,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5180,i,2829375376113858845,8838422802113728255,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,3981172631103763522,17132511376530375349,524288 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,4572722027334271473,8836060388114244382,524288 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,150265739024231065,2925251205403425733,524288 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,6221600481140409242,16019477352340071927,524288 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6208,i,112502526975451893,2452058001163105998,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6248,i,17587271490563058071,12787594776239787274,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6412,i,9974485733749739739,8785368757578102219,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6300,i,5968999245272292375,17478988384187430557,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5508,i,6127180250638355095,11277039477672167674,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6624,i,3942532772653945897,5623175492783378495,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6292,i,12135521227199201555,11432524303225636249,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6308,i,7978969751454041638,10277211075775711308,2097152 --field-trial-handle=1920,i,16348466278638709820,3599080053749036999,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:5852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 696B
SHA256 d27877a5e868d86aaaf411b7f7cc67f06561fb47b77cf7244d18097bade25af6
MD5 9ab322f051494d4114ee1aafbbe89bda
SHA1 ecc5ab4bd82e010ab864cd2b63f8fbf7979947ba
SHA512 e8d0b864c960e3a7e094c07ef98d5fa27a0a5a9d5b72cb7557002186a6fa639a54bea1e385f0025f7c832d2ff2a8c5a6c7f81c20d702b2e8df5ae52603dda5ac
TLSH
T19B012EF01E0758A7D700D87125FAD9007A3A765F6C8F7DD6D1B01B79DE6531453800E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 fa60ab5585b621dfe6a8c8b350a2e1c2206841d59eedb94d126ab245b31f8d99
MD5 f36a93b020a6635286ce16856e13f374
SHA1 0b2ba23f61949cab46b5d64c342dc7a6e8f95818
SHA512 cc95d527c6caa39b2ace2e88acc5586fbec5dee81efc7befd9d769ad6afeaee39500f25d4dd66e2aec8a8fdf3ed30768e24d91cc8a310010744667203d46e24d
TLSH
T1BEE05E141E455CF7C754183067CBE8107C74B669A59B4FE682505AB99A1B36527000B2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 9df84dba774c92a8691b272e65f6a9b91fd1227668ebc1d977dfed899dbaedac
MD5 91d9e9871ec762fb726640cb98d7687d
SHA1 7959d804af2127e6d4bbf8567317bc645d692ddd
SHA512 9afdbb1054793181711fbb05c03f5073b1b0c32d9183a229c3ddd9db5b2dc084ea77045e66e8e84bb70d8098536acef487eb4e60de98c268c6c7e669406d2b7c
SSDEEP 48:YALlH1HVYMY0hNsJCSRsJWXLsJufoKsJrfsJbAos84sMezsqZsnesar2sivsGVlL:DV1XB/SrJu3sM+UOEZlZ477yUZa7j+BK
TLSH
T1BFD159E7C3E8CA6DCD1552F4A7157A2BDD2D091853383D1B88E8DE8BA3E2472D15064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2fae233060cbfc76c95f8b588e1d23ef96bc206cee4da63724a7222643ef2ad7
MD5 b2f24f83ac270a1e48d2cb67e065fb89
SHA1 85e15424963f8be25b3b11ca9eb6015dd2d3977f
SHA512 26293010e616b41bc3dba104305995c9b993af0535b0de4e8037c70423bd19ec794b6976ba7ba8b9f7aa790b2e8447c3568d43d890ec3577907d8e798ec8fc88
SSDEEP 192:5BRE79ElakRv7QvAPRp2Kb9XxHsb+WNn0yRAh2nwW0kw4VyIsnAUgR:5BRyYRB86XZfw3C208R
TLSH
T1CE32A62EBD14693B6DDBC22AF9627753D7F6102165A02F44E7FC8A2C11DB5DC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d4074caafc6c0562e79d389974159898a7319fd61e4273a3317dfc6babed9625
MD5 c10019dc4afe8510e34d6e3808bc5955
SHA1 4108355ea0a4989c6c993fc882b2ab505907f332
SHA512 1c7cfbdfdc87f5b1f50d2e5d89a8da5ed00d4a894fb581fbac8f5289531d7e2f3199b003134768c07a1ca43eb62429bd9ff7ed00b699f86835552448380ead3b
SSDEEP 192:5BRE79ElakRv7QvCPRpsKb9XxHsb+WNn0yRw3YpowW0kwbVyIsnAUgE:5BRyYRB88XPfw3SYX9E
TLSH
T1BC42A62EBD10693B6DDBC22AF9667752D7F6102165A03F44E7FC8A2C11EB6DC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ff12c4d7a25250510c98a0de91df7404fb25b21927fd1a609a960714559ad19b
MD5 73db2c7e18a29b3aa007f524a9fd95e9
SHA1 2032e44fafdaf8d6eaee63ec1840110eb171e731
SHA512 c79472d4b483c6c196ea3d4de56f3e0e08566dc54cad2de04da7b2a93fe459ee5c45b0a5b0fcead8dd7402003190cd91dceed510cbb3f2d03ea29cf2a9137130
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934RM6Sl8h4otop53icDLB6PGyvn0SvQxwzQShjm+98uq:Rt0ITo+TQ0I/iU2p1vPSIxGhjm+98urO
TLSH
T1EDC13B76A46D5C7715A7E542F0233947CDB4305BCA516F60EEDA0F1C11EB4EC2342A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 76215bafa16f4eb07682e932984e404b7c52dd4df10cdce26c595ec04a6eaabb
MD5 d0fa34272b370e4e8c15387ce025f67c
SHA1 d18f33ce394219487d166895f49649212757ca3a
SHA512 1d11f5138ea6b715fc7735640cf0255d9cd0d62eab9865309b44912c98df5ed61c76014b40a3c37803ab9c944ec00a163d44e1fcc5e795d3b7a942569baf0a27
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934RM6Sl8h4otop53icDLB6PGyvn0Svhlm+98xRNC39Ic:Rt0ITo+TQ0I/iU2p1vPSvhlm+98xuCjo
TLSH
T1BDC1E875D45C4CBB08B6E486B1132947CDA8206BAD65BF64FEE90E0D11E74EC5382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1d787c67e2e1d109edb840875d83dbc6a8e2598f885c8993957f6084fee2754b
MD5 12797f668de602640a81fe0245d5c67b
SHA1 4fefff709b3d0653bb5fa6b20259756a0120ae7f
SHA512 7da5a48709b8e8e7a43fd18b0e08b49f4d14b99b7d6fff462236ec5d592abb23961eb81d613c99e070e43dccabab1d2ea9a9b287bf0f326111d603046e34f885
SSDEEP 96:xC0d+r2io+TJ/E0f6m934RM6Sl8h4otop53icDLB6PGyvn0SvQxwzQ/hj+98ur0/:xC0ITo+TQ0I/iU2p1vPSIx7hj+98urU9
TLSH
T127C13B36A46C5C7715A3E446F0233A47CDB8315BDA516F60EADA0F1C11E70EC2352923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0f673aa15128f5a41e9e29947a4591778d3f4c546e00164e53c0adb04e932999
MD5 a81adac2dc25ba951d8aadd0d6c4789b
SHA1 6f3c30b4f48da3e4252b9ae904d69e58a3230943
SHA512 9ce24faeeb9a8cc51b8be7ef09b07cb1be48659883b111209b4652305df73381e1fecb6bd168f0752f1412e944abde0b4cfb8bd89a2eb4bf718175eff576e81e
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok53mDLB6nGyvn0b4T88ybJv4a:xC0ITo+TQ0InDUDQ1PPb4T88ybl
TLSH
T18EA1F836A0284D775476D446B1622A43CEB97067D962AF90EAD90E0D25F74EC1342A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 400dc2fafdf8f9af205667155e3e798c4799fb1ad67bbfb77b48e6f6a9ae2494
MD5 cf15b4e7db16723fad2bab776c5dd55b
SHA1 487b59279ebfa9755852c6a1693619ad4ae57b87
SHA512 d2eeadd80e6511bf42b99edefc578e7d76e46dabff489b80b0cd503a0f4c04fe86689ee959997fe5560f3945299dbb5ad0ce309040744bd116637471ad61090c
SSDEEP 96:xbJ0d+r2io+TJ/E0f6m934RM6Sl8h4otop53icDLB6PGyvn0SvQxwzQ/hj+98urO:xt0ITo+TQ0I/iU2p1vPSIx7hj+98urU9
TLSH
T1FEC13A36A42C5C7715A7E442F0233A47CDB8705BDA516F60EAEA0F1C11EB4EC2382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download