hxxps://palsurfestival[.]com/wf/click/?upn=fUZRXdlMyu6M5zKGBJ7Kf-uXbBaGbOHURzl_K4yZI5e_Taf1-9Vh1BWH8NlXDp4fFK8a2EqqhFpgqUku-OhKONZ-/

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://palsurfestival.com/wf/click/?upn=fUZRXdlMyu6M5zKGBJ7Kf-uXbBaGbOHURzl_K4yZI5e_Taf1-9Vh1BWH8NlXDp4fFK8a2EqqhFpgqUku-OhKONZ-/
Sample260824-vx44dsec67

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2376	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320658028534524"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1556	chrome.exe
1556	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 4600	1076	chrome.exe	88
PID 1076 wrote to memory of 1608	1076	chrome.exe	90
PID 1076 wrote to memory of 1608	1076	chrome.exe	90
PID 1076 wrote to memory of 2376	1076	chrome.exe	91
PID 1076 wrote to memory of 2884	1076	chrome.exe	93
PID 1076 wrote to memory of 2884	1076	chrome.exe	93
PID 1076 wrote to memory of 636	1076	chrome.exe	94
PID 1076 wrote to memory of 1800	1076	chrome.exe	95
PID 1076 wrote to memory of 636	1076	chrome.exe	94
PID 1076 wrote to memory of 1800	1076	chrome.exe	95
PID 1076 wrote to memory of 1256	1076	chrome.exe	96
PID 1076 wrote to memory of 4624	1076	chrome.exe	97
PID 1076 wrote to memory of 5500	1076	chrome.exe	98
PID 1076 wrote to memory of 4624	1076	chrome.exe	97
PID 1076 wrote to memory of 5500	1076	chrome.exe	98
PID 1076 wrote to memory of 2836	1076	chrome.exe	103
PID 1076 wrote to memory of 2836	1076	chrome.exe	103
PID 1076 wrote to memory of 4328	1076	chrome.exe	102
PID 1076 wrote to memory of 4328	1076	chrome.exe	102
PID 1076 wrote to memory of 1688	1076	chrome.exe	104
PID 1076 wrote to memory of 1688	1076	chrome.exe	104
PID 1076 wrote to memory of 3344	1076	chrome.exe	105
PID 1076 wrote to memory of 3344	1076	chrome.exe	105
PID 1076 wrote to memory of 2124	1076	chrome.exe	106
PID 1076 wrote to memory of 2124	1076	chrome.exe	106
PID 1076 wrote to memory of 2932	1076	chrome.exe	107
PID 1076 wrote to memory of 2932	1076	chrome.exe	107
PID 1076 wrote to memory of 4180	1076	chrome.exe	108
PID 1076 wrote to memory of 4180	1076	chrome.exe	108
PID 1076 wrote to memory of 4724	1076	chrome.exe	110
PID 1076 wrote to memory of 1696	1076	chrome.exe	111
PID 1076 wrote to memory of 3444	1076	chrome.exe	112
PID 1076 wrote to memory of 1556	1076	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://palsurfestival.com/wf/click/?upn=fUZRXdlMyu6M5zKGBJ7Kf-uXbBaGbOHURzl_K4yZI5e_Taf1-9Vh1BWH8NlXDp4fFK8a2EqqhFpgqUku-OhKONZ-/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffadd38c728,0x7ffadd38c734,0x7ffadd38c740
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,14038123538521195532,2220867555513106900,262144 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,18084231331527238813,539205000116828613,524288 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,5476513457794655340,13372041209669171734,524288 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,7608795564113522551,10277695976270475551,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,7051480037277885823,11003114936061945936,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,12743528940047798763,13167452783902238740,524288 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5252,i,8738779033251929137,11265754952198800133,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5264,i,10289788426075902684,2155083766121024041,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5612,i,10038206356627177457,14232658702769417425,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5256,i,18018886326940231301,10869603261834783741,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5444,i,12546736078858820964,174502583633666507,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5196,i,6752636821076745750,8653731569265473442,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5984,i,18089640782712512964,2318726707497441004,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5444,i,5455555335872215941,5543102034660682935,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5336,i,14435002068566686817,6183179115027590906,2097152 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,2654360614640866633,16198110166088968766,524288 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,11769579107612088700,15706357632065978391,524288 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,2277985557967701368,444328208441016595,524288 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1132,i,16005841564698586225,1430241917039246443,262144 --field-trial-handle=1904,i,8823531084671310767,11201252383283213225,262144 --variations-seed-version --mojo-platform-channel-handle=792 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 614576bf334cb4985223679bb368d87e0cb84fc77b36953e5bb16961c66104a7
MD5 43d8a92b9788891c5c2c298cd7d086b5
SHA1 aaf7ded0b6a91ddf1470f273be6d82c1e8d5b728
SHA512 1cf409927597d43bc1cd2dbb7819e287eae5f2639ca863aaa5032aa4cf395eaab56978720b3d353e6a7dfdc8b70cf20d7b2677d8aad567bf503ffd2778f87b32
TLSH
T14CB01108EAC00823CA008AB0B8F2A0F0B03208B882020A0388C800EC800A3AA8002082
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f62b05c80c0804ac50e9d888ffd2dfffe0573f2fd01755d7a00b584b7df860fc
MD5 14a99542b5d24be7099fb159e3bda69e
SHA1 0e34278bb2e6908f0315d8f3eafad5d6ddb9db31
SHA512 348f0c1addc93f47ee40fab26e5eabad971632a774b0d8362b6a21a2b25342519b40aaa81e6e5ae9a4a6ceca9cb0eeb4fe6b795ce50cc6e0c6430a1f034fbe89
TLSH
T16D51BAFB93F48A6DC61193F0EA04AE1FCE6A0524032C3C56CAD46E1B97F2462E11475E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d2e571426dc56e1beba0189054a0c63cebee5803a7fe2baa58c5e3234a956714
MD5 d4888b6b8e9b5a932d28a901e2eead6b
SHA1 89a6bc408da010ba739df020bb8664657c1b33e0
SHA512 c7d2ade8720edc029eabe5bdf7e3594246c1e0d7a25c8f702dcd4cd4f90fb28f3b464738a3ae3bd88bcc735d7d951537f6adb82612f1a1aa54353bbba8d89b92
SSDEEP 192:bRcNo8CWv7xbvAPRp2jG9GHsb+WNnPQYMp2L42trvChVyIsnAUge:bRcNBCiN6XDgwIZ202t+He
TLSH
T14E42B82EA914693BACD7C219FD62BB57D7F5202171942E84EBFC862C14E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 44b4ba0435d62554eaa8fe4995bac1240810f021c9201a9d402ddaa45f30e1de
MD5 61c60fa93421abcfea8442cfc909bf40
SHA1 542c3c7888b5168e8ed10f7b475efbda49904013
SHA512 4b9cf9e3709cb796bcb4c0fc1c35220397eb03413d8713d7b2c7649fa131d8ee687f7001f4596ebdbf6a4f66721bbf7b9a0a8e332778607741adab47c1e40a48
SSDEEP 192:bRcNo8C3v7xbvAPRp25TG9GHsb+WNtRPQYYVe742trvChVyIsnAUge:bRcNBCfN6XFgwkteE2t+He
TLSH
T10D42D92EA914293BACE7C219FD52BB57D7F5202175942E84EBFC8A2C14D79CC321B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 31bbc91862efa445695c87dbaf451a9e5ff7827784b420e958073dfef39cf284
MD5 c2cbfa11f46a54ebbf435554cb026426
SHA1 d138230b276cf8440a4a962c4ebdd468617a5c19
SHA512 05912b85a0da99b1f55c88a7c2b97b5f5fa294c677fa9cad7dd30cc0dda583b84bb137681fd4871e8a40b49d556cfed9015cc89566a3931f1fc17c2eab560696
SSDEEP 192:bRcNo8Cnv7xbvrPRpL5TG9GHsb+WNtRPQYYVej42trvIhVyIsnAUgE:bRcNBCvNrXUgwktec2t0HE
TLSH
T1AA42D92EA914297BACE7C219FD52BB57D7F5202170902E84EBFC8A2C15E79CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ddf5ed5b31e177f4c0c3bebef97be8e3b3ee92090199ceb81ae04fd005df702f
MD5 8bde07420bd7b20c4ef58529ec0eedca
SHA1 6332a4b9038b965d1058b1800a49bfe998c8e4dd
SHA512 d74c4a5754fb23633fd78a55fe55b49100ab4246743a3e6c242bd927bbf7be55a2fdf258b0d41478843d8356def901c9a93f2b2bd56bd4baa89716cc93d512a1
SSDEEP 192:bRcNo8Cnv7xbvAPRp25TG9GHsb+WNtRPQYYVet42trv0hVyIsnAUgE:bRcNBCvN6XFgwktee2twHE
TLSH
T1F042C92EA914293BACE7C219FD52BB57D7F5202175902E84EBFC8A2C15E79CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 813fdcf36e6a589398899d0120e6a5a8c49593c974394c398ab3b3c001cd9763
MD5 faa920e355b62c85f52f9a235ecb42d5
SHA1 a3bfc6e8d1f8dd900c0058622b3eb84b269a7195
SHA512 3db0845b5142132b4c40aa2a8486f431b162db89c8809ac45b105f1e293eb496efc21bae0393ff37e5bc5eea8ff4052e2db311c6061e12cfbd3d2759ad28acf9
SSDEEP 192:ezs4K6hN7KxkXqK4I40pUZNCgVLHrKHfFKslEGbFXzKD/CN+ErUkKN9QgJiMna1q:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFe
TLSH
T1FC32D867A48D9A3F0FE8D50DDC16AB8BACB4025672780C2457FB9D0803A57CE115E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0f5d1aafda43dfcfc46c5ea91d95ad9cb1d98b2c327b78d5fe6c04bb4a465188
MD5 9aec2bc1ab6513769ec5abb20751a781
SHA1 c8745308decd90ce84837cfa7bd7c85525f0b177
SHA512 b1e33f84abc1ad3efc10e0376bc23465b774eca17946848f8ed3f55994cef9e6086e0ae9d94a6b7841d6fc21de821f765dbf23c1ce0b0b9ac57e4f5a0b9e39cf
SSDEEP 96:ibJ0d+CVgOeTnnGBfYZSJK3/wSl8h4otop56iD5B6xGyvhyYD+f+cal/RNC39ISU:it0JeGnJfiU2DfJaD+Wcal/uCEy
TLSH
T139C11AB1E46DACA78CF6A885F1022D43C9A8216BAA657E54EDE84F0C01E74DD1383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f48ba0533660cbb66ac644b958f0c95f59a68c2d88bf72837fd29ef12bd336f2
MD5 e2de8a093cf25c106c2307209255a5d8
SHA1 b0efd701c1a04f17d2f19870d370734207c82305
SHA512 8bde63331771b86ad2fc67ecaafd84b95c3c46420fab35a6626bc0cf362f60cc9e15fe03ffb03d90efe96331eb0079fa1c56e31fce9b043b67b39096a69b6cb8
SSDEEP 96:iC0d+CVgOeTnnGBfYZSJK3/wSl8h4otop56iD5B6xGyvhyYMUGsakO0AGX4f+iaX:iC0JeGnJfiU2DfJaMUGsYWiallrUA
TLSH
T1BFC13D70A46DACB394F6A999F5062E47CDA431A79552AE54EEE80F0C02DB0DC1343937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a3f41f1218141fd0879797982a763061e0965282de9bfcbd2ed4a9f15d04b9e0
MD5 89e2040b5547da597fc44b917013c17a
SHA1 a6fa3f53f14492cb3257c4c5a819bbccb362256c
SHA512 b4ca1041b2ee560c31eee2a677d2ecb363a39fbb363fc71c576be90ae726d2196d095422adb305e96a9fab5d9fd7dde6aecee7ea46ced29c3349e8948291cae8
SSDEEP 96:ibJ0d+CVgOeTnnGBfYZSJK3/wSl8h4otop56iD5B6xGyvhyYMUGsakO0AGX4f+ic:it0JeGnJfiU2DfJaMUGsYWiallrUA
TLSH
T135C13D70A46DAC7394F6A999F5062E47CDA431AB95525E50EEE84F0C02DB0DC1343537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f5a4e9c290fae1c4d1b4e88060536ae3a2e59514dc919dc0c8bde5ed6d3c5d2e
MD5 dfdd58f31625bb35de32c02ebf60cd0e
SHA1 e2ba9ad3ea1d6d05fcb8b9b19db80c65b114db61
SHA512 c23a6736392ba33bb96aae1283fdc71956bcf3d68eaae7084b6fa5dfa5b54153383dada4f3be61b78b9562698a96f6b9380186c1a37290863843afb752eca0e5
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok56cD5B6gGyvhyLfOLlEbZP9v4a:SC0JeGnpDUDBfE1mLlEbj
TLSH
T150A11C71B06D997384B69889F9526B43CDA531ABDA31AE44EDD85F0C02FB0ED0346537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download