hxxp://goldasia[.]cc

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://goldasia.cc
Sample260728-fgfcrsfa82

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5964	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296878409446171"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
3656	chrome.exe
3656	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe
Token: SeShutdownPrivilege	4956	chrome.exe
Token: SeCreatePagefilePrivilege	4956	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe
4956	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 3548	4956	chrome.exe	88
PID 4956 wrote to memory of 5964	4956	chrome.exe	90
PID 4956 wrote to memory of 3632	4956	chrome.exe	91
PID 4956 wrote to memory of 3632	4956	chrome.exe	91
PID 4956 wrote to memory of 5980	4956	chrome.exe	92
PID 4956 wrote to memory of 5980	4956	chrome.exe	92
PID 4956 wrote to memory of 5428	4956	chrome.exe	94
PID 4956 wrote to memory of 4436	4956	chrome.exe	95
PID 4956 wrote to memory of 5428	4956	chrome.exe	94
PID 4956 wrote to memory of 4436	4956	chrome.exe	95
PID 4956 wrote to memory of 1996	4956	chrome.exe	96
PID 4956 wrote to memory of 4468	4956	chrome.exe	98
PID 4956 wrote to memory of 4468	4956	chrome.exe	98
PID 4956 wrote to memory of 1436	4956	chrome.exe	99
PID 4956 wrote to memory of 1436	4956	chrome.exe	99
PID 4956 wrote to memory of 5920	4956	chrome.exe	102
PID 4956 wrote to memory of 5992	4956	chrome.exe	103
PID 4956 wrote to memory of 5920	4956	chrome.exe	102
PID 4956 wrote to memory of 5992	4956	chrome.exe	103
PID 4956 wrote to memory of 3832	4956	chrome.exe	105
PID 4956 wrote to memory of 3284	4956	chrome.exe	104
PID 4956 wrote to memory of 3832	4956	chrome.exe	105
PID 4956 wrote to memory of 3284	4956	chrome.exe	104
PID 4956 wrote to memory of 4776	4956	chrome.exe	106
PID 4956 wrote to memory of 4776	4956	chrome.exe	106
PID 4956 wrote to memory of 4732	4956	chrome.exe	107
PID 4956 wrote to memory of 4732	4956	chrome.exe	107
PID 4956 wrote to memory of 4788	4956	chrome.exe	109
PID 4956 wrote to memory of 624	4956	chrome.exe	110
PID 4956 wrote to memory of 4640	4956	chrome.exe	111
PID 4956 wrote to memory of 3656	4956	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://goldasia.cc
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffec7e3c728,0x7ffec7e3c734,0x7ffec7e3c740
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,1565870210480102887,6638141392245640238,524288 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,1795566877718679831,6699112342854132402,262144 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,4894772966721040382,8387792253004436358,524288 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,1046493440759499337,11771082830762649081,2097152 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,15651560215012991734,3181694144584236176,2097152 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,11071273198878093688,18034545810033149161,524288 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5572,i,5810635766229527717,11433657666719792600,2097152 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5636,i,10277250892848326106,311638490199948194,2097152 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5800,i,8116567073555889919,17119622951201676987,2097152 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6108,i,8831360375276870109,9343436180780583693,2097152 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5380,i,1012598859931056724,14204879187972306514,2097152 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5892,i,8294133732149621192,14695906431428955,2097152 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5836,i,4269695636466592866,915327264155154950,2097152 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5440,i,15960335124697016537,8411098644829162919,2097152 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,8060138491741234206,7043566219806297445,524288 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,13894850473661190099,5008833314790866378,524288 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3184,i,17794487841898607332,14429378121063051386,524288 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6016,i,12135901550130539259,12213713182237715872,262144 --field-trial-handle=1908,i,10325950655329343229,161932037910257076,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 df973f3c75f64489bdd4cbf925761566418f98982dc526f0d071772164e2bfdd
MD5 94863deec71e8bfc9c7087a4127439ac
SHA1 166d5dfb900f4eafae49830662a458ac5d8283ab
SHA512 9ba061173ece814b20fd974af3ca7d79d12ed3a107232a3b23000ddc5a7d12de1d7e454067f1bf1e9ef417ebc67701bafd68d8fcaa21119a10a9e96438f22f70
TLSH
T13D319CF7C3D4997D890456F8A7157F1ACE290E18531C3C26C9D8AE1F57E6872D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8dcbea97c0500431b859d133c3da1b47e5f818250217ded72bb60b08764e2c39
MD5 3b62d45ce1dcb3f28bc7bb554f7c56f3
SHA1 fb70e0d812b77f24eb9b58bc0c7142df512fe3e8
SHA512 336441c47ed3dfeffa7ab635bc33bafcf41a2fd2adb7e4a20ad72def0266cf00ed994bb3a83f1dbf5009128b6d18affa7751d043de36b30c6a51629fc80851ee
TLSH
T131418CF7C7D8967D890556F8AB156F1BCE2E0A18432C3C66C8D4AE1F57E2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a69950768e8e7b3b4cfb9f8828af301274e40ad5088766f5f94c424323557660
MD5 a4def7b5a28ef7d8467305d2b9243df1
SHA1 b91479a7d45101b65b25a4081d38f23dcfce822b
SHA512 25d7e57e2395db85402d1a43bf544f63337f1f8c5a993709116e629f4a27d334c14c78bccbfc327bde5caf4ee7a026dc139dc4f38585cacfff20e52dcb54bd3f
SSDEEP 192:dREIb434v7DvAPRp2uV964HGi7b+WNn0MPK5B2Keew3fHVyIsnAUge:dREaskH6XDbj5PG2lhe
TLSH
T1FC42B63EB964697B6DCBC219F9657B53E7F6102261902E80E7FC9A2C10E76CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b33ecf6365644b45b982b8248aa5a831b0d7eef3dedb4ecdf9a0b0dd831bf0aa
MD5 520219056e06bc010826470004b9b884
SHA1 d971ac4baaee0b84a2576547dc045a8bd0514a26
SHA512 07a534de22771d78122edd356b7ea263eb4f4640b63c14b6b4c5b9135e5c1d638a6f3da416155369e8cd2294b9ff6204ff517ce8cd861600cad11f9ca881c408
SSDEEP 192:dREIb43Jv7DvAPRp2uV964HGi7b+WNn0MPK5B2aeew3KHVyIsnAUgE:dREasJH6XDbj5PG2YhE
TLSH
T1D042A63EB964697B6DCAC219F9657B53E7F6102261902E80E7FCDA2C10E76CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ceafc524efb32718f219b7c388f9a65e7c377daea6a25802bef801cc35fcd629
MD5 349c6180369f16f08609017e77c38a58
SHA1 d5ff2812b7f9ba13d1086d8b5e1e6cc7716a49b8
SHA512 1551fd0c4727c0e9d2a2114fd7e5bc5bcbc50f45c9c848077d796b08035333b5a5a27e4956067257e47153baeb3aac0dad20f84d7d1f1ba7b40f8509b77fcd36
SSDEEP 192:dREIb43Jv7DvPPRp7uV964HGi7b+WNn0MPK5B2neew3+HVyIsnAUgE:dREasJHPX6bj5PG2FhE
TLSH
T16042B63EB964697B6DCAC219F9657B52E7F6102261902E84E7FCCA2C10E77CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3cfd3ee9c90fa6405818ff05cea2125085985dbe905f979bd3c6c954dfd3cd62
MD5 bcb8cacdbaca61361d9f4161251df97e
SHA1 acce9fed4621401a67bb7addf6db32511c3e4f3a
SHA512 a4349de9b6cb0ffd6525038d08b9fd59a6f0ea88011044d4251c886a08d71b72832db069d3ae9e655267895cd26d5bae7293d997e85dc8f8d46dd7181d1387eb
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7DcOzSl8h4otop5QpDuB6rGyv9JLAQDAzRNC39ISyVNQ3:Ct0LA/TE579hiU2COH+LAQDAzuCGJ9
TLSH
T13CC119B5A4AD5DAB0DF6A485F0033D83CDA8A05BAA257E44EDED4F0C00D35DC5383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ebfedb748973627e2748ce3b299f4a9b7fced687ad93ddd6bee7809e394f3df4
MD5 dc445a495124b3723659f72c10b4c82b
SHA1 17598f158eab03aa7fdfc1b650296714fd80073c
SHA512 c193422cbdabafada23194aa41c7880a8b5b6a96cfe4a0036aa8d85feccb62c7814fdb32578e5cab3f81a521d5798eec9b5000a878cdc0207f22c883f907d205
SSDEEP 96:CC0d+cAOIt5aDVmufj7DcOzSl8h4otop5QpDuB6rGyv9JtFiO0AuSwXSDAzr0j9K:CC0LA/TE579hiU2COH+tFGSwXSDAzrUK
TLSH
T1CEC13BB5B8AD6DB36DF69554F1437A83CEB4A157AE226E8089ED4F0C01D71DC2383623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 31866a9371a5d2fae432b586e78e2bf74b1eca2eef1d5c4c61c694bc261520a8
MD5 5dfaf5d6c420d318cd9684022519248c
SHA1 bbcd0a71c8872b02db1362dfc76a1b1be020891d
SHA512 4730ee763a690f7845f046837006cd263574f9a93133221a908d04a3dd6350711fd3e5fea3002e8985d1b4e01050a991c7b4481bc40073314ec80db128d7ecdc
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5QCDuB6/dGyv95SAhbb2Jv4a:gC0LA/TE57cDUDzOUweSAhbKl
TLSH
T1DBA10871B4A95EB75DB5C584F4827E83DF68A117AA226F80D8DC5F0C10E71EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 01e001e978b80fd4aadf85f5f8db20887d048406cb89a843d3dcf3b2da680afa
MD5 4ca26148e667ea03537166be1f885a5e
SHA1 72eb80c733f4ec2669193fc81ba363c35b947b90
SHA512 7a54b5e2072ce8ac5c7095a9f7046789c0f5259d3fa46783ecbfce37beb85668abf51a947a23eeb3767244651dd2521ebb425585b69ee0b75fe4a4f1822c2e1f
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7DcOzSl8h4otop5QpDuB6rGyv9JtFiO0AuSwXSDAzr0j4:Ct0LA/TE579hiU2COH+tFGSwXSDAzrUK
TLSH
T145C13BB1B8AD6DB35DF69594F1437A43CEB4A157AA226E8089ED4F0C00D71DC2383623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download