hxxp://help[.]amertias[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://help.amertias.com/
Sample260421-tefgmscx4x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4360	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212607186377823"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
900	chrome.exe
900	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 440	2172	chrome.exe	84
PID 2172 wrote to memory of 2180	2172	chrome.exe	85
PID 2172 wrote to memory of 2180	2172	chrome.exe	85
PID 2172 wrote to memory of 4360	2172	chrome.exe	86
PID 2172 wrote to memory of 3808	2172	chrome.exe	87
PID 2172 wrote to memory of 3808	2172	chrome.exe	87
PID 2172 wrote to memory of 4532	2172	chrome.exe	88
PID 2172 wrote to memory of 4532	2172	chrome.exe	88
PID 2172 wrote to memory of 4764	2172	chrome.exe	89
PID 2172 wrote to memory of 4764	2172	chrome.exe	89
PID 2172 wrote to memory of 2392	2172	chrome.exe	91
PID 2172 wrote to memory of 2392	2172	chrome.exe	91
PID 2172 wrote to memory of 4772	2172	chrome.exe	92
PID 2172 wrote to memory of 4772	2172	chrome.exe	92
PID 2172 wrote to memory of 2568	2172	chrome.exe	100
PID 2172 wrote to memory of 2568	2172	chrome.exe	100
PID 2172 wrote to memory of 4496	2172	chrome.exe	101
PID 2172 wrote to memory of 4496	2172	chrome.exe	101
PID 2172 wrote to memory of 2800	2172	chrome.exe	103
PID 2172 wrote to memory of 3784	2172	chrome.exe	104
PID 2172 wrote to memory of 1908	2172	chrome.exe	105
PID 2172 wrote to memory of 4228	2172	chrome.exe	106
PID 2172 wrote to memory of 1492	2172	chrome.exe	108
PID 2172 wrote to memory of 1492	2172	chrome.exe	108
PID 2172 wrote to memory of 2036	2172	chrome.exe	109
PID 2172 wrote to memory of 2036	2172	chrome.exe	109
PID 2172 wrote to memory of 2060	2172	chrome.exe	110
PID 2172 wrote to memory of 2060	2172	chrome.exe	110
PID 2172 wrote to memory of 900	2172	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://help.amertias.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbfdfcc728,0x7ffbfdfcc734,0x7ffbfdfcc740
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,8557091356896957609,10342158176067562715,262144 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,3692068381820939050,3539411669370275588,524288 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1908 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,266813775044175539,8143900715506084726,524288 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3020,i,2171839672489578101,16050932543605461500,2097152 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,9493198907651601836,508513443824939277,2097152 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,2170024810935694724,17855279989377861392,2097152 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,2622794538320876752,12326341127933385281,2097152 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4948,i,12746211039899476951,5145813018076535023,2097152 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3268,i,9129442575276562711,10037552020767942072,2097152 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,12855854128812940160,5941147067994301334,524288 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,7750699659134429092,4550005441226775440,524288 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,213899387593611366,17647086767222230319,524288 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,3943450437359226552,2762719804415057513,524288 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5228,i,18264558327863677519,10604677109662178733,2097152 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4692,i,6307489683296229589,3155889929503745942,2097152 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5092,i,6401955676842740979,15349041193906221925,2097152 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4360,i,7164038662828989637,13696067526494518000,262144 --field-trial-handle=2012,i,7125732306110403556,12803598863068389373,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e7491a83a726fd4bcece591a0d02c47e55c22fa07e7ebe178e82652e7074ec63
MD5 23f865f6b96956e6c22c2783cd2d9e32
SHA1 8cafee59dacb1e612c1d31da6359e5e0eac8e069
SHA512 b1ebcb0eef7fc09d15e11da052f97a076e02c628b6775bc44ace2ecb89c82132abaf02f2f3e285921a891ec7cc37397028fa1eda0c9d6e25ca5ab390f58326a7
TLSH
T133E0E5AAC825EC2718F94B1861584641E74023172781485F3B7C960D8FB6A76468682C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 904a4af682b9cfa181e6a3acb5975328aa92e2fc70a4739e4942c4ee10b8f5b0
MD5 2bc4e065969a2b404f53d416d171a97d
SHA1 6db5a1c30e353afb32f2c0ce44f63525e59aec44
SHA512 87dc7c39c5997bcb5ddfba16cb537272d30416c51e377b5a8496f8dec2d162ae07c9c7bf4b0ba6d7efd6cbeb791bb5db90846cf67061da983605fcd7d949ef84
TLSH
T1C3C0921127C4C159CF80A3B198BB05B823201B9EC8CB62A6C3EC474CCCA2EF26291D00
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e12a91a4-54bf-4a43-800c-5eac5c51fcec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e12a91a4-54bf-4a43-800c-5eac5c51fcec.tmp
Size 3KB
SHA256 0a4e53b2a6395c5568948a4eaa5caf2a55e2088d001834781ed8131f967a405f
MD5 94830204dc461ebc0d62c5d506f4f4c7
SHA1 fa3fb6c75e630eb117c43a4948ac9875e6bc3e31
SHA512 dee1e71b3d022cecd16fc507fba7ae2fa9da641548a4041067543836751ac29340d7e2b8fde3faf79c546cea374656fbf28a061a7aaa91a278bc0c2fcec39d7a
TLSH
T186617BF783F48A7ECA1196E4AB156E1FCE690924431C3C66C8D4AE0B57E6971E20038F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9a04859c40775af7f8a56c4c126bd60f31c864fac372df3ebc3faf568151d4db
MD5 217588cd6230fc4c1319a462875a2a36
SHA1 e918942fb2da5c89f6c3f6f1a48cef2a91beed01
SHA512 3df49ded7931a689eee969204ffc9ba89f28935506870da1011de3429e1b2a3dc4b9b19622bb565fd53aba5dfcb2d6d0e373256fc09fe22e20a4cf2ca8d06248
SSDEEP 192:cReovWhLkEv7rpAPRp2Wh98Hkub+WNnBIM3Gb2/gr2T3frlKVyIsnAUge:cReov1gHUXr6ZaR2K2T3j4e
TLSH
T18242E72EBD10797B5CDBC229F9297757D7F2102120912E84EAFCCA2C14E7ACD221746B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b33b394cfbcaf34e9537592acd4f17f8c08084a50b0c9c9c77d25d6596965dae
MD5 8402a0a7a0abf5e3c094afa16200b32b
SHA1 3dc032e9b2fd6a50c536dbe4c86754e41b16417a
SHA512 02bb1bd92ea364e2491f396d5cb18a7ebdcd3064c5674c075f42d7956c3e50a013041c5f2fac39fe96afb928a0d5ae4a97c9b86202c42542c66473028cf5c47c
SSDEEP 192:cReovWhLkgNDv7rpAPRp2Wrk98Hkub+WNnBIM3Gb2/vr2T3frlrVyIsnAUgE:cReov1A7HUXy6ZaR272T3jXE
TLSH
T19652E72EB910797B5CDBC229F9197757DBF6102160812E84EAFCCB2C14E7ACD221746B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 05bcb0263772216cf22e7b409eef174ffdae9ee374e98d1d1c2df9b3147f2d82
MD5 86561075327a2a5c3aeba5adff5e09fd
SHA1 c43dd5f15a45a29f3bd5248464042a8aeddec727
SHA512 be88a2448b2a0d916c1d1c8ab7f329409db7b021bbd29b6531c7e4903ae2b8dfa1bd145e8cdd90e91df36917933c8255a386a07a10a7a15a26125dd0e928577d
SSDEEP 192:cReovWhLkgWv7rptkPRpqfer7r9rk98Hkub+WNtUrkrpBIM3Gb2/9r2T3frlpVyN:cReov1RHaXM6ZtIR2B2T3jRE
TLSH
T15652E82EB91069BB5CDBC225F8597757D7F6102161902E84EBFCCB2C05E7ACD211346B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 04a17dd6c535f2162e20d3e911ac7c213c0cb91ecf0b13b11b84df9eec2e7cbd
MD5 12daf4b9ba1d209eb8412c9a89846028
SHA1 e1ff893d7ee3640e90c690a6ab8bbcfe69cd0f07
SHA512 a47865df77759127a88a3316c7f4f5cb18f5e7d957f78887d4850d5ee9d52d8509fac1e34e14f8ae3a60ab37bf0e60b75e3548c87ddd25e1cb363e251af11c07
SSDEEP 192:cReovWhLkgsv7rpAPRp2er7r9rk98Hkub+WNtUrkrpBIM3Gb2/vr2T3frlrVyIsv:cReov1DHUXm6ZtIR272T3jXE
TLSH
T1BF52E82EB91069BB5CDBC229F915771BD7F6102161812E84EBFCCB2C15E7ACD221345B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 459033ff23086a918e5b957520f1bdfd3a74faa4552d8f328cf79409c69f43be
MD5 548aa6e7c5a6125ef79599035978bd23
SHA1 5df0a6931cf3091881d554908afb143c153421ba
SHA512 7d467316638ccb9b1a56dd19d90598b17a719b4afe2248697589c11423049590e37530931bd95743cd631ea0fb345618237aec77703b390afe48ea3ff5548763
TLSH
T171B01250C0029A81C45302F821C304AC31649F108707170193E079B5A8261F04018151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cd7c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cd7c.TMP
Size 96B
SHA256 341a0c0334afa371f9825452dd5f416d11646ab03ae30d8e5c817880a5de0836
MD5 527aa014614fce2914be8ce6b5a4611c
SHA1 e44eddb0533263d2e70d80c914ea5aa0d79e51ca
SHA512 058f51560981cfadb70fb9309d73f0c85d349c6c7d7f18fc2093242b4eb77e2b1afdb19dc89f69997f5de235772dbe517b6e53487851023555e74dafb1cc9419
TLSH
T12DB0026AC102A323C04217B039D695D97164DF26CE13561A92E45E67DC297605575D60
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 026e0f5eb7e2cb8901271f5a1687b82bd5658877c66c1e293e986c6d9d36d4f8
MD5 89278e46549bc9881e85ef52dfd2294c
SHA1 5a74f628c3364a92054af0846535b5680789b64d
SHA512 a13355b2f2b2884126c1b27337e396ef032a8ea6dc5272465bff48658ca0f599e1feeb453dd311d62e09cf303e68a0847e540fab3561c0b541254162f1bd1ce8
SSDEEP 1536:2BTKcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:Ou3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1DF9302BA5D2A49E795BE5692729E3809CE12130E716FA8CC7268538C31D41C82B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 ef3814552fda8af45531ca1a4f492d28d8d136854135231d24b5b819d1ea4794
MD5 4b4310e5a316aced854e45600d10987b
SHA1 3b671f3c0d7fd2105bc97884bedb876d1ebc8ea7
SHA512 3674f75319d32ff7284e3942c1fefc68972e7d8b2f67aafd62c14fd685c4a51352031552f16b304b5dace2ef146dbdb61bb613471a5ef37a0d5fc36a89815dc3
SSDEEP 1536:gTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:i3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T13C9312BA5E2A4AE7957E469176AE7809CE12130D70AFA8CC316C539C21D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 fd91bfc0b9e2a4c69df6f104de1523c8cf17b95421b3ba8f672855a1990e74bb
MD5 665c3de387bb5718394ffadf326b3ab7
SHA1 86177090415d06e9d6c9dd24f871a419ab1f64ad
SHA512 1b1be0b97936effe60a7f643cc96209de9f0a17b3d010f91df2a99fb36bc185980597efdbfa15afff334c0c68f75c034eab9f7c68fd78acfc65eaa5a5149de3c
SSDEEP 1536:5xBcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEL:Z3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T10E9312BA5E2A4AE755BE46D1725E380ACE12130E719FA8CC7268139C21D01CC2F73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 d3576d1ea6d6e00a8bf4a2cbf275992ccedef94a53ef3db30f131dc58b1437a2
MD5 5c075d71dcffa73fce7d6abb33ee2764
SHA1 cdd51c8214d144d223cd46fad983688611df2b5b
SHA512 48f5c63971341a4daf0ca6d2b014177db4f80489110556fd51e3325ed889bc902eacfa9d46aae41ba16afeaadee23364daae7946c5bc98184ad103a4e6f8cccb
SSDEEP 1536:2xBcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEL:e3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1E49312BA5E2A4AE755BE46D1765E380ACE12130E719FA8CC7268539C21D41CC2F73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download