hxxps://click[.]benefits[.]inspirafinancial[.]com/?qs=ABB7InYiOjEsImQiOjQ5NDZ9AAoAAAAAAsFsdCU88z8y4rijlfyxDhzN0CGx7O45MEU7U7zYgY0yUuXHUGmJcwyZWqXyZzRu9pNQbe9Yn1OFMjuH7CuPVv9mYnXJy_BnRkGh6g3PZ3DSawy0

Analysis

user interaction
yes
max time kernel
59s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click.benefits.inspirafinancial.com/?qs=ABB7InYiOjEsImQiOjQ5NDZ9AAoAAAAAAsFsdCU88z8y4rijlfyxDhzN0CGx7O45MEU7U7zYgY0yUuXHUGmJcwyZWqXyZzRu9pNQbe9Yn1OFMjuH7CuPVv9mYnXJy_BnRkGh6g3PZ3DSawy0
Sample260727-wp4nbscc73

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3264	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296492173064729"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
952	chrome.exe
952	chrome.exe
952	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 3132	952	chrome.exe	85
PID 952 wrote to memory of 3972	952	chrome.exe	86
PID 952 wrote to memory of 3972	952	chrome.exe	86
PID 952 wrote to memory of 3264	952	chrome.exe	87
PID 952 wrote to memory of 4644	952	chrome.exe	88
PID 952 wrote to memory of 4644	952	chrome.exe	88
PID 952 wrote to memory of 4640	952	chrome.exe	89
PID 952 wrote to memory of 4640	952	chrome.exe	89
PID 952 wrote to memory of 2096	952	chrome.exe	90
PID 952 wrote to memory of 2096	952	chrome.exe	90
PID 952 wrote to memory of 1064	952	chrome.exe	92
PID 952 wrote to memory of 1064	952	chrome.exe	92
PID 952 wrote to memory of 3700	952	chrome.exe	93
PID 952 wrote to memory of 2092	952	chrome.exe	97
PID 952 wrote to memory of 2092	952	chrome.exe	97
PID 952 wrote to memory of 3376	952	chrome.exe	98
PID 952 wrote to memory of 3376	952	chrome.exe	98
PID 952 wrote to memory of 4364	952	chrome.exe	99
PID 952 wrote to memory of 4364	952	chrome.exe	99
PID 952 wrote to memory of 3084	952	chrome.exe	101
PID 952 wrote to memory of 4704	952	chrome.exe	102
PID 952 wrote to memory of 1768	952	chrome.exe	103
PID 952 wrote to memory of 4208	952	chrome.exe	106
PID 952 wrote to memory of 4208	952	chrome.exe	106
PID 952 wrote to memory of 212	952	chrome.exe	107
PID 952 wrote to memory of 212	952	chrome.exe	107

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.benefits.inspirafinancial.com/?qs=ABB7InYiOjEsImQiOjQ5NDZ9AAoAAAAAAsFsdCU88z8y4rijlfyxDhzN0CGx7O45MEU7U7zYgY0yUuXHUGmJcwyZWqXyZzRu9pNQbe9Yn1OFMjuH7CuPVv9mYnXJy_BnRkGh6g3PZ3DSawy0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffdba2c728,0x7fffdba2c734,0x7fffdba2c740
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,5102512262404446114,15762349173500307223,262144 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,2365151069717940604,13917581457317634313,524288 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,864496265345461934,9476172271532397952,524288 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,4173702604439373351,10063244605239650662,2097152 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,14510423211266065822,5665099757957618340,2097152 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4140,i,12122430391591553823,15521715565093641060,2097152 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,11757919466178692114,17614547094728353833,524288 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5924,i,5154752779911346075,8010846095740605398,2097152 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4632,i,9831153403777860055,12036575151705172566,2097152 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5968,i,2049783378602963321,5791660830838425531,2097152 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,505322871701321389,14946437254531217594,524288 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3356,i,1853767956266748795,11077508672575022527,524288 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,670291192163523864,7328277679138550450,524288 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3908 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3368,i,12009981309860584516,1438138008488153872,2097152 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5928,i,652069050362345966,13258108517150240141,2097152 --field-trial-handle=2000,i,2185012773030760524,6974550530082706195,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 92f198b004302fb1ff04ce797ebab5f06929ab0a3da4520758ec9ac515524ca8
MD5 1f9e45d88c5681ba603048cd226039d3
SHA1 366c1ea37e77448c93b3a1d08229c00c539699f6
SHA512 741e9ca2f71bb48a5f4175623f7935c2a3984408cba18c80a1e13caca7f08bdf8b84c7e67643a7809fedd991e196aa9198c6b30e0a79f5eb7305c06ac6930c72
TLSH
T18BE02BB9C9219D2B0CFD07696459075AF654231B2B41456B3E3CD20D8FB86360586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4797cd554a4448bd8dea47f4f133d76976f474035c97df07052d508af80fcb8c
MD5 54a40f3298fb675d32e692b763dd03e6
SHA1 605fb76b3cdaf22bbdfb27097977bf1e1e0aed2c
SHA512 53bc51e636a155769fef339bc79cb62ee9067289667303651603519a0462fea7f3907a6bda109248dbe287f7c7dc6b03a289d9871d313106807ef9181f55e92c
SSDEEP 192:wREqBgx3xIv72ympAPRp2jEc95Hsb+WNnTTAqi21hl2AeReONDqeaNStFVyIsnAI:wREqyXUQUXi7wv02x2jauzE
TLSH
T1D952B62FA920697B9DDBD229F9127722E7F5107625842E80EAFC8B1C15E75CD231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1e0e5c334645e69b1c71dc43d9dbcb26511490249804f21e2bbb331e8aab648f
MD5 8771e2232f4846d48176b12c740da062
SHA1 cebf3b7f63c72c4dcecc4c0f456cdffee8d86daa
SHA512 41ea0a5e5a70bbfafddc70afc11e3f04678d3874c3bac55d31937702f13c9831243bee1a835f3199034665a850e10c1dbbafe0f6a6b55d71b088199d89376313
SSDEEP 192:wREq/3z3xTv72ympAPRp2jB95Hsb+WNnTTPUhl2AeReONDqeaNStuVyIsnAUge:wREq1rQUXk7wvPm2jaume
TLSH
T16942B62EAE20253B5CDBC219FA127723E7F5107625942E84EAFC8B2C15E75CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1953c339b71ebcbae97f30d4ea6dd5bfd66e6021d4732b9b66b07be9d2936dd5
MD5 9e1613ce72f3618553af8e8e953372b7
SHA1 b266eb8212c8a9d90ecee838f45a9dbcbb5959f6
SHA512 7aeadd14e0a6e729f67bba2c22f903086cd4bd0b1605fd6df38ae98abe1af7c7905bd4da6a4da078dbef4a62510917c3b7e49d45dc474bb31bdab2edfc8ebcc1
TLSH
T16BB012008402B101C05602B42643148C72599F10961B5B0183E0EE22C82A6B18064160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5880d3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5880d3.TMP
Size 96B
SHA256 92576d13e84653075a068f2b3c9b7900d9547b5eaa506e086553f8bb284e4ae7
MD5 8b545111335093cbb7758c7093ddcecc
SHA1 4d35fda1ce815e075413bb217490e2b9429df69f
SHA512 9ded2e5d23cee5b917a531e37414cd65ef409406957a9afe605711bfca27f215628bfb956301ecba8f3d19248860b52bd2b56c1a33a6701d3fd55717c3c7ed47
TLSH
T115B00255C1226336C08203F4799995DC7174EF26CA576212D3E05A7AEC26B754AA5160
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ac4e2ab35b8ca38d2dabf98ca586b40e859d674f540c9cde73dbc63eb0a773dc
MD5 a8153fb334cb5767295c2a6822178d77
SHA1 864e8191f62e0fd0b9a953454ac580271a3dab2d
SHA512 ca19b5029b352da5df297bd26ba415554881c73c0826a24cac040f9364b1dde235693d5dd1e54944732c295aeff8755974f0d62da0824b693ca5fc0663a9caba
SSDEEP 1536:TGQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:vqfd7NtZL8cHQRZEQ6Spsk
TLSH
T141C30237DBC21F339D96CB60B9530FD697B644A99034D301EA6D77AF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4c86873347351b6853f167939be52a0e64646eec69de1081466f6d7724d6d034
MD5 dcdbb26007fd49524327cdc1857d4e20
SHA1 b5763258e30d814abae9b22b1fbd6aa3530db897
SHA512 defcc7579323c886fabe88d7ce79dfcefc2161a82a4adf401a68fe580e7c9a2eec1e768d71f6a0e49f13eac63b642a956a0169d50f4239fc66e289553eec9f04
SSDEEP 1536:/LxQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:tyqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1CAC30237AFC61E339ED2CB70B9131ED797B644A9D034D301AB6D27FB6883491698249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b4e31c639506349bcbe8d84e2c01155bae1f709f4972df6e5eac0407969c9da0
MD5 e9e31913362ff7458b3e835e0b783b34
SHA1 0bb9a019dc095cd4cbeab279591ea4fc6a618f93
SHA512 a629e3dd6c27717a300b3c5fd2b588a9911aaad7e20934b2c475fa88da807b037c626b3979ca8e329d2774aa6f3e1c8c00c855d2e2b692db6b816f46b1803247
SSDEEP 1536:MLxQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:+yqfd7NtZL8cHQRZEQ6Spsk
TLSH
T103C30237ABC61E339ED2CB70B9131ED797B644A9D034D301AB6D27EB6883491698249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download