b523b5c8e00d17dcccf9361de60b55a94b82b7c3f99e7a1bc8f360dfbf0085d3

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voicemod.Pro.v1.2.6.7.Cracked/Voicemod.Pro.v1.2.6.7.Cracked/VoicemodDesktop.exe
Size 2.3MB
Sample260704-e7gg3sfs9k
SHA256 b523b5c8e00d17dcccf9361de60b55a94b82b7c3f99e7a1bc8f360dfbf0085d3
MD5 a7a9f1e62af46756fa9a398273bd532d
SHA1 70336382aa5b56b7056b5595f43045d336656072
SHA512 bd9e1c0cd2f8f5019c5e51ddd27d022a383f28897fc771af85d0f38c8ee1e72ea334e4f50b395d084a5bf2e0d1bf835d82209ef153da8f493f2ddbf9cca2ad5b
SSDEEP 24576:IGLjWwo2aKdZqMx6v1UpexYxxNFscBh66afIaYYXpviEwromNzWF60O8wr+i:IgDq0GAlF7LafIXYXpdwBPew
TLSH
T1B8B58C513BA0C809D47A6E359D30C5EC97327C06EE66E60F78D63B5F29BA7924E11323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/5024-0-0x0000021C49400000-0x0000021C49648000-memory.dmp	ConfuserEx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2040	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276134060675363"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3960	OpenWith.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 3272	4288	chrome.exe	103
PID 4288 wrote to memory of 2040	4288	chrome.exe	104
PID 4288 wrote to memory of 640	4288	chrome.exe	105
PID 4288 wrote to memory of 640	4288	chrome.exe	105
PID 4288 wrote to memory of 2708	4288	chrome.exe	107
PID 4288 wrote to memory of 2708	4288	chrome.exe	107
PID 4288 wrote to memory of 4376	4288	chrome.exe	108
PID 4288 wrote to memory of 4376	4288	chrome.exe	108
PID 4288 wrote to memory of 4000	4288	chrome.exe	109
PID 4288 wrote to memory of 4000	4288	chrome.exe	109
PID 4288 wrote to memory of 1692	4288	chrome.exe	110
PID 4288 wrote to memory of 1692	4288	chrome.exe	110
PID 4288 wrote to memory of 3580	4288	chrome.exe	111
PID 4288 wrote to memory of 3580	4288	chrome.exe	111
PID 4288 wrote to memory of 436	4288	chrome.exe	112
PID 4288 wrote to memory of 436	4288	chrome.exe	112
PID 4288 wrote to memory of 4156	4288	chrome.exe	113
PID 4288 wrote to memory of 4156	4288	chrome.exe	113
PID 4288 wrote to memory of 4604	4288	chrome.exe	114
PID 4288 wrote to memory of 644	4288	chrome.exe	117
PID 4288 wrote to memory of 644	4288	chrome.exe	117
PID 4288 wrote to memory of 5084	4288	chrome.exe	118
PID 4288 wrote to memory of 5084	4288	chrome.exe	118
PID 4288 wrote to memory of 4236	4288	chrome.exe	119
PID 4288 wrote to memory of 220	4288	chrome.exe	120
PID 4288 wrote to memory of 4508	4288	chrome.exe	121

C:\Users\Admin\AppData\Local\Temp\Voicemod.Pro.v1.2.6.7.Cracked\Voicemod.Pro.v1.2.6.7.Cracked\VoicemodDesktop.exe
"C:\Users\Admin\AppData\Local\Temp\Voicemod.Pro.v1.2.6.7.Cracked\Voicemod.Pro.v1.2.6.7.Cracked\VoicemodDesktop.exe"
1⤵
PID:5024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2492

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcb835c728,0x7ffcb835c734,0x7ffcb835c740
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,13200903037999527045,2212083046673126467,524288 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,2002140610537493934,5216277304544312619,262144 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,3168501360074944190,1949299367696792156,524288 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,11267761763290423939,7660257937282675523,2097152 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3436,i,8283724407252891744,13946673608925607735,2097152 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,6958218606403121635,14732135617731018740,2097152 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,7741082601713658155,2931661107347724496,2097152 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,1574035730123565859,16492745551485931410,524288 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5036,i,14841228010392628239,16649033929782719774,524288 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,14038475434874300020,855363447207328550,524288 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,9534710773906582551,13421342932625872874,2097152 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3604,i,9356431571911690152,13459384848359566885,2097152 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,15651239855679252766,10803763616627214075,524288 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3968,i,1337865327888128080,2437710420131359616,524288 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3988,i,16482498796621391057,12336597056476245347,524288 --field-trial-handle=2028,i,17329528749622946318,439005147453212200,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:4508

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e15f363fefc650b6519ea3c720a53ffff462d606bcf7c8c27748f152b6b165b6
MD5 3db1145962deb3c5666e13fe9760b54f
SHA1 f265343b33b03efb53b20636d366fa67bce4b75b
SHA512 c59f17360f271e107c7b5933d6d5d940d27945e7e4f42f215daf971276113cff8041081363f6ce15044e8c79eeab71644a1f4d9838dc976c17eaf3175e97a92b
TLSH
T16CE0A2AACC209C372DFE074820910B05FA2513072B80881F3B3CE31C8FB062A01C2CAC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 4b183ac7694773330106044f5fefd7277c7c5cac17b29620035d253b550c0a0c
MD5 7a2cda2f3ed0e9c8e773330f673c31e4
SHA1 71b29e875a8f850dc6d4bb97f7161840bba562a2
SHA512 9f5b5d68e66b35f4700637e5600fb3e763d59ad4e2b849eadad75577445b1e01fc7aec0af297348ad1c703f35e2509f8fd28ea3795437ce24d07caef14f4c2b0
TLSH
T153F0DFE131C280E6CF6D023105EA3922A771E6840206EBAE415C9191B2F7D317D1384B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b8ddabce67d1376b89ef4fb09aa4d2f15a1f471056c05baa9aadf59dd8117846
MD5 9ffa7c98df7618b13e80b0471c88f8a3
SHA1 dd26781a58c86ad1fad56106fc5f390040198627
SHA512 97df9e5b76b0b5eb026305dc6d52ab48f8fdce1545fd8a7ef8e39ecf73be502216c0b8e346e9eba9a8f8e1407f6ecf41344a56e0659db3e1f5421d23596951eb
SSDEEP 192:cRXcBzwLgrRzi4ARgqgbv7hpAPRp2HV795Hsb+WNnHs4YP2UAeG2uYgkVyIsnAU/:cRXmzO2zi4AR8j9UX0rwMj212ulg8
TLSH
T1B452E82FB910597B4CCAC21AFD667B27E7F7102276942E84EAFC892C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f903df8d1b36741f8c094dc3196edacf389c9b9cd21fbd9a790a47aa7db2a3b8
MD5 c11faa6da5c12a1cdb8df3baa7e724d9
SHA1 8e59e26dd34a27a90d691fedcefbdf562d95602b
SHA512 27c7eebd7b63d6e9ce9f3fa6ce6fda8ebdf4f1596f67483af7fdf486079bc776a819b05b994704c2f4a43ef2d38e6a7d52a1ea2e17593b46760153d562983ffc
SSDEEP 192:cRXcBzwLgrRzi4ARgqhSD/Yv7hpAPRp2HV795Hsb+WNnHs4YP2uAeG2uYHkVyIsB:cRXmzO2zi4ARwDM9UX0rwMj2b2u2ge
TLSH
T14E52F92FB910593B5CC6C21AFD667B17E7F6102266902E84FAFC8A3C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9e4ed1cd17644013184932b18d2133b5bcd272cfccd04ad6685e14e111cec0eb
MD5 226d235fd0fde702e402e944e9426089
SHA1 971c356952fb8989d617c52d5adcbe3d92ab9d52
SHA512 b68205b6f773651d8063d8b3df6f32ea7056725f824c1eb9d719ecebba4dc4ccb234b88fedec1d6d17c2506cec3818b5cdba266f24a55c73e4941bcedc4df502
SSDEEP 192:cRXcBzwLgrRzi4ARgqwzv7hpAPRp2HV795Hsb+WNnHs4YP2uAeG2uYHkVyIsnAUp:cRXmzO2zi4AR8L9UX0rwMj2b2u2ge
TLSH
T19052F92FB910597B5CC6C21AFD667B17E7F6102266902E84FAFC8A3C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7bd0c5fac8f1b14595509db415203bd3af883d726ce733fa1ef5eb6d2817dc9a
MD5 7915fbbbe0cf2693670491ee62d839f9
SHA1 fbf23e1a34c549ff4734076f6607ce0fd231b01f
SHA512 aa2c2a56695165c08581ad7abf2ad43341c8987de0e257e4b81e9a803174f69e07091d2e5e262c07c195e92a546acbdecc86b63ee51ff3f46d67473c16557fd6
TLSH
T1EDB01240C042D142C04E03F4224714C87154EF20960A170187E06E27C8256618015091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2982.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a2982.TMP
Size 96B
SHA256 e76af7a40665c8f8f5fb9579d60e43d5c08598e0e36d593813ff9b4a14340f86
MD5 0396ee1270ef879ff63bf3389e93d278
SHA1 726b8d7dd6fdfe467ec0dc4efb1aa1fa4171cdaa
SHA512 d4c513395ed847fe6e29b40f3ba6ff9d226cf44dd1514eae72f9f49c4dab13116b7e127c65f51a8402a037113628a18421e76bcc10cd150ca7645864c2c1701e
TLSH
T19DB02200C00222C2C08A03B0288082ECB2A2EF20C2030303A2F00A3ACC28FE00022020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 22d21ffde9474773616cb2f9c7cd188f5f5a17b8126f6f4d8a09cff667c4b163
MD5 88cb23a6357a0df2d5a1d932eea075c6
SHA1 2cf025fe465db4c7bf3467018c29fb8cf992ee74
SHA512 a90144ed7ac5d7b65f53cb5e82c31d891c6b63360d8b0ed0e3cfb53a987887500f1c335c6d4605e26be6d6c1ca67f71494119ab9016737a4fea4ec50e20da2ed
TLSH
T1C7A002E5C2D00D46C84403B023A701C47B6198354711C643DED40246887BD836146205
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 662b065403864b788dfc58b406cfeda67caed15563b973fd885350334b90b574
MD5 2e3cc2ba12ad476adfaea25eca5b7752
SHA1 0a6e1ddaf21c5c0261aefa0b931832cd032e3f3c
SHA512 2b6fc82990a66c3532b0260a5ab305e3249de0c00810bedf6360d0f2a2d4918a6297f012d2057022797bebcb2442f0ff0046e048ac235fd2522bd91ecec6bf62
SSDEEP 3072:D51mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5eqfd7NtZL8cHQRZEQ6SpsT:jmg1kQfATCFbzQACjXqZ/ZLW3ExT
TLSH
T10534123B9FD10E3A1F424AB076430EE9B3F65A6AD8305744937E27F769C3C462782459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 09999a05339c4ac01071023f0cdf1076901fb51139be819a37b2a49c7dcffab9
MD5 0de2b90998519daeff8d02efa2a5f91e
SHA1 344441bbce777e6fcba69602c1e64a344daa5c2c
SHA512 973e81afb48bcafaac1dd45168bea600eb22a18622d32052e2d4da0b0396c0daad6010039c3e553839f2092fe4ebb495e64700d2d33789c61b58a8d03329abcd
SSDEEP 1536:6wyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:jqfd7NtZL8cHQRZEQ6Sps9
TLSH
T164C30237EBC21F335D82CB64BA534FDA97B644A99030D301AABD3BFB6C93451648249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 62012a8f853ab3314b14073102f47437d3c96f48801a8b13aa0b0d14792f55ad
MD5 999e72567c63b4785bd360918984595b
SHA1 d1cf7deaf01235bbe972ccb011ba1a11d1d1abe2
SHA512 017eb58c0d56a8bf64fb7e7f94287c9ba550e3e7e997934ddddd72116f8f09cad98bf4c06dd24fb5b253e21a341e36e6a72c784b6ab328981209fc2994f6ef7a
SSDEEP 3072:q51mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5eqfd7NtZL8cHQRZEQ6SpsT:gmg1kQfATCFbzQACjXqZ/ZLW3ExT
TLSH
T19E34123B9FD10E3B1B428AB076430EE5B3F65A6AD8305744937E27F769C3C462782459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5024-0-0x0000021C49400000-0x0000021C49648000-memory.dmp

Download

memory/5024-1-0x0000021C4B240000-0x0000021C4B250000-memory.dmp

Download