9e78d6f206a7f3d4dd6f043147f054c88ef5cda35b79118c7793717cec5ec874

Analysis

user interaction
yes
max time kernel
84s
max time network
81s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7vdea5vzwdsj.html
Size 5KB
Sample260808-spd6wstsaz
SHA256 9e78d6f206a7f3d4dd6f043147f054c88ef5cda35b79118c7793717cec5ec874
MD5 2b276404a9e9710570828f38aa8ea88f
SHA1 8c73d563791bfe8c80b4b66a3825ceb8200a240a
SHA512 cb94971da12ab5945ee33f6db2809d5762db4476ffd74adeaf62ec1c483100682ea9d55dec130c88c2c3203575fd80a3daf0d7759b6e91493f3fc893c8399a4d
SSDEEP 96:PNywtoXZzIEb0EaW87kd425gHBZ8fbpW8VW1zbiYzueh8TWVmw:PN9tkCBug4013vyHw
TLSH
T183C14AA3AA36112B9BA83F97A0B3735C5300E35E7A04549DEA91D72CD9EDE0BC2142D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
47	3356	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
2120	TheChoicerVoicer_0-5-1 stable compatibility.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	13	https://fuckingfast.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27f7dbbacad63f5	5

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TheChoicerVoicer_0-5-1 stable compatibility.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3356	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306758723677282"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	TheChoicerVoicer_0-5-1 stable compatibility.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TheChoicerVoicer_0-5-1 stable compatibility.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
2120	TheChoicerVoicer_0-5-1 stable compatibility.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2120	TheChoicerVoicer_0-5-1 stable compatibility.exe
2120	TheChoicerVoicer_0-5-1 stable compatibility.exe
2120	TheChoicerVoicer_0-5-1 stable compatibility.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1332	4076	chrome.exe	80
PID 4076 wrote to memory of 4492	4076	chrome.exe	81
PID 4076 wrote to memory of 4492	4076	chrome.exe	81
PID 4076 wrote to memory of 3356	4076	chrome.exe	82
PID 4076 wrote to memory of 3744	4076	chrome.exe	84
PID 4076 wrote to memory of 3744	4076	chrome.exe	84
PID 4076 wrote to memory of 3284	4076	chrome.exe	83
PID 4076 wrote to memory of 3284	4076	chrome.exe	83
PID 4076 wrote to memory of 4008	4076	chrome.exe	85
PID 4076 wrote to memory of 4008	4076	chrome.exe	85
PID 4076 wrote to memory of 2244	4076	chrome.exe	86
PID 4076 wrote to memory of 2244	4076	chrome.exe	86
PID 4076 wrote to memory of 4012	4076	chrome.exe	89
PID 4076 wrote to memory of 3760	4076	chrome.exe	91
PID 4076 wrote to memory of 3760	4076	chrome.exe	91
PID 4076 wrote to memory of 5104	4076	chrome.exe	92
PID 4076 wrote to memory of 5104	4076	chrome.exe	92
PID 4076 wrote to memory of 4896	4076	chrome.exe	93
PID 4076 wrote to memory of 4896	4076	chrome.exe	93
PID 4076 wrote to memory of 384	4076	chrome.exe	94
PID 4076 wrote to memory of 384	4076	chrome.exe	94
PID 4076 wrote to memory of 3920	4076	chrome.exe	95
PID 4076 wrote to memory of 3920	4076	chrome.exe	95
PID 4076 wrote to memory of 5004	4076	chrome.exe	96
PID 4076 wrote to memory of 5004	4076	chrome.exe	96
PID 4076 wrote to memory of 4604	4076	chrome.exe	97
PID 4076 wrote to memory of 2980	4076	chrome.exe	98
PID 4076 wrote to memory of 2440	4076	chrome.exe	99
PID 4076 wrote to memory of 4572	4076	chrome.exe	100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\7vdea5vzwdsj.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8957c728,0x7ffe8957c734,0x7ffe8957c740
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,8935744723410468115,16699153912565543243,262144 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,14379449524192010927,12357065266341956156,524288 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,5018917445954072569,4174098660526045781,524288 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2856 /prefetch:13
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3056,i,827098179266963017,7267889572799513517,2097152 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3052,i,15045439341597884724,17344196168738608441,2097152 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,16967249877922680352,11477554446184980955,2097152 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4212 /prefetch:9
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,6021189698507965526,127777374458184375,524288 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5640,i,10734215438069117021,1269286489187397088,2097152 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5332,i,5866733821813949245,6792176108201505200,2097152 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3760,i,17803335017509905339,13913376467524136715,2097152 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5580,i,5399552871572923868,6245785600199224662,2097152 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6060,i,6851319457947780069,1614615480076313887,2097152 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5696,i,8247682468016745341,7102190433273351796,2097152 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6304,i,4193664413702222651,6781181016830821673,524288 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:14
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,13899715150220654965,13092218790649949045,524288 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6280,i,16199548368202776966,8060150924336839630,524288 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4192,i,8909337110099895343,4627427925850290203,524288 --field-trial-handle=1956,i,16733054995066564919,11667389547059246059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1896

C:\Users\Admin\Downloads\TheChoicerVoicer_0-5-1 stable compatibility.exe
"C:\Users\Admin\Downloads\TheChoicerVoicer_0-5-1 stable compatibility.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 eb41ef2fcbb0770b1c0ab4ff48072d556a0f318d02f37e4228c46e1b6dc6879b
MD5 0f831c552e9f7003c6b4fd81db0b7c73
SHA1 1abb00de72d9b22844cbbb1c581660e5f2c0d265
SHA512 5ae8fd2d54a449be5631df7572da1bd5e5d1bbd6c7bb6daddc8d044beda15ceff8d82ba16ca96d11d2f0352a293900103a157ecdeea69f6942645b5b59df201e
TLSH
T168E02BB5D951EC2B1DFD0B5850244645D70403073A42499B3A3E91088FF1A3B959585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 cf3e2617e06bfad72ede2fab239b81ca7e824a67d2aeda494c51313afa179c40
MD5 513944d48dcf00767f054875e53c63c3
SHA1 fbfd2b6afa1f2863f9912479d253a53e531c4c5f
SHA512 e12b729f7802326e3050036da7ce821ead4d7db19d8f3ddc63b1e1aa8ad907548ed260a5bdb4aa7ac5e2d65c7ae2d47ef5a6a2cb2b90a403c099e125bb0c6bc4
TLSH
T11DC08C2088E02242CF43C2BD65E358A8202139212C11B71282F29FC898232EA21A906D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6ec3d32dacfdaa95038e624ba39a089acb06f869576fcd9511281b86e8e1e743
MD5 6ad3258a1a2268d3867fa1b627052447
SHA1 f96c367839c317b57d2cbd365d63fd1fc37d3011
SHA512 736fb3060f2770f8defce8d7f4e7107305f04e18f8e20461a81d45c1df15e5fdc2efbc83cd2e1906497859ff77815dedb10cc5dba7c2ba66c2381f0a2cfa136e
SSDEEP 96:DCaCaVreaIaEdo3oCkCvCfyVjcVGPzVQJVkBCaCkCK:D1PVreaIaEdo3o54TVjcVGPzViVkB9Lx
TLSH
T1319191F7C3E4867D891161F5AB152F2FCD6A0918021C3C66C9D5AF4B97E24B1E21074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 eee7e7e1337ba52f8a88eaa14b7b534c5f8e2c98f1e9153c0e116cdae8040ac7
MD5 9117a930b5f34b21cc6166d22fa2e5bc
SHA1 85db1220d8e01b7b45bfe0568cdcaee4213bb043
SHA512 e6148f635c8588b8dd089b275a1f4a651ab32a784163b4d19889b61496a0aee73c990f9033952f94fa008b95d397541b492c6576b3bec5579dfa2a943b7c0a30
TLSH
T1C6017BA3E779702B127955EF1D08B90A5975A83201C16CF4DF67C27DA0845E32F02553
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 753ed760593b7141da2070beb4fa7d01e7a269ff315603c981fe39ad94e974a2
MD5 2ac522d12da7436321237edbef42b579
SHA1 91ed9cec5bd24c91e97a4470d9f3a322476a8283
SHA512 ac382ab72d167c1b526b901d2acc4c5398bd9b00c77de4967efcb9d9baf326f3d19abd9d855d1cf1402e3c7b51af9a93c58dc6eaeb30160676ad8b9106b6b934
SSDEEP 192:qRA7rh3wYtcztv7lpAPRp2Gzt/9+Hsb+WNn4HEIv2Bw2Kk8kwYVyIsnAUge:qRA7mpRUXP0wgP2u2Krce
TLSH
T17F42D77EAE11797B5CCBC229FA257B13D7F9102525811E88FAFC892C19E79CC212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 452dbbe7adffe0ccb8376fd9b47c9632bcee30fd219f68c0a2ea172ff213339c
MD5 ba77746bfd61038dc644dcd1b95bfbbd
SHA1 db56edbfb924545d47aaf517fe900639ac7a9c4f
SHA512 178537acd4bb6e85e16fc9e7a02a77938266328187df68037a522877f2b9e91c89adb3438235a79cb0c5406b245b0d73e45adaacf39d99ea70991c7680c8e0c6
SSDEEP 192:qRAfrh3wYtnztv7lTAPRp2Gzz9k9+Hsb+WNlpkB4HECZWTw2Kk8kwYVyIsnAUge:qRAfVpR+XI0wXHW82Krce
TLSH
T19252C6AEAE20397B5CDBC229FA257B17D3F9101564C11D88FAFC892C15E79CC211B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e5a88e14bf7625a37017c1fbaffbc1c345a6d952e2ce458a519606039f53de8b
MD5 2245c6b91847b58f053afad8223af2ba
SHA1 2de7abbe0e962b1221d298b3be2881e1a47c4270
SHA512 60359144db756250d725150a09da65ca96d5de8a860af28a777bc6ffdd7b8abd0973d9311771e5bcef1b7af609fc4bcc8b30988abe119d6c9ae30d2315e1576d
TLSH
T1EAB0125080017251C05302F8218214C87118AF14D60E2B0163F06963CC351608014094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594d8a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594d8a.TMP
Size 96B
SHA256 593c0d0cebe981a7e4ab85e2c4932d41171e9a70cd045320dd682a5a56b5a2d0
MD5 9f6342d1b94161fcd22a678b86896f41
SHA1 7b8ee7b7f26541a99f445152183e7f877adfeeb2
SHA512 b80018b40f853bced8394763401a8e9818d4df1997e05dcc4b105f77acecd0ac852621636f89d6beed90a4240fa8701d280020db55c6ddeb4446478c9abd7fbd
TLSH
T1FCB02208C0022322C00203B22CC080C83020EF20C3232222C2F00A23CC30B200823320
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 2ba539bf8e0b4054aa8d0406bbe125e0c97b10ab77aa197da331bf5410d92873
MD5 2fabdd8281827cd649b1296e83bee32c
SHA1 c26d8b8b7e0eacfbf164055cd349f31fab4e48f7
SHA512 c3d4cc4ac86071111e4eb5b42b9c19d1a2104ca5abc4f04841a0b5e9b68a7ff6069de2252b5f354946f054fe788215c8ffe6878a2dff1f322775e9156a129de2
SSDEEP 3:MsEllllkEthXllkl2zEklq9ht:/M/xT02znq9ht
TLSH
T1C34404047FC00507C55010704011D3500370F4700551774334511F13FCD55405C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5ce05e8004566e6f772527e7ba1a376660897f6444e0596216c115f0d08cf2a8
MD5 a9567949dff2e762a598c83cc7dfc299
SHA1 62b41d916936e618d7a4c4b87ddc2e61ec058e10
SHA512 801361252d4a3763bf3d2887de2101a065830c4b326ed8d4d43808ec5c018894f2a540b2ba72ebc7e5c84cba46452f203da24574130e2661c1ebf4eb20ba7558
SSDEEP 3072:VGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:8m7Rkm1tYpBeh2BAoa
TLSH
T168C312375E71E93759B9B75EB08E0B1F1EF149A7C920DE92C8D85B0427EA6CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9be054f9ab8e7e63c49558fe7bc98891211996ac8d73a1e7e6b76abfc3170409
MD5 eb3f5170f3bff2090aa56a176c37930f
SHA1 9ed96bfd2167cc3410a08944fa4739e4b6fb1989
SHA512 e4a6fa57183b62bd1301f18186839e296148792b3e2a5cdaa46464cf736eb7ce210a392045f3328700b46619e2c9b6850db28e1ad072dd3a4f2b27e983b9e0b2
SSDEEP 3072:qGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:tm7Rkm1tYpBeh2BAoa
TLSH
T1F7C312375E71A97759B9BB4EB08E0B1E1EF149A2D920DE42C8D85B0437F97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 21a498f203c9bff59013cba59c23b0d5b8558dbeb257ef424d394836f36f0de0
MD5 cc4043a76990110659d4ce045f0ab048
SHA1 16f0260a88b336a8f15cd8d0c2c9ce5832fe8d1e
SHA512 91f113bd445732e6136f17c032224c4f4b5a3480d2289b8b886f064c546a8a5836ff6747d1bf0d4f2aeba61a0e657b9001aaa3fd6e39f8412b9aed1b62d445ed
SSDEEP 3072:QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:bm7Rkm1tYpBeh2BAoa
TLSH
T134C312375E71E93759B9B75EB08E0B1F1EF149B7C920DE92C8D85B0427EA6CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3844973ed1fc5b9436d675af4bf8cb4299c69e2d4cf992e6ecd1b38388221d69
MD5 13a4e43cdb66f698f8c0fe7dce1b134b
SHA1 a913e3b3c0ca94781e2c8e420b0088707980d0fa
SHA512 98632b248f71058218242247f905cf0ac443dd5e10d3c4d513e7a521880f075596de2273de594b496c715c95db80701015b8303380050b7fbd459a267a8e5bab
SSDEEP 3072:5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:4m7Rkm1tYpBeh2BAoa
TLSH
T1D3C312375E70E93759B9B75EB08E0B1F1EF149B7C920DE92C8D85B0423EA6CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8d6d778a1870e0a78c0f7a3ec476f0d26ab9aa984c1c21d3d25883c345b081a9
MD5 5570aab4dd853ff5622aceb4629aaaf2
SHA1 7a865cafaaa5d5203779c53c6450af9ceee21f8a
SHA512 bbee531dcbf468740c0c8d7871d5a67e89822364b1cfdc323d1aafa7566d02d5ed262a49c5ad012bfb330e7af48ffc0cb7a2944241cca2366818d95e0b105ed2
SSDEEP 3072:UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Xm7Rkm1tYpBeh2BAoa
TLSH
T1F2C312375E71E93759B9B75EB08E0B1F1EF149B7C920DE92C8D85B0427EA6CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TheChoicerVoicer_0-5-1 stable compatibility.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\TheChoicerVoicer_0-5-1 stable compatibility.exe:Zone.Identifier
Size 353B
SHA256 cbaade14dc7ad800fd33374115c7a142f3eeb4230dd511a40dbabf2bf99ff11f
MD5 e8d35f482a259c1dbe110e0c30b0584c
SHA1 094272656ff5db450b32adde6deff1a9d18f5083
SHA512 624eaf2406e57adfecb57f27feb34d1b1cdfcc4f3fe928dfae95e716be6d8c9293b242b98e9325ed62be8f97b8e24d85221c788be0b313ffc321ba4211273e79
TLSH
T1F9E0C0DF815CC510030450CB819BBC2DF10735390B180582B9A4BC62DC63334A4A0F3A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2120-304-0x00007FF69B4A0000-0x00007FF6A12F8000-memory.dmp

Download

memory/2120-305-0x00007FF69B4A0000-0x00007FF6A12F8000-memory.dmp

Download

memory/2120-306-0x00007FF69B4A0000-0x00007FF6A12F8000-memory.dmp

Download

memory/2120-308-0x00007FF69B4A0000-0x00007FF6A12F8000-memory.dmp

Download