e7ab1578e1b8c23bd263e366760a197a9f380be8bf07cde36cb163eef8bff331

Resubmissions

31/08/2026, 03:50

260831-eecy7awzbw4

31/08/2026, 03:44

260831-eaks8scr5x8

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
🔴 Void Tools V2.exe
Size 3.1MB
Sample260831-eecy7awzbw
SHA256 e7ab1578e1b8c23bd263e366760a197a9f380be8bf07cde36cb163eef8bff331
MD5 8db4320774f663e6db3f534c950fdf08
SHA1 f0674525c2305cf31f31fa0856c1036e26a5476d
SHA512 face17bec25a922c7a5c8bbebed40248147858b27fdce240b81856d84ff6f49cbf60165dbded0f74e7726bd103c8bd47c2b936eda29e693864e795af635c8925
SSDEEP 49152:ZQ2+tq1exZXjs9g275a8Fm8jPl7/oqhpCVjiVSXj:FwY9g6RjCVjY
TLSH
T15AE57B5AE7A841A8C0D3C0BD891A5403FA7338461375EAEB92F085566F277E06F7E770
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

ioc	Process
\??\VBoxMiniRdrDN	🔴 Void Tools V2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
8	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	🔴 Void Tools V2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	🔴 Void Tools V2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	🔴 Void Tools V2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326218776552798"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5480	chrome.exe
5480	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	3756	🔴 Void Tools V2.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe
Token: SeCreatePagefilePrivilege	5032	chrome.exe
Token: SeShutdownPrivilege	5032	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe
5032	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 5572	5032	chrome.exe	94
PID 5032 wrote to memory of 8	5032	chrome.exe	95
PID 5032 wrote to memory of 2972	5032	chrome.exe	96
PID 5032 wrote to memory of 2972	5032	chrome.exe	96
PID 5032 wrote to memory of 1088	5032	chrome.exe	97
PID 5032 wrote to memory of 1088	5032	chrome.exe	97
PID 5032 wrote to memory of 2476	5032	chrome.exe	99
PID 5032 wrote to memory of 1440	5032	chrome.exe	98
PID 5032 wrote to memory of 2476	5032	chrome.exe	99
PID 5032 wrote to memory of 1440	5032	chrome.exe	98
PID 5032 wrote to memory of 2088	5032	chrome.exe	101
PID 5032 wrote to memory of 2088	5032	chrome.exe	101
PID 5032 wrote to memory of 5148	5032	chrome.exe	104
PID 5032 wrote to memory of 5148	5032	chrome.exe	104
PID 5032 wrote to memory of 5212	5032	chrome.exe	105
PID 5032 wrote to memory of 5212	5032	chrome.exe	105
PID 5032 wrote to memory of 5316	5032	chrome.exe	106
PID 5032 wrote to memory of 5316	5032	chrome.exe	106
PID 5032 wrote to memory of 4036	5032	chrome.exe	110
PID 5032 wrote to memory of 5260	5032	chrome.exe	112
PID 5032 wrote to memory of 5260	5032	chrome.exe	112
PID 5032 wrote to memory of 2360	5032	chrome.exe	115
PID 5032 wrote to memory of 4580	5032	chrome.exe	116
PID 5032 wrote to memory of 3008	5032	chrome.exe	117
PID 5032 wrote to memory of 5480	5032	chrome.exe	120

C:\Users\Admin\AppData\Local\Temp\🔴 Void Tools V2.exe
"C:\Users\Admin\AppData\Local\Temp\🔴 Void Tools V2.exe"
1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffc163c728,0x7fffc163c734,0x7fffc163c740
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,88795918218556935,2068939197320593856,524288 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,1551785382657881950,2274561404795930963,262144 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,11805282854477413392,17461157862358587886,524288 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,8395876455349400801,8986182658045697007,2097152 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,15244545495977387401,10412786541403218426,2097152 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,4418807187270154274,5741377346520222049,2097152 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,5740006784151274429,11210861117720422038,2097152 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,1698277090103866490,5357359332635419503,524288 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5016,i,603148891990093919,15833325865720343281,524288 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,11377335331881996316,12326089527051466327,524288 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5748,i,13856695089483645615,11165729630671453242,2097152 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3372,i,1140787690413218792,14990097873416383080,524288 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3364,i,12612518255843673435,8606485376891372992,524288 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3348,i,14320492285722728727,14415624737268436288,524288 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3920 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4552,i,6008504341731487481,17589447526488723446,262144 --field-trial-handle=2184,i,4636223301435858703,7681014849415853041,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05de32c6-b8b9-495d-a973-49f37490bc82.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\05de32c6-b8b9-495d-a973-49f37490bc82.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fde317813a8bbd738da215cab5c9882adcc0409986b11975b32f57eeac8a37a3
MD5 4b4e15ef63240db1444c973bde66e579
SHA1 dba5af98b3db542d7aaf72f2cc9f377d49df3ac4
SHA512 2e19a72c4311aa1f0dce896e22ba6379fc8b01e86a17341ddbebc77916efb0edb449ab4ac4d9dbd1f3d6325fecfaec99c1d589b52272ccfd25a87f7ed8e440e0
TLSH
T1D8E02BAEC962EC7708FD175C94500B45E65457473680848F3A3C89194F7463A475A85C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 343KB
SHA256 07afd00bc6b13e35f702104aebea04e61d7f90b8447559279895e5f72cabd471
MD5 f39ab38ee79b1eb354356116d49017c4
SHA1 b97e8c1d90d46d372791af31561daa69e132d7c0
SHA512 01217bff1fb5b28e6d1e5e02473ea3154c97f36f87b8973da56e8ca84b636e0de2c318cedffaedf0c76ee90d3eb2e26e6689d5a973538b6f0f91bda10c7a5253
SSDEEP 6144:nQbTrYgHjNyXvc/D0GyVq9bk72B3QM/lUs7Jv2zjWriqGfkMzZh1RqXOzKY:nmTsgHHLlq72iM/mPzjWrykMzZhXqXSV
TLSH
T1177423D43C829CDEB5717D27911A93A6C213B4052D40E39377DB808A7E8B5E852FF86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 13f48156d8df6941ccc5922fa0943a506e0fb11ebb8d93c60b8b4d4fc14ea03b
MD5 b0946d44b389195946a852f43436ba44
SHA1 aecd4eea7a0d745e5986e1a733aafee70e3ea1ab
SHA512 9b7e0ddf4c4a0c6b80fe8fce2496645a92696c22680fe4067977a3abd12735be48aaf213b2530e47bc785e8989aefcde3e6bda921d39cdea7501406df64e2905
TLSH
T1DCC0926A22482126C329857158D21E88623D0E2401570D8AC1D44CBF8CA2A61A656566
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 231dbece85bbe5a86741173f8cfd1309f2fdab204357820c086af7755a0e5748
MD5 99070b2f66e956f4cf5d44cf60e0f5c7
SHA1 aad3b92979ac0b8aec9c90156a05e392fa07ab46
SHA512 511115aa594f80dc0f8ebfb34646aa54a4593dda994511e84ef370e3e2bd74b405946257d375f829211f170ccc9bfa0fc508b1aacd39c007f7fee224e50e2a5e
TLSH
T15B718EF7C3D8C66D8511A6F49B156E2FCE390A24432C3C66C8D5AE5B93E2472D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5d2d651aa1a9a5994544bc95b2429e5ca669e53da21dea2fcf05159ecc03b372
MD5 f68e856c2b96668be9f19b1b7f8e0267
SHA1 d9831afb63732aec0c73a1e8324e3536f57fa93d
SHA512 4e4e1871d94e67fa3b2449ce7acc68cfbd4cafb28c68c80d12c24512ee570e1cd9a83fc945241392f93c293b3e3c39ac32f7dd3d451d8d51adf76c8a38d1a9c7
SSDEEP 384:7bRHWKXSNAFO3MCBhUXjQwEr2bEW2geT58:7FWKXSNAFO3MohMQwfbEW2g2e
TLSH
T1B452C42FBD10697BADD7D22AF9617B53C7F1002520E11D84EAFC886C15D76CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e03804d06b36f782bfe8f31188b8c21b3438b22070337a9b1d7bfdffcc38cde1
MD5 6712d063937211d7096b8be1f3b436ad
SHA1 8c0255d9032a0f4f9c076e8b8bf3ee86f02910f9
SHA512 05a1be7b5367aacd82011b2018d840eb33c2c7017c00e1b4ae7448f6793564c2d8c4bdbffce420a0bc5c49acd201ff7111d73de6d5f50629a3cb4b010ea36b99
SSDEEP 384:7bRHWKXSNAFO5CBhUXjQwEr2REW2geS5e:7FWKXSNAFO5ohMQwfREW2gTE
TLSH
T15952E52FBD10697BADD7D22AF9617B53D7F1102520E11D84EAFC892C15E76CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5e7cc551024d2171b343c9c80a63d171c2d2c84c77b5e12c10cc17369135d1c3
MD5 afdbb79cd60a5095b675de2220c9308e
SHA1 ccad978548edf7c89520dd0af3ec0cb6432216c4
SHA512 2de4f65d8a882215c3e583dc68964df3e8ffb8c18eb1945fd09bd6257f7d30be5c3f44c5fbf96cb3fc64e3b21708c31d6c4398552ef3eff47979a259b7c8f5d3
TLSH
T1B3B01200C0015111C04202B4154658AC71145F18B60B170543F0A923CC25571902C250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d2db.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d2db.TMP
Size 96B
SHA256 83692a81e229c0d608103beca8518e743a705ab778476adde04e63131e62eda3
MD5 666accee849acb49b2dcf7442b734db6
SHA1 01dc9869c88baa9c5e974d3135a57876d9dd4bf0
SHA512 c1e6924b6b78686b425f67990c3cba263665f8d9baa38f06cceccf98189f92509307c20f1d44d8e200e9cc69182a39891bfa15c396f2933c6739c6991006b07e
TLSH
T15AB00255C1036353C04643F039A5AEE8B1B0EF2AC603265292E11A7BEC2D6714529570
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 734799285c95a2badb4bffb8cee2f74a76682f8f6b79e34e81040320359c41ab
MD5 255a56f290402b4c38dc4d744141e06a
SHA1 3b50f01fead85e11d4d415af8a3d58ee0b189511
SHA512 2076c9c3c674af3bec2ebce4b5fa17aa602aac940aec00f0065a6b98ede0775221a57efdb52e282a59e434dba3fcdbfb4e306a12480cc8550ec6b2753623b31b
SSDEEP 3072:VtMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPgkGm7D5Lk17ox1tIpud63U8BehbCBi9i:20mAIpUNVS6Hm7Rkm1tYpBeh2BAoh
TLSH
T14134133B9CA35D3B26A67B96B4891B3D1CB245E3D814CA5888D46E083BDF78C2D07D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 840cfb1619f6e2971a8806e725a42a1d7d6b92850c24f648adeaac3afc4e2e9b
MD5 2649729e2430c36a49535429e775b2a3
SHA1 135e4e7ef0e5519fe65f5a8a49ae75574489ab6f
SHA512 7512b28f16ddd9100c485cfee8cf9f1e9a390bd081d5550d5161af31da4c8c9f521a2065dbe708dd2198b4e0db5e762394731c5a4e35d191a72a1b96dc7873be
SSDEEP 3072:qGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:tm7Rkm1tYpBeh2BAo3
TLSH
T11AC3122B5E71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 4e8ffd8a6dcc213bc3ff0f8f9f4cd0ec63ff11c4f4c8a027fa16dc3241cacdf5
MD5 9ecd399d07bcb6867c9aeb3613ff6e01
SHA1 688791b3ed26f93698b34849f05699754bed4044
SHA512 151b7d71c2fba0254985cf3a0e3f2f4eb1f386c88a3c61e6d2caaa2e64c76c7c85be718734ce9296347a88689a12a480c5ab81e36addc6e0922eec0a138b529d
SSDEEP 3072:ftMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPgkGm7D5Lk17ox1tIpud63U8BehbCBi9i:00mAIpUNVS6Hm7Rkm1tYpBeh2BAoh
TLSH
T14D34133B9CE35D3B269ABB96B4891F3D18B249E1C8148A54C8D46E493FDF78C2807D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 f2e3d9d5556413e367dffa14c19af22a6d0bc366ff30fab7e942c0cedc850784
MD5 aecf93b39ff0a76ea74314e0b669f3ea
SHA1 ead73502e3eb4ffec812181fb9edc9dbc51cd6c1
SHA512 4ffc44e883fc9a4c01e2aa9c2f84f89f5874e8691597da8ca9458ecf1bc89e3fe304e1bf1ee69e03b6d7b5cffed76b8f65d2f5855829c74d118c97ab6c1719a1
SSDEEP 3072:YtMrv0mr0gMqpU+6Cb+5CCV2xKpBJYxPgkGm7D5Lk17ox1tIpud63U8BehbCBi9i:Z0mAIpUNVS6Hm7Rkm1tYpBeh2BAoh
TLSH
T19334133B9CE35D3B269ABB96B4891F3D18B249E1C8148A54C8D46E493FDF78C2807D74
MD5 SHA1 SHA512 SSDEEP TLSH