aa1c8fef9c244076da34591ca63715a2c8f51d2582aa1a37c6cacdb94da50b72

Analysis

user interaction
yes
max time kernel
262s
max time network
255s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
discord_stealer_win10.py
Size 13KB
Sample260827-e2tkfsxwgy
SHA256 aa1c8fef9c244076da34591ca63715a2c8f51d2582aa1a37c6cacdb94da50b72
MD5 a2e0e64955e2d15f82eef6983ecd0e80
SHA1 20606b7761758fd30ea66913d55207badf1bf550
SHA512 69c09ada23ea1816937025d96eaaa232cac935a6c6805abf9dd7ed5b30e809fee9796eec839e99b391275ca9bb41abc1917e676f356cc67c4613a7cec05548e3
SSDEEP 192:z5n1Cw9ydB2+dssTWt/l3ejszHZwMgq8F92ENnkICbP37rSgEA47iAi:tngTWt/l3ejsmG
TLSH
T19952A862ECA81822E397EDD85C57C29227272C235A19353875FC43DC4F8573642D69FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3208	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3100	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322784582251273"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
5260	chrome.exe
5260	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1172	OpenWith.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 4004	4612	chrome.exe	82
PID 4612 wrote to memory of 5396	4612	chrome.exe	83
PID 4612 wrote to memory of 5396	4612	chrome.exe	83
PID 4612 wrote to memory of 3100	4612	chrome.exe	84
PID 4612 wrote to memory of 888	4612	chrome.exe	85
PID 4612 wrote to memory of 888	4612	chrome.exe	85
PID 4612 wrote to memory of 5352	4612	chrome.exe	87
PID 4612 wrote to memory of 2216	4612	chrome.exe	88
PID 4612 wrote to memory of 5352	4612	chrome.exe	87
PID 4612 wrote to memory of 2216	4612	chrome.exe	88
PID 4612 wrote to memory of 4472	4612	chrome.exe	89
PID 4612 wrote to memory of 4472	4612	chrome.exe	89
PID 4612 wrote to memory of 568	4612	chrome.exe	91
PID 4612 wrote to memory of 568	4612	chrome.exe	91
PID 4612 wrote to memory of 404	4612	chrome.exe	92
PID 4612 wrote to memory of 1084	4612	chrome.exe	94
PID 4612 wrote to memory of 1084	4612	chrome.exe	94
PID 4612 wrote to memory of 5896	4612	chrome.exe	95
PID 4612 wrote to memory of 5896	4612	chrome.exe	95
PID 4612 wrote to memory of 4976	4612	chrome.exe	96
PID 4612 wrote to memory of 5052	4612	chrome.exe	97
PID 4612 wrote to memory of 808	4612	chrome.exe	98
PID 4612 wrote to memory of 5260	4612	chrome.exe	99
PID 4612 wrote to memory of 4820	4612	chrome.exe	100
PID 4612 wrote to memory of 4820	4612	chrome.exe	100

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord_stealer_win10.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0dc5c728,0x7ffa0dc5c734,0x7ffa0dc5c740
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,3196899578341928996,3400442137318865100,262144 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,5084456705448444286,14181738143639502347,524288 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,12891855817409413928,8384974076937187452,524288 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,5305672721529002319,6342835388789254263,2097152 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,9003799346867654160,16045442163052669245,2097152 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,136416956697238531,6130919014284316163,2097152 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:9
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,6364312176659540320,2546526780112858878,2097152 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,7984982808551423204,437999748743695193,524288 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5864,i,11678518520491626489,9476452754399720302,2097152 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4872,i,18417537276825168761,14408229523761617212,2097152 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,15950802442248229279,7914669588765897168,524288 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3648 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,193693748988553020,12631747227281937770,524288 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3704 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3660,i,4311811464748725789,2024446078741899258,524288 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3520 /prefetch:14
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3548,i,1106224224184136334,82078433829389558,262144 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3604 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4700,i,740098308474672978,5426797110438463324,524288 --field-trial-handle=1880,i,12978202860586729855,3147232709208687577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3548 /prefetch:14
  2⤵
  PID:4820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

285abae9-158a-4135-9c49-a7104905e36d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\285abae9-158a-4135-9c49-a7104905e36d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3d9ca384bac0305d8a98d5f8e63b1a6f8c27f9d0d4f91f79388102a158aeb240
MD5 35e04841d82f8011e8688cacb1e207dc
SHA1 34e8600b5eff57279ac1e262965b128afb3e80ca
SHA512 ffad464c6018b03d50a425bbae2c7117fcfa9b21babf003b4e5c1ba3edce117bcfdd7b4327f637964648a66f5b1dc05e397ac5254f3da0e9580a198ee1239ed1
TLSH
T11CE02BA6CC61EC270CFD2B2CA1590346E76403172B809D1F3B3C810C8FB1B3E814581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 c1196de73faedc4b97379da13d4422ae193ab8d8090b9f1fb0bc8b339774f23b
MD5 cdeb17360f2c65bcf00245feefc14380
SHA1 d1d041fdaefbc8e75b7ff7bd431926c709dde6d1
SHA512 896ecd77e16dc0752aa5365e2dc0cbb5de1a26afbe33610d81d696c1597905f6e710b5605e74abea2f2fb0250b8b7e27a74d8bb70d4cc0d8622a8141f8b29abe
TLSH
T108C09201C688032DC7500DFA88B106BA7630262C406B9E23959C9074D8287B7228D561
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9770cb085ef852fcca940d50d21ddeef403c343c8c1790862871f8e1d0b489ec
MD5 2c0b086175b58ce3ffa946144fc8bb3c
SHA1 9e17994bfd2441cdbb5441851df92b92fbea471a
SHA512 824ed5be7556991637cbc0baed8eac61f272d373d2cf6c04c1fc39ad89d22cd16f277a63e69868a3a13a416ce54a2e4e40877b9b79a1e42747525368c3cbf6ec
TLSH
T1FD719DF7C7E4856D891196F4AB246E1FCD2D0928422C3D66C8D8EF5F93E2472D24168E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 acecb37c9d4c9d12199643a9191e98acf6c0ad24865abdca4f8edba02e07129e
MD5 d933ca63c89beb8f46ad66001a727da0
SHA1 7142898ba37096528a3167fb0005c6f155a1c4e2
SHA512 37f84fa4bd601fb1ad4122509d98285571e270a8c3fa55e99b2ab7a1af546ddd5fbd956ae6b0f8c463ac8974e753bfd90d77af1a5f2872483b9a4094bf86d954
SSDEEP 192:eRtLvvJ+Ry4v7HpAPRp2y9DHsb+WNnYfUB0nxYgX2LfTepuP/mmUVyIsnAUgtaJ:eRtjlkjUXR5wYMB0nZ21+38
TLSH
T1E142C72EAE50793B5CDAC219FE653B97D7F5102221C42E84EAFC893C15E79DC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7a6bc28a1f3cb0524a84f1c7be5f0a21ec0a25373c2a9b433bbab8984272cce0
MD5 8cccb11162dba902f39523e3b3022881
SHA1 ff8ab898b14290c1cdec1306f5c8da44bbe48c19
SHA512 0d95e738ed84c698a259aad9211a1eaf9a439d935ee0a6cc69cb0d8a37fe82e375929f4159f0389ed4f0948abe9886aa3a67ed5a53eaec0b11d73365e4ab52b3
SSDEEP 192:eRtLvvJ+Rydyv7HpAPRp2xT9DHsb+WNnYfUBSvl2mYgX2LfTepuP/mmUVyIsnAU/:eRtjldejUXa5wYMB82021+38
TLSH
T16D42C62EB950793B5CDAD219FE657B97E7F5102221C02E84EAFC893C15E79DC221B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 926f8984837ffb410c70c90ce5801d5ec531bdd02aaba60ca3268ac58bf47ad2
MD5 1ed5905d0502eca53c2ad71b6d9a4e11
SHA1 c44404d1f5ba6d5d43fade96dcabbaf038690a43
SHA512 00a502192fa4cb23244e2d6e759c7e38502d29c9c431497a407df9b311bd0372f08b699c9c72d848b3e15b078785434c74a0c61f69735d04003cbf6119d29fd1
SSDEEP 192:eRtLvvJ+RyLyv7HpAPRp2xT9DHsb+WNnYfUBSIue6YgX2LfTepuP/mmwVyIsnAUp:eRtjlLejUXq5wYMBceY21+3e
TLSH
T1FE52C62EB950697B5CDAD219FE657B97E7F1102221C02E84EAFC893C15E79DC221B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 131e661b636f8f9f4de5ac6754f756b8114cc4190f83dc05dcad373c7ee231e8
MD5 a47278f662157667ea7893028fe1e0cc
SHA1 33906b5b00cd31976097ca313255f3a32ff6d9d8
SHA512 9bca316890837c50ce197fefa5b2295d76bc22f8800d41dfe7976295358c62ca1299bc9c388716a9e257939922db7cc0bc98a4b08e1a5edcf09f24fa831610fb
SSDEEP 192:eRtLvvJ+RyCv7HpAPRp2xZ9DHsb+WNnYfUBS9TYfYgX2LfTepuP/mmwVyIsnAUge:eRtjlOjUXk5wYMBgYj21+3e
TLSH
T1B652D72EB950797B5CDAD219FE657B97E7F1102221C02E84EAFC893C15E79DC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d3e17b472cccfa0abb14d5dac2bfeb27f8f9f0ce1f70de2a4396a75748d3e4d4
MD5 afe8752421b5fc624307cc96f54aee15
SHA1 6c5aea20dfc3c4df38ae5fca94082292601e83b4
SHA512 e19cc9f58c1d6f914e9f04a41b5b73a65fd84d9ff315b28a6f844feb4045e0d6ba1b4015d4c1d54711b97fdd118486ecf88fb669eb008049c9844c77b40bf99f
TLSH
T1C6B0125080015142C01203F4154A548871249F10AA0A1B0143E07A3AC8291608138061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590b41.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590b41.TMP
Size 96B
SHA256 ce16f2d7d02ba38d31ed2d3aab0936412085463000ba3f194924cbe449cec562
MD5 7e88cc0c9718de19380b5e2d43d00e57
SHA1 1a1caa541b1c20e312c73c3beb8fb12670aba004
SHA512 52e93ae09de064c38105b4fa29ee087a83fa76148734896ee2265be1c316dfe81c08fadfc84ae736a47de2755415e0e4a9964e34dbc6fcc7d95a8c1b9ca20d24
TLSH
T1FAB00256C1027216C38353B02E95D5E87160DF65C617365693F41F7BDCBA6604636660
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 e0d4874d2456240e9e3717b008ab4c8e9abfcf015c1258285bde11b714a2d512
MD5 72321e4e5f0558d5ab8c63eeadb03fba
SHA1 f61cce78b817a246e8b0b5d536a385d153e48e72
SHA512 de5e8cca29714855f2c5d2fc1095d6350b0b01468bb1e47f1e09e11635171609f76a36c414892513066f18d5f19ee8f40bd6a40c21b0c6a9efa0144b1bd26641
SSDEEP 6144:dDYIlZtkAVlYJ6X7ivkB7m7Rkm1tYpBeh2BAoN:dYIPGJ6X7BBa9oBGcAoN
TLSH
T1B73412336C78B8F655BAB25E244E1F1D2EF04CABCC149B969584BF4413E6BCC160B6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 b67d491e8dc89b400d84045d3146d98dfc988fe3f2182292312e38d42371eca0
MD5 3033da1d7879b33eff07d453cdd99f4b
SHA1 c337e49c73bff6fcff2f75815a7560ca0f5f70f9
SHA512 fd70999dace5a06778d04200f66b68b807b7dd202cf1323e322fb4e46402d03ab46c4be5a05eca98b382eed9a18efd436b1a1b08739a677cb664b037a1fe4fef
SSDEEP 6144:VDYIlZtkAVlYJ6X7ivkB7m7Rkm1tYpBeh2BAoN:lYIPGJ6X7BBa9oBGcAoN
TLSH
T1183412336C78B8F655BAB25E244E1F1D2EF04CABCC149B969584BF4413E6BCC160B6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 dbbbceae30bf1473c491ea5de10e0cf15e21e14d3b0049dc9a4a42edadcb6c0c
MD5 48d7851ec9de6b027c66661ff74053da
SHA1 51044a9512f9d7f1818aa89245fd94d18ff9655b
SHA512 5acd03069badadbdcb1b3d3ecf78a78a37a798b1122243472ecec9d72e1e2553eecb8ad226add1bdfd4b2f9b29adf3f842f644bf2cea86c00d1b466347f17630
SSDEEP 6144:TYIlZtkAVlYJ6X7ivkB7m7Rkm1tYpBeh2BAoN:TYIPGJ6X7BBa9oBGcAoN
TLSH
T1C73413136D78B8B294AAF21E254F1B2D2AF04CA7CC248B939584AF4453E6BCC174F674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 eb38fb413ae7ee5bc7db8b4267940b491ff2f7caff0b848a2f7117cab39ef2d2
MD5 5aeee00f837a6276b0ed4f0b2650c2c7
SHA1 1112dacf3d01e862a4c3a4656f22930c34129734
SHA512 7b92867a6e4f990c3910132bd3ee097b207e8f061b82bb5a3ad1967dd0f06f3a454cb9fa1b9b41ba9614e620de077b0e731ed5d39edabd18bf58dc1ed7a23933
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Vm7Rkm1tYpBeh2BAo+
TLSH
T1DDC3122B5D71A97658B9B74EB08E0B1F1EF14DA6C930DE82C8D85B0477FA7CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 00fe61f13cbb2512a0e4d63f711b1af6fc96d9cfefc9715ff0c569df62c00322
MD5 82375063d849faf24e1f9778523cc3ca
SHA1 ac8c620a03e61261b904df49e6061f1ae6dd8623
SHA512 77b41cc848ff28a4cbe991c26e31f77fc60e6c53000aedbbd6b79f2fa570f192169b69546e8e6b9a25fa9c0c3eafee98c2fbccd7ca3b1674dbdb0c69fe6b40ea
SSDEEP 6144:mYIlZtkAVlYJ6X7ivkB7m7Rkm1tYpBeh2BAoN:mYIPGJ6X7BBa9oBGcAoN
TLSH
T19F3413136D78B8B294AEF21E254F1B2D2AF04CA7CC248B939584AF4453E6BCC174F674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download