1af6aaf2b4d9d255f503c70c1c7c69d220cfd0980ae6c8dcae70350dbefabe8e

Resubmissions

20/04/2026, 17:14

260420-vrzlqacz3s3

20/04/2026, 17:13

260420-vrexbacz2t4

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LoaderPro.exe
Size 26.3MB
Sample260420-vrexbacz2t
SHA256 1af6aaf2b4d9d255f503c70c1c7c69d220cfd0980ae6c8dcae70350dbefabe8e
MD5 fdb51dc1d8dc4adff22c870e8e578957
SHA1 056364675370eeb5f8a7777cc71ea1e55020ff6c
SHA512 2f460ded47e614f34abaa44f05e1836cf1afda732a13a991323167aae5efd92984445cab6022fced078663448b128ac2931380cafed64051923a48f2cc8c8f9b
SSDEEP 393216:17nZNrDYrAAGokGpKVNBxIj1RYnmRQMXwSAeVUr76aypSVy2:VnZ1EL5IxIjwnsX/Ae6Bypd
TLSH
T1D257129A38E1A1ECCB52C530E78959F9E2D9B4894DBA813F7FCA09027131C56CDE1D36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2740	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 3156	3184	chrome.exe	80
PID 3184 wrote to memory of 4832	3184	chrome.exe	81
PID 3184 wrote to memory of 4832	3184	chrome.exe	81
PID 3184 wrote to memory of 2740	3184	chrome.exe	82
PID 3184 wrote to memory of 1580	3184	chrome.exe	83
PID 3184 wrote to memory of 1580	3184	chrome.exe	83
PID 3184 wrote to memory of 564	3184	chrome.exe	85
PID 3184 wrote to memory of 564	3184	chrome.exe	85
PID 3184 wrote to memory of 612	3184	chrome.exe	86
PID 3184 wrote to memory of 612	3184	chrome.exe	86
PID 3184 wrote to memory of 3704	3184	chrome.exe	87
PID 3184 wrote to memory of 3704	3184	chrome.exe	87
PID 3184 wrote to memory of 5876	3184	chrome.exe	89
PID 3184 wrote to memory of 5876	3184	chrome.exe	89

C:\Users\Admin\AppData\Local\Temp\LoaderPro.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderPro.exe"
1⤵
PID:1104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffac04dc728,0x7ffac04dc734,0x7ffac04dc740
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,17226528474356363468,6212982513734641144,262144 --field-trial-handle=1928,i,1015510500470663328,14080352834689508274,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,18079561875370505937,11652863621888723900,524288 --field-trial-handle=1928,i,1015510500470663328,14080352834689508274,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,2250982806680104169,17556232081085077084,524288 --field-trial-handle=1928,i,1015510500470663328,14080352834689508274,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,18180403655109130480,12411984077690679219,2097152 --field-trial-handle=1928,i,1015510500470663328,14080352834689508274,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,10817786862197431284,12692825363090259655,2097152 --field-trial-handle=1928,i,1015510500470663328,14080352834689508274,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4188,i,164143823207055669,11810968002109246559,2097152 --field-trial-handle=1928,i,1015510500470663328,14080352834689508274,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4200 /prefetch:9
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4356,i,11043885614160699063,3904419213970231799,2097152 --field-trial-handle=1928,i,1015510500470663328,14080352834689508274,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 715cba5c30935dd1adf3d3815de386d06909165adc1402f84e3370a1c57ddb83
MD5 e20bd62fbf69a46ee2c7182af9ddd274
SHA1 54563f28df2a5faa04e86fcaccad41c3e6960919
SHA512 95baecbc1249bd1938df1c1ba1d42744e0b2b69257a9032f904fe1e81efffd68a07fc4e774252baf18c47d7f4eb93b6d30da63053d9a982794898ed4c27d34b1
TLSH
T190518DF393E4897D891192F4DA246E2FCE6D0929131C7C6689D4AE0B43F2973D20179E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 85455a6cbdc25b70230e3fb3a908afc615eb0a4fad1648d41d6c24579906cee3
MD5 f7ed014cf392eb117d8b4af2ad31840b
SHA1 d9bb866d228310c60fb5bc2ab60a4479da4fc33d
SHA512 b9cd6df063255ec442e324870e4edbe5029779a1bae9e9106734e35c3a40a46b55cf7e56eb5f01c1e1b096e2664e830b707fbc7d013182cf2d7193f7e8d87756
TLSH
T147F050E7937EB46720BD45A61E00BC0A35B5D834029054F0CF56425DD0D14F31F11853
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e29083ad33ca6f84f45b12f2f1754e6dafa1b08fbf608883d9a8bff77ca984ca
MD5 5345b2c1ca8476f36769f7e45f978b5f
SHA1 8b2065d967aec31619cd78f69f2104c507bf1f4f
SHA512 53878cb5ae58360e63b34354955cee3e5add42930a8d46a5fae02f3a4a4387ae321d848824629991eff4e18d451602e24e477ad49f7aea87a84eb14fda8b0dc0
SSDEEP 192:YRlXm0XHXrfuJJ+XYwPozv7+FpAPRp239hHsb+WNnNpzdV3HUEOjPyIsnAUge:YRlW0XbWGhoL6FUXQbw3ddIXe
TLSH
T1A342C71EF914693B5CDBD219FE617B57E7F5106120901E88E6FCCA2C15EBACE212701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6eedfc3796131bf14a18e30c60c054c531ce0178dd86c3a652994b5762417e86
MD5 5f28b2c537c27ba9d3dee57395244c61
SHA1 e628891ca10d3b6db08bfd6106258ebc579d7bd9
SHA512 2335ff23407350450d236693399416d974b1019e7b7062fbd24eacef5ff5320a5952f623433e22d271b141a7c238c0a0f127ec0cff91e31b649175d908b2393e
TLSH
T172B012108401DD00C46301F4164304C821049F318E04230157E469729C370A140141A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5850ea.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5850ea.TMP
Size 96B
SHA256 863a3a146ca4981249c9b1c4ea49b8a277e851c7936d2d038764c92a238c6a62
MD5 dc242213e74b08ec00010a09a711c25a
SHA1 bdbf5fb8e77169bda92b74b828f5c96b8c7446e0
SHA512 3fabda78927317b1b7d03a3512f5e043a5a4b93a00c2c5221b7545cb794ebb148d846055ed667786f6e13e144273f3a6770d37d8e500d0574f3af3d6616d183a
TLSH
T1CAB02202C002320AC00303F0AAC888C832A0EF20C20B220A82F00E3ACC2ABA02220230
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 15763d98bbd959a5fa2910efba35d47c401fe0746f774bf4517ecfc4de61c4dc
MD5 98fcb9b4b0750d1281b9ad6be907a75c
SHA1 5dd0eed100d74790ff83d4e5a46f4149df85176a
SHA512 273bf0a8daa3410c8b58f85d21db39744c92a5c50a9ea7efc3cc9cae235f7b561d1738ad71833ffe50aa5c407b6dd7b209004ca4cd4daaabf53db282bc3b838f
SSDEEP 1536:eG9qVP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:wN++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1BD9312B9991E7D35636AC6D6A0079DAC8CD3DCCE1514117C30C7AF1E14BE393931B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 46c9281fe6d14aa07a33a9afe5663f22eed400a7504a88e81c40516b95118873
MD5 43aa6abea9c133dd184fb49ba1aac60f
SHA1 e0d3b4126b05d6ffda6abd3ca9a9840e9714e82f
SHA512 fc9650480efef4f46f50576b64c8b240c52bd1f93c5defdfd1c4a2bdd552259be8dafad6f1a7a68eed39b4e8e8b5df22a73396e34bf9301e0c36a91bf26f75cb
SSDEEP 1536:eG0vP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNF:wX++J3qUQm08KMWF0bFTcVHr6za
TLSH
T1709312B9992E7D3563ABC6E6A0079DAD8CE3DCCE1514117C31C39F1E14AE393930B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1896-13-0x000001F3EEB10000-0x000001F3EEB6D000-memory.dmp

Download