hxxps://cdn[.]discordapp[.]com/attachments/1533213252870344754/1533213287515160777/PrefabLoader[.]dll?ex=6a70fd25&is=6a6faba5&hm=0d7bc2db10a86a58ed0e5ce23a12f13ac21b547c90ccf642935a2fc1bf418696&

Analysis

user interaction
yes
max time kernel
900s
max time network
897s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1533213252870344754/1533213287515160777/PrefabLoader.dll?ex=6a70fd25&is=6a6faba5&hm=0d7bc2db10a86a58ed0e5ce23a12f13ac21b547c90ccf642935a2fc1bf418696&
Sample260803-a232nsaa56

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	632	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
63	raw.githubusercontent.com
1	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnSpy.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
632	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301914153696406"	chrome.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	dnSpy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "2"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	dnSpy.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\dnSpy-net-win32.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\PrefabLoader.dll:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
5000	chrome.exe
5000	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4416	dnSpy.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4416	dnSpy.exe
4416	dnSpy.exe
4416	dnSpy.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 5012	4520	chrome.exe	81
PID 4520 wrote to memory of 1068	4520	chrome.exe	82
PID 4520 wrote to memory of 1068	4520	chrome.exe	82
PID 4520 wrote to memory of 632	4520	chrome.exe	83
PID 4520 wrote to memory of 2096	4520	chrome.exe	84
PID 4520 wrote to memory of 2096	4520	chrome.exe	84
PID 4520 wrote to memory of 2400	4520	chrome.exe	85
PID 4520 wrote to memory of 2400	4520	chrome.exe	85
PID 4520 wrote to memory of 352	4520	chrome.exe	86
PID 4520 wrote to memory of 352	4520	chrome.exe	86
PID 4520 wrote to memory of 2436	4520	chrome.exe	87
PID 4520 wrote to memory of 2436	4520	chrome.exe	87
PID 4520 wrote to memory of 488	4520	chrome.exe	90
PID 4520 wrote to memory of 3972	4520	chrome.exe	92
PID 4520 wrote to memory of 4952	4520	chrome.exe	93
PID 4520 wrote to memory of 4952	4520	chrome.exe	93
PID 4520 wrote to memory of 2708	4520	chrome.exe	94
PID 4520 wrote to memory of 2708	4520	chrome.exe	94
PID 4520 wrote to memory of 4468	4520	chrome.exe	95
PID 4520 wrote to memory of 4468	4520	chrome.exe	95
PID 4520 wrote to memory of 668	4520	chrome.exe	96
PID 4520 wrote to memory of 668	4520	chrome.exe	96
PID 4520 wrote to memory of 3516	4520	chrome.exe	97
PID 4520 wrote to memory of 3760	4520	chrome.exe	98
PID 4520 wrote to memory of 4952	4520	chrome.exe	99
PID 4520 wrote to memory of 5028	4520	chrome.exe	100
PID 4520 wrote to memory of 5000	4520	chrome.exe	104
PID 4520 wrote to memory of 1680	4520	chrome.exe	105
PID 4520 wrote to memory of 1680	4520	chrome.exe	105

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1533213252870344754/1533213287515160777/PrefabLoader.dll?ex=6a70fd25&is=6a6faba5&hm=0d7bc2db10a86a58ed0e5ce23a12f13ac21b547c90ccf642935a2fc1bf418696&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf7ddc728,0x7ffdf7ddc734,0x7ffdf7ddc740
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,10135058632511530877,10254228352608364823,262144 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,2290222819703051314,16169453807326747084,524288 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,9562575184412481143,17105738401255606317,524288 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2740 /prefetch:13
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,2553665548366915217,5952850367463572754,2097152 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,10014153452444119248,11260372676740363109,2097152 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,14529484723741986241,7625145886641597341,2097152 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,3197708995329943959,18438607617616878951,524288 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,17076131973096265071,9199109216096970368,524288 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5884,i,12812044355351856676,14799632327422418444,2097152 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5784,i,15640924415761669015,7895546207996045038,2097152 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6040,i,2746868039378196042,13118851782200640007,2097152 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5368,i,2617230409894322002,6585568470719738612,2097152 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=744,i,4421444454741936733,17292227860475576671,524288 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=740,i,4375898707506326347,11743039166194756890,524288 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,6582626524057193669,5130557772510001945,524288 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,17763254426121774438,9649779909226793056,524288 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6348,i,7094385858951806322,11565417509531069492,262144 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1076 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,11235033122797106614,648349162174486480,524288 --field-trial-handle=1960,i,14991912331819344882,903280369882496796,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:14
  2⤵
  PID:1680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:536

C:\Users\Admin\Downloads\dnSpy-net-win32\dnSpy.exe
"C:\Users\Admin\Downloads\dnSpy-net-win32\dnSpy.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2f972fc4-9602-49d3-a0c4-e1ac4568571b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2f972fc4-9602-49d3-a0c4-e1ac4568571b.tmp
Size 12KB
SHA256 b08eb8d1c9369d6a06fe3fd5c331068587b6e0f50387b21a05799f7d698fa8e6
MD5 fcbeb2c79a4189ae78f934d5ef03ea29
SHA1 338d6483820e1841e6b5b1f472c28ede55b29c98
SHA512 17a58f15d4c05fa9b5633176a7c4d94ba7c0602f0eab21b2d6f3189e80973125b1422d2801ab3a8a8a269df7ecb918a6a0ae38e059e90131ef584270ad53977c
SSDEEP 192:pRFp/7IY4XGv75pAPRp2A98Hsb+WNnnVPvP2uD7MVyIsnAUge:pRFpsJyVUXLuwVP32uYe
TLSH
T13F42C52EBA10697B6CCBD329F9227763D7F6112135D42E84E6FC892C18E79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5dbd59a8ba7d2b61f710937b940993abba436a06f6a0bb06b18b6f77d33f6cf6
MD5 b14278fe44d7a44343c69c90962767c2
SHA1 15004679bb3702181cf7cb5e741b59a3a8c2529c
SHA512 3e9b5ed565f034178792ba4165503f9689e6dec95f56a47d224bf1b4c4386fe36db337727c6b9d8376e8c811e82cc1f328809b30299fcf107ccb2b1b6727ded3
TLSH
T19EE02BA9D962EC3B08FD27A9A1500747F75213272650C91F3A3C912A8FB253A458685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 caf27f2923f0e072466c6c7600d3be5272c6f263742bd5127a92925e0999cf36
MD5 cf677fd52d24fd8e10d31966005ab400
SHA1 0255aa9e39f959b110706181ab5e787a3f4fda30
SHA512 962437d97011f1b172322f69abd1b78a7e5f2cffec4f2e82a86275d77b28dcea5a852d9792ecf148931754ded0514c73842844c80a4298a7dcd528e36f4306f3
TLSH
T16281C303A07184A5EB5569F044D28819B9F80AF4457F5EC6EB132436FBD936E0FBD3A8
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 498acd89c6d8372fac200a9c9f4bf61a62efe51c93d2318ea02ad7303697baa4
MD5 bb9590524ccd87a661e43d2896d21b13
SHA1 d45d1c1320ce155c8e2c885cb6fddd9fe03a3715
SHA512 9e183953a235ffa2fd42ccf4163e6bd9d5a56fe15f83211a56c3f0e709c71c54312b92dc50f3823a3533e601dd48f42b702985ac4fb4cf348978fe5c8590e58e
SSDEEP 192:DYtrVmxmjw6EaIt1jEAyXRSIUZVIsNPiNmDmrmmmDmt0mnimBdDjhyK:DYtrVmxmjw6EaIt1jEAyXRSIUZVIsNqL
TLSH
T16AE17AF783E5862D8A0156F4EB15AF1FCE290624432C3C66C8D4AE1BD3E3972E25175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 02d455efe6b15b1b40fb5465d8709cecac430cd0d0ebdfec77ce0049974f9d86
MD5 cfc733aedccf730708d2de588cb9d2f0
SHA1 47e2856d3f38d441a55be8c2ef5634e2fa9f01c5
SHA512 fb8038ef02eed9eaa4ef0c00a1a2def61f5e51f228dcba110793e88bd28211f27785279680622b1dbbd09cbf7b6edf7c0318641b730fdaafb5e24627268bccf6
SSDEEP 192:DYtrVmxmjESAaIt1jEAyXRSIUZVIsNPiNmDmrmmmDmt0mnimgbDjhlVK:DYtrVmxmjESAaIt1jEAyXRSIUZVIsNq5
TLSH
T119E179F783E5852D8A0156F4EB15AF1FCE290624432C3C7688E4AE1BD3E3972E15175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 b69a81244e36013467b2857b081864f33a344039350a8bc56f318a531a18a761
MD5 c37bd9c99173b6637d369840c74faf4c
SHA1 22f2fb1859c56995f43c84966bf1e3030eceb945
SHA512 1e578ee6bb19d2a86be3d9850c7847c4a223b76ae2fc175409cbc251437669d8702dfe6e96953f0f26a24cddb8957e7dab7b1c7e2d19a5b2e50213da76b76726
SSDEEP 192:DQLPeqdmUmUPaIt1jEAyXRbaIwEVIsNPZNmDmCmemDmtJHmnimH:DQLeOmUmUPaIt1jEAyXROIwEVIsNRNmW
TLSH
T138E18AF7C3E8852D890156F4EB15AF1FCE290A24432C3C66C8E4EE5B93E2971E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 21ea24dcecd51a0df2eed7d1ea9944e34955f4a9bc4b086eec5ab11c4752d030
MD5 e8f131c69ba9ea54090024f0a560c7e3
SHA1 46215d67226668cf8bfc5b3adfe32cbf403c3b4e
SHA512 22113f06e000edce4a602aa7b0c732489e93bd82cd6a69717914ca9a4f38cce1539fe25af14721e8bc934f257501dca8076621ed65bb8b0260bc8e4474e09cee
SSDEEP 192:DQLPeqdmUmUr6EaIt1jEAyXRbaIwEVIsNPZNmDmCmemDmt0mnimuudDjhq:DQLeOmUmUr6EaIt1jEAyXROIwEVIsNRx
TLSH
T18D028CF7C3E9852D890156F4EB15AF1FCE290A24432C3C66C8D4EE5B93E2971E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 f98d4c1bd9cd933439795ea791300b464c4a4ce6b4e0e6e0a2f804bade82db58
MD5 a1e1396d1df11d241c22efd4eb99096e
SHA1 b1bb57193b8b1a4315d716766bd42be883cc3faf
SHA512 c156038be19a4f31dd63d79f3d0ba2ca7659c5c65718a24478c12cb87f8790c4de6411204fd2f04b6e5c80e88e01818d8da569a36999250e7a694f0ca8896aa1
TLSH
T1E4319ED78A7DB42B107D146F1D087C09A87AA83505927DF0DF96D13CE2895E71B2206A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c88d4db0cb583747fd6b6f55bacbdc45f24adb128222631984e9f0af42b832bd
MD5 a5475d1726b4a034ae9a719b607687af
SHA1 4a33b53bc864b05ab0f0baf57ce72cb54a8d7c41
SHA512 99f0cc26d38a0b64b0c2b1bd5aeccf26deef44101383e4271cb30957725b16de7b321f2170d599c2cd923f0cff83b4dbe26a63f084137f1552f77a6538e576d6
SSDEEP 192:RR5cBzpGF54ecv75pAPRp23j+Be98Hsb+WNSqLnLvU0+T/2zP2uD7iVyIsnAUgE:RR5mzp4vIVUXeuwTHLe2T2uSE
TLSH
T16B52C82AB9102ABBACC7D229F9227727D7F6106265D01E84E6FCC93C18E79DD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 45853fdee9efa5f749325ba8f3911aaa40bd07666adf532abc1d202b88c8509a
MD5 eebcf1acf61a2bde8158fac985c8d12e
SHA1 3eedde803de9d153d0b1b9cb6925235e01368bb5
SHA512 88a846ba4e170297953a41fb1dcff9563e1cf7c2dbe233364d6664af004275190f80c165e451105857d8cf238e424358c17dfa4bd4ad92c4542df307cbbb8243
SSDEEP 192:RR5cBzp/7IY4ecv75pAPRp23j+2e98Hsb+WNSqLnL4T/2gP2uD7MVyIsnAUge:RR5mzpsUIVUXTuwTHc262uYe
TLSH
T1A152C66ABA102A7B5CCBC329F9227767D7F6112265D41E84E6FC893C18E79DC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a4e70955800d5658bb9538cb21f562dd3b22917cd68ca912f4f8d6badaf615e9
MD5 f0986a14aee21022e25314438a42d61f
SHA1 c98a0a61495121bc9cbd50c22d7bfa41e4105766
SHA512 1c6bfe783b23ba3f020b3ec43f36434ba4d1fba5daa3126cb3a1ead0e3c3ad7ff0a770f1aaf48e55931b464cb3ea71aaa7f41c9bb881e6d867a11259ea0b646e
SSDEEP 192:RR5cBzp9F54ecv75pOPRp43j+Be98Hsb+WNSqLnLvU0+T/2DP2uD78VyIsnAUgE:RR5mzpHvIVaXouwTHLe2j2uoE
TLSH
T17962E91AB9102ABBACC7D329F9127B27D3F6206265D01E84E6FCC93C18E79DD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e6b689b53d7e6306663624e2a21177b9d3c0fc72cab20ea5a904bb92efe08d08
MD5 0a36bfec78c47c431069f959067409c5
SHA1 ffd7a08a4d59f3f15a6c6f3e9e7ce0640dab0111
SHA512 b7a58d5d56beee021987eebfb2ea8cbce009c77f62119fd736ee63dac2ff910e441c305fc1e944c228b2e1ec082010c3add844046c09cde642f05b5c2bb34ea7
TLSH
T1EEB0128080055611C02652F41152548CB124DF29DB0A1B0643F06D638867251C815060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584532.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584532.TMP
Size 96B
SHA256 add62c54716ae54ac72d1798d79e770bc09f3afc6ae9e723d8fbc88abb13162d
MD5 a14fb3516075f29a40809d5bd40e6186
SHA1 9929c1008c07ac19c4079241a9c61184df71461d
SHA512 5776538b64761db5da83cdd88a55ea1ac6943f9f001be689dbac18b7bbde227e4155fe11a09a5b296ab824ddcae6e1d4c0da0102f184c9dd4406c712b18ce47f
TLSH
T1C9B02220C0033A0BC08303F02EA8C0C83020CF2AC2030203A2E00A2ACC203300038820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 0e95d2db8f11ff3ec6df98aab2027b5e60a789760f946db426e5ba5c3d0a9b62
MD5 412cc0323ef875a05cb35502c174b35f
SHA1 7059a6375fe10b48f5cd2d90454bc1710553405f
SHA512 f1416fcce4edc99609b2bd58a58669670a921c15fdf7897863f376c28e0f18afbddb7835a573cb30c99e9732f8015bada0c9679d4d2e572d335a99f4d8c2d945
TLSH
T1E4B0021651550813DB8A1BB163E684C4B7721C16E3C3B153C6B86164A9D5343536D68E
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 8883ba34328776da1d376b1ff39121a5043e3c6385197a74d9e3a0f90005c159
MD5 ddf52c2ab1dc0a5b9615618f46d5481d
SHA1 83b4b2688c88acf6b0f8619f6078cb6353ff49c4
SHA512 5a1f27a3156fab0dbf97eee3c14f5a617fa21ed859a88f9ad72d7ded43cebc58fcb9c6dc0221402e450503b305f49b8d54a2aa94c887932fd7cf9e94a0968214
SSDEEP 3072:l9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:lUm7Rkm1tYpBeh2BAoF
TLSH
T1A8C312375D74A8775DB9BB4EB04E0E1F1DF20AA7DD20ED91C8D85A0423EABCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e04eb0497f2d13d88e12e1df7fd4c95bd99b5214154b05cfa21f4baceb7fb0c9
MD5 b73b58c05e7e10c3695be8e96fbaaa8e
SHA1 6b5b4ab82f51ceb64b12f5ca0afcfb84da6e51d2
SHA512 bd3add537be6d485e5b65ef260a92b70d5feb3aaccec76a5fe63f083eff2fb6188917db66ce73a85ba08d06342785bd70462a710e9bd948e30b4fb2bfee90336
SSDEEP 3072:IFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:IMm7Rkm1tYpBeh2BAoF
TLSH
T1BEC312376D74E87759B9BB5EB04E0A1F1EF149A3CD20DE92C8D85A0433EA7DC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8e71042e607b1cc2e12e1dad336c2cd13c2e7d6a3ea83bffc4cdf3afc4244616
MD5 7cfe90bb860ec530ba39686483628acb
SHA1 e1f5cc0c5f25cc13de5d66dc0ac0d0eeb6fd8e67
SHA512 c5ddc45380b0394e8c563b59cbf626aad28fa5e07a8238ee291f4bb026c34547be00542a2d0c944f7ee172b74f60f1e81b8c966f3f35cbfd45e1eaf7d02abb1a
SSDEEP 3072:WFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:WMm7Rkm1tYpBeh2BAoF
TLSH
T10DC312376D74A87759B9BB5EB04E1A1F1EF149A3CD20DE92C8D85A0433EA7CC0A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b96e7f5d8ca0cee5be71c1ab70766f177cacfa830c94620c35e5efdfd61d5577
MD5 b8e7fd7f458285c5f1c1a9f90d240c3a
SHA1 cac3e943a9fddb5bafbe008119d79b5a2f3d76bb
SHA512 92fca0cb17435caba8d97734fc448808121b0a66f6fa6d9406253996ff1200e563f92c05aa244a160ca39bfe20cf81b91c88f51cdcea132042774237069fe06c
SSDEEP 3072:F9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:FUm7Rkm1tYpBeh2BAoF
TLSH
T1F0C312375D74A8774DB9BB5EB04E0E1F1DF249A7DD20ED91C8D85A0423EABCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8ed50264c489424149028ff471e137f50fb5491df5c0d2f49584da01177e0522
MD5 ad2b7b5f9b079b8985fcf29861b831d3
SHA1 e750012e2f8f2679c0a55a8e5f96583ba2b25771
SHA512 24d8397452cbe3fbe68858a00b107888f8cde1420942f9c81e704d42b5a0d98bfc136864abd59ad9a599a846dffe99505a1e267dc43e098310bbf1e55a6a1f61
SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:em7Rkm1tYpBeh2BAoF
TLSH
T13FC3123B5D70A97759B8BB4EB08E0B1E1EF149A6C930DE92C8D85A0477FA7DC0A04934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 40f5221256b39a131d3f989226cc239b2577bc024bca15f691c1041f4a9c3b75
MD5 e49824c092c397031df91deb60aed86e
SHA1 a7ed7a8ddd293dc81c3b5de20f675a284a8075a5
SHA512 9c9bec7c83e2f0bdcf3554bf1f2c35e65b18336d2a26f827fe91d0e128419584373c9a232f9142dda73e18cd48ca72d4aa2579cd49771f521ceab8d4893014d1
SSDEEP 3072:9FGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:9Mm7Rkm1tYpBeh2BAoF
TLSH
T162C312376D74E87759B9BB1EB04E0A1F1EF149A3CD20DE92C8D85A0433EA7DC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrefabLoader.dll:Zone.Identifier

Path C:\Users\Admin\Downloads\PrefabLoader.dll:Zone.Identifier
Size 224B
SHA256 12b2f85377495c637385ed9b8ecb4a216a837d1dcdb36aa9bc07b4fd55272b04
MD5 7c878807ee00aee79aacd64b2021cb70
SHA1 d39895f6988adf95516572d951f5518b77b5d5d7
SHA512 03ce2e913300ca3c0b4ef12522d6eb999b9922b471a0b443792bbedfc583a0454b3e6e03726999ffc5b1278251b5c7dd872989722274710d07616a84dcaa80fa
TLSH
T1A9D0A7A3A0515190108B619DE6996186511D68D1858786455D7885FA809166ED19DC32
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 678716.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 678716.crdownload
Size 24KB
SHA256 8ccd73e89663fc5cabedd449285ab6a21a8ead3a693061ab1084470252737c7d
MD5 2092a15ae869f29f42d0a5f42f209733
SHA1 de18525c13f4d3281afb486c0367e6ca0c59a561
SHA512 6f6de6d0c9d0d21b36221dd4d7931137c52aa5f70359d75e0261cc050c72530366dd06835031e214d5695742b470a2f346b60d9762a4550436f8a27aa185e706
SSDEEP 768:GMMcvEBVmbMbyWMQEc0kC8KzayLVjUzf9fFjbNHsfH:GRmMbzWZtzasjAdhi
TLSH
T1BEB2D59062FC8322E8BF5F7C997212420771BA27DD7AE34E16C8B1DD1DB078049617A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnSpy-net-win32.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\dnSpy-net-win32.zip:Zone.Identifier
Size 1015B
SHA256 067654ce327eb5e7b15d4efc88368d806ae213c43742ba609f1505aefc90b40e
MD5 0bae262ff9644a49f59a02f5dfafd8b3
SHA1 55806084ff39969bbb1f16254438febff4004430
SHA512 33875f30cfd4bc9a3327de91e7efa9a607220b7031233f38c832a8d82d969c46839d5cfa5e76116a7b43f29861d70df2b985477528aa99fec007aa2503c74098
TLSH
T15D11A5E790259B1A1F06B9D3C64C5C6D145FF4FB4E07034C5235C08A88C01B681D783F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4416-522-0x000000000DD50000-0x000000000DD60000-memory.dmp

Download

memory/4416-524-0x000000000DD50000-0x000000000DD60000-memory.dmp

Download