hxxps://cdn[.]discordapp[.]com/attachments/1533213252870344754/1533213287515160777/PrefabLoader[.]dll?ex=6a70fd25&is=6a6faba5&hm=0d7bc2db10a86a58ed0e5ce23a12f13ac21b547c90ccf642935a2fc1bf418696&

Analysis

max time kernel
900s
max time network
870s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1533213252870344754/1533213287515160777/PrefabLoader.dll?ex=6a70fd25&is=6a6faba5&hm=0d7bc2db10a86a58ed0e5ce23a12f13ac21b547c90ccf642935a2fc1bf418696&
Sample260803-a232nsaa56

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	2644	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2644	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301914284410255"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
4340	chrome.exe
4340	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 4304	5956	chrome.exe	88
PID 5956 wrote to memory of 2644	5956	chrome.exe	91
PID 5956 wrote to memory of 2472	5956	chrome.exe	90
PID 5956 wrote to memory of 2472	5956	chrome.exe	90
PID 5956 wrote to memory of 2784	5956	chrome.exe	92
PID 5956 wrote to memory of 2784	5956	chrome.exe	92
PID 5956 wrote to memory of 1776	5956	chrome.exe	95
PID 5956 wrote to memory of 2716	5956	chrome.exe	94
PID 5956 wrote to memory of 2716	5956	chrome.exe	94
PID 5956 wrote to memory of 1776	5956	chrome.exe	95
PID 5956 wrote to memory of 5852	5956	chrome.exe	96
PID 5956 wrote to memory of 3228	5956	chrome.exe	98
PID 5956 wrote to memory of 6108	5956	chrome.exe	97
PID 5956 wrote to memory of 3228	5956	chrome.exe	98
PID 5956 wrote to memory of 6108	5956	chrome.exe	97
PID 5956 wrote to memory of 2396	5956	chrome.exe	102
PID 5956 wrote to memory of 2396	5956	chrome.exe	102
PID 5956 wrote to memory of 4556	5956	chrome.exe	103
PID 5956 wrote to memory of 4556	5956	chrome.exe	103
PID 5956 wrote to memory of 4288	5956	chrome.exe	105
PID 5956 wrote to memory of 4288	5956	chrome.exe	105
PID 5956 wrote to memory of 1812	5956	chrome.exe	104
PID 5956 wrote to memory of 1812	5956	chrome.exe	104
PID 5956 wrote to memory of 3260	5956	chrome.exe	107
PID 5956 wrote to memory of 5668	5956	chrome.exe	106
PID 5956 wrote to memory of 5668	5956	chrome.exe	106
PID 5956 wrote to memory of 3260	5956	chrome.exe	107
PID 5956 wrote to memory of 4568	5956	chrome.exe	109
PID 5956 wrote to memory of 1200	5956	chrome.exe	110
PID 5956 wrote to memory of 4852	5956	chrome.exe	111
PID 5956 wrote to memory of 4340	5956	chrome.exe	112
PID 5956 wrote to memory of 5812	5956	chrome.exe	113
PID 5956 wrote to memory of 5812	5956	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1533213252870344754/1533213287515160777/PrefabLoader.dll?ex=6a70fd25&is=6a6faba5&hm=0d7bc2db10a86a58ed0e5ce23a12f13ac21b547c90ccf642935a2fc1bf418696&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc1da9c728,0x7ffc1da9c734,0x7ffc1da9c740
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,16999856375608302476,4732298585661517170,262144 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,13740489702329109354,16027477041687301055,524288 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,3194038743423934240,10795071199835373045,524288 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,12221707659735852438,10658024723321282031,2097152 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,17378724072908270866,10134036017124356672,2097152 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,5766095205543134223,1506798243722580107,524288 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5744,i,2979402988099786871,10817935272688145884,2097152 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5764,i,8426371892574750042,10970913852838211337,2097152 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6132,i,14636109900315854580,4108990214165928063,2097152 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5756,i,17615434446067626726,6304516196985284501,2097152 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5752,i,5084829981125844239,13523681619471424459,2097152 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5812,i,16096910101834432942,9467749412345838610,2097152 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6408,i,8266826458668246078,14617989481666538929,2097152 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5980,i,8234087422294815232,12375184314174341004,2097152 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,4522193882913140690,18270603349139624673,524288 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,2608332635896142251,6940404215224157389,524288 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,2744810226415640967,10935250329524735604,524288 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3904,i,13595484419888192130,11017295357451114522,262144 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4568,i,9036921781647887015,8988083854305639024,524288 --field-trial-handle=1928,i,17709582135689608160,18207621925734573437,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
  2⤵
  PID:5812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1240

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4df62f3fb42cbb1c38956bb40e092c3f3b56be2690a1a5ac2c3aaf1eae09489d
MD5 5e585937d1ed6e49152a694b2482adc4
SHA1 aef35bf23c6a6ccd9c25cf0208d9fa4af899409c
SHA512 c1d4823b03be61b907e167a45c36213347b632508589c3b7a9746d4cfa958769cbc7e676ec1c31746130811e6456a8d70bb9dffb3d94e74b3182143ad80e9ba7
TLSH
T129418DF7C3D8857D890556F8AB156F1BCE2D0A18531C3C26C8D4AE1F97E6872D20064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b9718f686c3230b67423472aa94ab7a48fe019095b45aa6a1f6ef4b78bd0f00d
MD5 5460d244fc8e96faa4d6a7ad8c25002b
SHA1 13b2bbeef85980c9930db86665adb61bee0e5dfa
SHA512 338790b3d5d8306c484fc30292dd3fd5b4056f8969238b5d286fc3dea8c3e2df6b270908b155fdbf9219f2b1c1a0378681e45c601ea10e9e1878f4912d9e35e0
TLSH
T168417DF7C3D4867D890556F8A7156F1FCE2D0A18531C3C26C8D4AE1F97E68B2E20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 64cd56822591fbdd6451b4f32ba565386038093398e0d882356de4053cde0c85
MD5 6d8f0fad121c45f44aca52c5f5d4f566
SHA1 ac034236e95137de902e1a6fea82ca4163df68f3
SHA512 37bc929493f11788b07a681ddeef2fd253202f863c4d46063295913ffed85d892c1093ed421cd4777acdf71ed505da758ab9803cfff3c02077b92d458ac686a1
TLSH
T1CF418EF7C7D8857D891556F8AB156F1FCE2D0A18531C3C26C8D4AE1F97E6872E20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 e91906a03531cc0dffbcb72d552455cbfb27ca01e634ddf0049c789bbdd41814
MD5 0e4752aae7d6dc8d78e650f174b1fc96
SHA1 210312651a28bb3855967b54b124f750e997c656
SHA512 c5dac7c41ea4a81f109411956719329eaa1e1ca131dc02acd20e1d0e18dcc9892b9cbbaa43c90e4ffbab17dbfd354680458ddf0417569fdf78d218504705d36c
TLSH
T134F05067A67AB9670079846E9D087D05AD76A435055059F4CFA6425CE0865F70B02543
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c52c27d5097496e3173fe2de2405a1ac92136b653c24f55064bc47f8d7e8ec6c
MD5 756def30b6a1380d06f17cead725cc8f
SHA1 7424ed1ad0f638f435e97b9e45601fc0a36f8f40
SHA512 9ac2f79e2c8762730285155a096f27348727c5a069396cdca666dfbc4481b1ab30103e9707e53ad8f1660cb087730dc2193044b4b41633e4b525a05f9544845b
SSDEEP 192:dRYVb4MFv7DvAPRp2X964Hsb+WNnWGPB2yQkwvEJVyIsnAUge:dRY9D1H6XUbwPPwMve
TLSH
T14132A43EBD64697B6DCBC21AF9257B93D7F5002220942E84E7FC9A2C14E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 801bb27dc2433e995f5579bf3be0456aed5a30a3d3433bb74df2f77b73c87d65
MD5 3c52aeb2da8ba740bafc653e8a1bd0ef
SHA1 f217eef2b803c593d2d025a8d30001af3a2056e1
SHA512 6bcdacf9d08914f074b43789f5f8787a4201c0cdc99c35144d132c61ef9f93d2a2f63ec43f7369016182ea54cde8916ec2520f21f90393fb22002ea790b5dd14
SSDEEP 192:dRYVb4MFv7DvWPRptX964Hsb+WNnWGP12yQkwvgJVyIsnAUgE:dRY9D1HQXNbwPPkovE
TLSH
T1BC42A53EB924697B6DCBC219F9567F93D7F5102221A02E84E7FC9A2C14E7ACC2217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd7cd4ff-7588-4c3c-aec7-bed0d4da9afa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cd7cd4ff-7588-4c3c-aec7-bed0d4da9afa.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a91fec1dd34fd6c08aef2b0aef403f0c365cdd587bc0c99a46b3ad5328567c73
MD5 1c580cc598e98597dd86b11cc50620d9
SHA1 008e7c6c6c80f5800ca76b85b084dd93b83cfb94
SHA512 24bd0a2d3fca4336ef2f97088b939ede7ad8fbffd723f999a62e86e5295aa218f17ae54d19d9cf2a3ae13e1af66bc8d968480aba8af22bc1f8e90f6cc9b742e3
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7mc2Sl8h4otop5qMpDVB68Gyv9JFhQDkORNC39ISyVNC5:Ct0LA/TE570iU2q2rs+FhQDkOuCMJiQ
TLSH
T1D1C117B4A86C6DBB0CF6A485F1033D83CDA8A15B69253E98ADED0F4C00D74EC1783923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 cb612495d869a21c3ef343e6dc583579a4ee1547a15078f8acec463acf1fa26c
MD5 c1f65951085d643559f754e570f6b374
SHA1 8af89c42f356065333a11e8056d7307ab3f67b0b
SHA512 0dc72507df14b44f8dee001fb6698a48faa000a76cb9f49589d38a390d9910b0cd02db1733d18339ea088b02536011e570880e74ce19c25777791e668559f101
SSDEEP 96:CC0d+cAOIt5aDVmufj7mc2Sl8h4otop5qMpDVB68Gyv9JtFiO0AuSwASDkh0j9IX:CC0LA/TE570iU2q2rs+tFGSwASDkhUZI
TLSH
T1A8C13970B8AD2D735DF69554F1437E87CDB4A057A9626E9089ED0F1C01C70EC2383A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a4370248457cbedc6f6edb0f54eac5621c85490881c558ad1b1feadc4d59bbdb
MD5 0e7354a44e0870b92cfe6c9a5b8d5ff7
SHA1 c22fb85059356854298bdb13fd25e395651ae8a3
SHA512 c48409034b1b92dc321e59352eaff9b1293ce2cf9a5d2e09e2e136fc14df33da824a36f0044ec0f4269c1ee2c718680a514a7eecd30b6bffd2966037ea930584
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5qMCDVB6/dGyv95Skhbb2Jv4a:gC0LA/TE57cDUDqnrUweSkhbKl
TLSH
T140A11871B8A85EB75CB5C584F5827E83CF68A153A9227F80D8DC1F0C10E70EC1782A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 80c0430da85edec737bbab1482de89e9aa8cd03de9f71a752906805829e80c2f
MD5 88b07aae4992db59976c0161490d17f6
SHA1 3124757116196da1e36d1600f20f551ba93679e6
SHA512 b16b68fdc124779ec5745ccbdab82f7b44f2de06cf4c4e640e01471abfdbd08b1e7e9983ee6d6e0f8a00c68a4a4bfebce5b434f034d0c4f499769c14d7e4223f
SSDEEP 96:CbJ0d+cAOIt5aDVmufj7mc2Sl8h4otop5qMpDVB68Gyv9JtFiO0AuSwASDkh0j9S:Ct0LA/TE570iU2q2rs+tFGSwASDkhUZI
TLSH
T14AC139B0B8AD2D735DF6A554F5437E87CDB4A05BA9626E9089ED0F1C01C74EC2383A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a21cafad1380cac8bf176d9fa86002ab9c4e404b5e05f52d9d66834ce5ef5d8a
MD5 925a3376012d84faf689f6fb337bda35
SHA1 f19a5c15fff0121ec44618974d678251ee2c9d93
SHA512 726cd11bf5b1acbc6975598bca302216235e34650a118cd71609630f3c95d6421163a707de507c49d49403f3b4ef1d38a369b1770afc46aab17142f657501352
SSDEEP 96:CbJod+cAOIt5aDVmufj7mc2Sl8h4otop5qMpDVB68Gyv9JFhQDkORNC39ISyVNC5:CtoLA/TE570iU2q2rs+FhQDkOuCMJiQ
TLSH
T1C3C117B0A86C6DBB4CF6A485F1433D83CDA8A15BA9253E58ADED1F4C00D74EC1783927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 380702.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 380702.crdownload
Size 24KB
SHA256 8ccd73e89663fc5cabedd449285ab6a21a8ead3a693061ab1084470252737c7d
MD5 2092a15ae869f29f42d0a5f42f209733
SHA1 de18525c13f4d3281afb486c0367e6ca0c59a561
SHA512 6f6de6d0c9d0d21b36221dd4d7931137c52aa5f70359d75e0261cc050c72530366dd06835031e214d5695742b470a2f346b60d9762a4550436f8a27aa185e706
SSDEEP 768:GMMcvEBVmbMbyWMQEc0kC8KzayLVjUzf9fFjbNHsfH:GRmMbzWZtzasjAdhi
TLSH
T1BEB2D59062FC8322E8BF5F7C997212420771BA27DD7AE34E16C8B1DD1DB078049617A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download