0bc0516ad89bee3ad9958e5929d348ee1356eeb5a5d789a7adb1dca41063c992

Resubmissions

08/09/2026, 16:00

260908-tfy1datfra5

08/09/2026, 14:41

260908-r2sdlsdk5s5

08/09/2026, 14:33

260908-rw92gadj4z5

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PaiamrPATCHER.exe
Size 1.3MB
Sample260908-rw92gadj4z
SHA256 0bc0516ad89bee3ad9958e5929d348ee1356eeb5a5d789a7adb1dca41063c992
MD5 3ae574008668e3bba563b8a84f15b896
SHA1 ce1987a698a1d2a88ca6d9e92a1fae9e326daa54
SHA512 dc496890cd26f284b6f3ad832b2be524051934bcbf558be22089002b3d40eba2dd4c45fea59959f86c43c1eaacee92c9b7dc6642f3fd3a00706e62d6d7fa53a4
SSDEEP 24576:n0/wH2fMinErsWguWHbZhQWya2ETtyqfF8XAU4u6LRWEzvALfARFXGnVgVJJ:0W2frO1fW7/sa7YqrU4u6tBvALfuG2
TLSH
T17D552376FA04DE47D20A457C4DE3D785E07EBC48EA6319EAF4367A5E2A79780312304A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

AutoIT Executable 15 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/3240-15-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-14-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-66-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-87-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-98-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-100-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-117-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-118-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-128-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-150-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-151-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-152-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-153-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-154-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe
behavioral1/memory/3240-158-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	autoit_exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3240-0-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-15-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-14-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-66-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-87-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-98-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-100-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-117-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-118-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-128-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-150-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-151-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-152-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-153-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-154-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx
behavioral1/memory/3240-158-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
596	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333516524489217"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
2656	chrome.exe
2656	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3240	PaiamrPATCHER.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe
5088	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1540	5088	chrome.exe	90
PID 5088 wrote to memory of 4172	5088	chrome.exe	92
PID 5088 wrote to memory of 596	5088	chrome.exe	91
PID 5088 wrote to memory of 4172	5088	chrome.exe	92
PID 5088 wrote to memory of 2976	5088	chrome.exe	94
PID 5088 wrote to memory of 2976	5088	chrome.exe	94
PID 5088 wrote to memory of 936	5088	chrome.exe	95
PID 5088 wrote to memory of 936	5088	chrome.exe	95
PID 5088 wrote to memory of 464	5088	chrome.exe	96
PID 5088 wrote to memory of 464	5088	chrome.exe	96
PID 5088 wrote to memory of 4216	5088	chrome.exe	97
PID 5088 wrote to memory of 4216	5088	chrome.exe	97
PID 5088 wrote to memory of 1084	5088	chrome.exe	98
PID 5088 wrote to memory of 1084	5088	chrome.exe	98
PID 5088 wrote to memory of 2056	5088	chrome.exe	99
PID 5088 wrote to memory of 2056	5088	chrome.exe	99
PID 5088 wrote to memory of 3300	5088	chrome.exe	100
PID 5088 wrote to memory of 3300	5088	chrome.exe	100
PID 5088 wrote to memory of 4412	5088	chrome.exe	101
PID 5088 wrote to memory of 2748	5088	chrome.exe	108
PID 5088 wrote to memory of 732	5088	chrome.exe	109
PID 5088 wrote to memory of 3232	5088	chrome.exe	110
PID 5088 wrote to memory of 2656	5088	chrome.exe	116

C:\Users\Admin\AppData\Local\Temp\PaiamrPATCHER.exe
"C:\Users\Admin\AppData\Local\Temp\PaiamrPATCHER.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7ff920f7c728,0x7ff920f7c734,0x7ff920f7c740
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,16850910960720574693,10041121431357093382,524288 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - System Time Discovery
  PID:596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,17645534929898824551,4697510287042876769,262144 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,18238821076881167785,2843409771695513285,524288 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,9841081638295329444,6013096633242753252,2097152 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,8021087905652061016,14676566795720181094,2097152 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4364,i,6081134808968769936,4912700619745585311,2097152 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,10569699920234465407,7258055417897161521,2097152 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,10333972085183931112,12432081351155067601,524288 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,11475203881476446527,10802493388278066119,524288 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,13227893337100530398,9182069032182006161,524288 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,9499514957120024593,7902265059518224821,524288 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,608070942785576276,16574878231907607553,524288 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,6613250378274587117,9334054260779114102,524288 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5724,i,14570598397465498549,10099961239622234847,262144 --field-trial-handle=2020,i,6562863683446526345,573659579540860891,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 991e3114850e687b35ee138272674778ce5525a65e2fafdeb1106b68746a7cd3
MD5 bcd02840b29199bfb06104d4ddccc01c
SHA1 c354a8064c2a54ce3c53021d9b11e442ae65da02
SHA512 e6549b4af9f63e43ae719571058b0a03f9a4daa2535a2e8daeddbae25c1ddae1736daebbde0f25682c85afbdc6162b6fd662eac08cc21d04e8d469c28a9c37d0
TLSH
T185E02BADC821AC671CFD1B3860104645E741231B3F90C90F3A3E81198FF5A3A8566D2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 434cc4a65e3ee8137c89d8fc7bf799c124203782b43f3213f93ba6d830874419
MD5 d7fdc1fb49fe7c52991eb86b031fabfb
SHA1 91041d7296eba3d7ae0b98fbef6a8f25cd079149
SHA512 8c73258db88940ecdd8d60efc6252f9eb11ef64421bf29978f2bd91b1da5a5126910471fd36a117b744504f3f7b20d7b7a2479fd6ff831a831ee78d4a5826149
TLSH
T190518FF3D7E4866D8511A6F4EB15AE1FCD2D0A14132D3C66C8D4AE5B43E2972D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 23a411eb39d9598c250c0e731f43d98a3b37129646ab4b5628e2ef6b1bb4d64f
MD5 3c8f8da8ed0581a671a516c5d77c8cfc
SHA1 b677dba2a0bda42208f7b242bc94d2649a02686e
SHA512 2a4bc159f812c95eb8d66d434a2d95a717ca89355ed12fb60354d88b43cbdd177f7835f9631c4fe1ae128595e0d039ebc54847154446f1c8f128a6372af54d33
SSDEEP 192:XREv2yZE0Kzv7chAPRp2qg9BHsb+WNnUwIa0IXkIIYZXaS1cRHVyIsnAUgtaJ:XREvoLw8XlgrwUna0IUITJahRh8
TLSH
T10A42F82EE920787B5CDBD22AF9557B53D7F5202235942EC0E6FC8A2C15E79CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3b5568c27dfdb87fc6ed27f22f98721f797ec846cc8954b4165d617a31b8c29b
MD5 532aeb8227c22f6ea155bf8c5f0d0e99
SHA1 acd9036099eb88e92788abc347819c4d07108306
SHA512 adc1178f23025037b17b3f25712ade143e1b610792b9dc7be9003366cdc8c22b2512920f399cdf811eb7974a0d18b14a6176e7469c40c44fa71fa56d811dc331
SSDEEP 192:XREv2yZE0KSv7chAPRp2qg9BHsb+WNn2ktdkIIYZXaS1c0HVyIsnAUgraJ:XREvo+w8XlgrwptCITJah0he
TLSH
T1C142E82EF920797B5CDBD219F9157B53E7F5202225942EC0E6FC8A2C15E79CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ced27b090fb62c269c1b50b40b95138be1f81f5fe5471dbd50604823fa06598a
MD5 693554d6cce948bf013cb62d2975ead4
SHA1 af7a48cb5bbc31c0bff510fdbc4f400ac6cf6b20
SHA512 716d3db22ebd5badd146438b730b0a61fed6fa31d978a77579871bf5f5384ff4456558819b3e305eaf97169c8dd6687ae17cd0b264c6e8272376353a1ea304d8
SSDEEP 192:XREv2yZE0KPv7chcPRpOqg9BHsb+WNn2ktzkIIYZXaS1cKHVyIsnAUgraJ:XREvoHwUXNgrwptwITJahKhe
TLSH
T10F52E72EE920397B5CDBD22AF9557B53E7F5202225942EC0E7FC8A2C15E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9c2b5c5b0f2b50b924a34d3ab9513bd29c2685c4778969bbfd4e3301ccbea8e3
MD5 c292a73a5ecbe9166d39ea7847368461
SHA1 c06cb0b4dedf2b10790eee1dc0845513ea3fdc17
SHA512 d94a8dff8abdc2d080ed77f07ec4a7ac6dc1e6e8bdc2d0cd20833fc72f638d8ebae3a939e3ca4b76eeff6bc89573e2f4578c75331239141d8404f6d4d31e947c
TLSH
T1B7B01219C0815242C08642B03243149872145F10960A1B0243E4A932C8252B180240A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ba62.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ba62.TMP
Size 96B
SHA256 b746aa31dcddda2182540478091527cf34091b876a59bdb45748f04a4e0ec5cc
MD5 35a50f4a4d5def86a9ff3ac7319088bc
SHA1 4ae0938822594f12368f421b52d248ade4b4d9a7
SHA512 ea14ecf294e87735dc88bee794179a3f3f5ad8da0bbde6cd8fa937282870c5ba194af8f70c33c483c84b0d80324885cbde563eaf08c79ddb1dec2d70f3a8f738
TLSH
T10EB02220C0222332C02303B238A0B2CA3030CF30CA030203A3E20A23EC302308230020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 c88227798672ac0ed94ab54bbf0cda138063b9f0c16bb5b2cb0933bd34210662
MD5 f2234643cfebaec4277e71692961e4e1
SHA1 00a697243e279e36e4eecb713d4eb6d9095df742
SHA512 a5f3ebf571949f7902c6b821ce8035d7f0dd5238d72cd9529a78fa633695b350a572f897fd650392edadddc4976ff090bc7288c7ccc1cd00c445a16f3a874abf
SSDEEP 6144:vCZqyXOplXaHl5FmUi21rSm8uUVNSlzYQ:vXTTS9fi21b8j8zl
TLSH
T1D83422217A9BF4F1DD9E205435CEAF94DE688A918294C5058757FAC09BDB3C30F2BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 81684a3cb3cda46e3a1535b43f5aa02e378a232bcff152008309f7b83ffd8d92
MD5 0f4b514fc441fc9873537475cf8b9748
SHA1 2a9958235cb4907734fd5d4a3fae63ca721cb8f0
SHA512 edaa0c8b04e7f476275e7e44b74efe9ff74bd0655b66f28e76e09f7a144ca230ab37320d0961b18dbda4fecb4f3840088a2c5e81cbf5825ab1c0f2ed3b8f8dc2
SSDEEP 3072:SIFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:5FmUi21rSm8uUVNSlzY/
TLSH
T1F6C31300B6E3F8F2FE5930447BEE2A145D6C0D818291C64152739D419DEF3C61FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 6f06fda039b443c6661d46922f8cddc037ebc02391faaca6a294171bcac88fee
MD5 c54dd3d49c9b77f6b2b4b33bb190e34c
SHA1 f37d47d530c59130516aa9dea1ee626f83fe9fd9
SHA512 44507f7255a6e84f2bfa46f49ad4dab488cef0b78fdd882e6d49d8162593b8529e16e58ad2c46cf7edb8fdca21e6ed833c6fba2377af19ad70af638d505c2557
SSDEEP 6144:YCZqyXOplXaHl5FmUi21rSm8uUVNSlzYQ:YXTTS9fi21b8j8zl
TLSH
T1733422217A9BF8F1DD9E205435CEAF94DE688A918294C5058757FAC09BDB3C30F2BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 267c81322411d9241faba8bb889873712a99f22cfaf2dd4731551bb9ace4aa57
MD5 c0a9b5b80f2e4c2e6772b36a5e95a063
SHA1 a8905ff4ed61e5bc91c4c5fde2f8fe37a31592d2
SHA512 4c781f3afa1c792600e607489b47b53996f41c75816353a06e4d98eee8da88967af9a8aff8af0fec0e6b8f0ef476fc34682063b97b3e2ae5cec72a9f97c77e31
SSDEEP 6144:uYCZqyXOplXaHl5FmUi21rSm8uUVNSlzYQ:3XTTS9fi21b8j8zl
TLSH
T1FC342331799BB4F1DDAF219425CEAF548DA8CA968394C5098617FFC19A9B3C30F1BD20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\config.ini
Size 11KB
SHA256 c04d17ccc7c8c0d48ee4a63af7f031b95a8d6f88e96bb2cf047c2a5d1f804236
MD5 f6d3cff8bff059da4d45c39b23076463
SHA1 1215a335413869a29f3824a88674ccc58759df73
SHA512 2253c9b68eb0c20474395d606747328b846534821a6aeb960c91b87dcab688b126b11a81974d3cd4cb1ab9f779cfc9355c363ef217390b59843ccb2ae21cba05
SSDEEP 192:5GCcM5vzp0ecdFuCvcf/vcgBQENVBotrcabq2ctKNmm8hJIel:5oM5bp0ecdQCvc3vcgxNLaO2ctK0m8hL
TLSH
T13832C905C6D346B3CAA47E4E33B17E93273BF1CC85CE1351DB56853E2AD2408929BE59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3240-66-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-98-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-15-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-14-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-117-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-118-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-100-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-128-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-0-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-87-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-150-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-151-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-152-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-153-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-154-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download

memory/3240-158-0x00007FF6C50C0000-0x00007FF6C539B000-memory.dmp

Download