43f2a9ae018c436617b6578deb0afb90576f5e233061e1a8ae9db856a5b457e5

Resubmissions

30/09/2026, 06:49

260930-hlb71sst5m7

30/09/2026, 06:36

260930-hc8vmaha457

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afterpatch.exe
Size 2.7MB
Sample260930-hc8vmaha45
SHA256 43f2a9ae018c436617b6578deb0afb90576f5e233061e1a8ae9db856a5b457e5
MD5 372dc0d4f84041a7858940c728ad15db
SHA1 c15712b94d1df3fd5de7f6a8d0649ead792d4bde
SHA512 7b69ef8f263def391d89d2a65ef1358bc062e43e3582734e784b2d2410be6abe7c475e5561cb60e127f288373de6b62571fff793e47be3caf2d3f11f08a20964
SSDEEP 49152:Z7JlipCLod/0Y4cPyxIVwwEyZo88/MgMz70bNY6zPtaHVq5O:Z7Hi3MqyCVwwL+82m0bO6zPtakO
TLSH
T1A2D5CE2AB25EB13DD7591E35C572F3105A3B7A71EC328C2B46FC7508CB2E4481A2B765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4760	afterpatch.tmp

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	perfmon.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Video\neuroserver\DLLs\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Video\neuroserver\Lib\site-packages\starlight_utils\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel\neuroserver\dml\Lib\site-packages\starlight_utils-0.2.0-py3.12.egg\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Photo\neuroserver\Lib\site-packages\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Video\neuroserver\DLLss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Videos\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel\neuroserver\Lib\site-packages\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Photo\neuroserver\dml\Lib\site-packages\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Photo\neuroserver\dml\Lib\site-packages\starlight_utils-0.2.0-py3.12.egg\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Gigapixels\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Photos\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel\neuroserver\Lib\site-packages\starlight_utils-0.2.0-py3.12.egg\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Video\neuroserver\dml\Lib\site-packages\starlight_utils-0.2.0-py3.12.egg\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel\neuroserver\DLLs\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Photo\neuroserver\DLLss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Video\neuroserver\dml\Lib\site-packages\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Video\neuroserver\Lib\site-packages\starlight_utils-0.2.0-py3.12.egg\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel\neuroserver\dml\Lib\site-packages\starlight_utils\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Photo\neuroserver\Lib\site-packages\starlight_utils-0.2.0-py3.12.egg\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Adobe\Adobe After Effects 2024\Support Files\Plug-ins\Topaz Labs LLC\Topaz Video\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Video\neuroserver\Lib\site-packages\starlight_utilss\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Common Files\OFX\Plugins\Topaz Video.ofx.bundle\Contents\Win64\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Adobe\Adobe After Effects 2023\Support Files\Plug-ins\Topaz Labs LLC\Topaz Video\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Adobe\Adobe After Effects 2025\Support Files\Plug-ins\Topaz Labs LLC\Topaz Video\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Adobe\Adobe After Effects 2026\Support Files\Plug-ins\Topaz Labs LLC\Topaz Video\rlm1611.dll	afterpatch.tmp
File opened for modification	C:\Program Files\Topaz Labs LLC\Topaz Video\rlm1611.dll	afterpatch.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afterpatch.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afterpatch.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4312	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1228-1-0x0000000000400000-0x00000000004FD000-memory.dmp	innosetup
behavioral1/memory/1228-13-0x0000000000400000-0x00000000004FD000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	perfmon.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4760	afterpatch.tmp
4760	afterpatch.tmp
1684	chrome.exe
1684	chrome.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
5732	perfmon.exe
5732	perfmon.exe
4188	taskmgr.exe
5732	perfmon.exe
4188	taskmgr.exe
5732	perfmon.exe
4188	taskmgr.exe
5732	perfmon.exe
4188	taskmgr.exe
5732	perfmon.exe
4188	taskmgr.exe
5732	perfmon.exe
4188	taskmgr.exe
5732	perfmon.exe
4188	taskmgr.exe
5732	perfmon.exe
4188	taskmgr.exe
5732	perfmon.exe
4188	taskmgr.exe
5732	perfmon.exe
4188	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5732	perfmon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeDebugPrivilege	4188	taskmgr.exe
Token: SeSystemProfilePrivilege	4188	taskmgr.exe
Token: SeCreateGlobalPrivilege	4188	taskmgr.exe
Token: SeDebugPrivilege	5732	perfmon.exe
Token: SeSystemProfilePrivilege	5732	perfmon.exe
Token: SeCreateGlobalPrivilege	5732	perfmon.exe
Token: 33	5732	perfmon.exe
Token: SeIncBasePriorityPrivilege	5732	perfmon.exe
Token: 33	4188	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4188	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4760	afterpatch.tmp
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe
4188	taskmgr.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 4760	1228	afterpatch.exe	87
PID 1684 wrote to memory of 5132	1684	chrome.exe	114
PID 1684 wrote to memory of 2108	1684	chrome.exe	115
PID 1684 wrote to memory of 4312	1684	chrome.exe	116
PID 1684 wrote to memory of 2108	1684	chrome.exe	115
PID 1684 wrote to memory of 1776	1684	chrome.exe	117
PID 1684 wrote to memory of 1776	1684	chrome.exe	117
PID 1684 wrote to memory of 3456	1684	chrome.exe	120
PID 1684 wrote to memory of 3456	1684	chrome.exe	120
PID 1684 wrote to memory of 3372	1684	chrome.exe	119
PID 1684 wrote to memory of 3372	1684	chrome.exe	119
PID 1684 wrote to memory of 4132	1684	chrome.exe	121
PID 1684 wrote to memory of 4132	1684	chrome.exe	121
PID 1684 wrote to memory of 5156	1684	chrome.exe	122
PID 1684 wrote to memory of 5156	1684	chrome.exe	122
PID 1684 wrote to memory of 4124	1684	chrome.exe	124
PID 4188 wrote to memory of 5356	4188	taskmgr.exe	134
PID 5356 wrote to memory of 5732	5356	resmon.exe	135

C:\Users\Admin\AppData\Local\Temp\afterpatch.exe
"C:\Users\Admin\AppData\Local\Temp\afterpatch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\is-MGPQT.tmp\afterpatch.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MGPQT.tmp\afterpatch.tmp" /SL5="$E0218,1706450,976384,C:\Users\Admin\AppData\Local\Temp\afterpatch.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffe8cbc728,0x7fffe8cbc734,0x7fffe8cbc740
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,4381740764816664495,6586255915447901314,262144 --field-trial-handle=2044,i,4368421701338620842,3209634427963377560,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,1431430677249133004,5329084449025863409,524288 --field-trial-handle=2044,i,4368421701338620842,3209634427963377560,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,18127465717799089876,9805076399814647052,524288 --field-trial-handle=2044,i,4368421701338620842,3209634427963377560,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,2331837309999823742,1734744145638514355,2097152 --field-trial-handle=2044,i,4368421701338620842,3209634427963377560,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,11810892580977688136,163303200877304311,2097152 --field-trial-handle=2044,i,4368421701338620842,3209634427963377560,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,16300220031248884176,2380610611243112783,2097152 --field-trial-handle=2044,i,4368421701338620842,3209634427963377560,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4500 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,14857909455124595755,1062486031789372612,2097152 --field-trial-handle=2044,i,4368421701338620842,3209634427963377560,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,8285596230840062328,8850795685496375489,524288 --field-trial-handle=2044,i,4368421701338620842,3209634427963377560,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6064

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\system32\resmon.exe
  "C:\Windows\system32\resmon.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\System32\perfmon.exe
    "C:\Windows\System32\perfmon.exe" /res
    3⤵
    - Enumerates connected drives
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VR.lic

Path C:\ProgramData\Topaz Labs LLC\Topaz Video\models\VR.lic
Size 543B
SHA256 cb3be0e6ab4d14d4560d276980de9abb7be9a1f3c072284c359e84cf4ee3b36b
MD5 fadc5dbfd5be7775911401cff50721a3
SHA1 d39f1dded59271497a12de4cc2f960c7ffe9a829
SHA512 cdefb8e8eaf84133c3b2a2f44b1df45c079cb3a60b10154f8cd863fc89a902e853e6e88e9c429811ee6005c882c1429351916a6285ca77af9173d040666fe69e
TLSH
T181F0E56CC51112BAD3470ACC6F0C18692A80B103C482A95563ECDDC013C00597343AFC
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8d0418a6997924b35908bcb0a4ac530a7a166d3c06d0530d510dfc07c4205e8e
MD5 d2894b3cca9b4327c555c9a8fd3ad67f
SHA1 52618030968136bb6a4d572c9a9619fce7d9131e
SHA512 e605742c7b6fbbc087f8ec7d1c45cb70b9fc7b65364da4e2f6114d15dfa7227c45ef7d01c87fb31377a5183a774e31eb9ac3437fa1cbe8e6b205ec93d688e24b
TLSH
T15CF02DB5C921FC7B18FD5B2D60944B47E74513273641845F3A3D820D8F7463B4695C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8b19ccd92495d828bb583476f89182e3438fd94927ac786be0378a9ef04f1e4e
MD5 f2965c39169b4e32adc38d2c1e369811
SHA1 4ffd26f84cf8b5b4460d6c77a46e487e5f7f5464
SHA512 fca45fc5e80c5cc84602a2e11ea39bc7be7d39d5081cb8703c0c9b16ccc0f95fc144cd03580b72db0c64cbcc3aaa1b04b081f67a95489594a013ab4500f91f27
TLSH
T1F651AFB3C3E8867DC90156F4AB252E2BDE2D0964532D3C56C8D8AE5F53F18B2D34064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 0e1999f675aef16b894dc3d2ac2e5a0a6151721b8a6c17e26f85af26e326098e
MD5 241254d63007d1ddd2dd92c151925e78
SHA1 38424c9239e03928c7985ade1ac883165ab17b62
SHA512 f10d20d1c679e74d9a6cb19ede8435dc9a6fa2891a4500f2955fe77736d9d5209625536b92173d1b75de980e3c06d31422b82d1faae25006e1b3cec025361edf
TLSH
T165F09EA7E2BE7477517F49AB1E047C4969F9A87012C168F0DE6B826CE0E64F71B02443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b2f9c8ca568a2fa13e3cbe815a498a6f4e83b141b2fd526f2ff733c8d0d9a5d0
MD5 56a6c87fdb432df135e10140f7217001
SHA1 32ca2ce96dd3069ad2dc8ae877052f19599d7f9c
SHA512 c46a4c286ec61d4a52cf9d7d8a39b205fc96a0ac6c27ee267674d7ce7d6a0472684ab25be914025f4ecfa7100ee4b6481016d2fe6f571a4556b6238de3224a27
SSDEEP 192:2RLu91ca8zNlv7GpAPRp2C96Hsb+WNnbUdcM28t7skw/PyIsnAUgtaJ:2RLu9SaSVCUXtswwdZ2ig78
TLSH
T1B742822EBE10753B5CDAC22AFA617753D7F6103624942E84EAFC897C14E75CC222B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2cf42abb4ef4d90cad1566b72744fc46b8953a7c2d3bb67051b934726e87d469
MD5 e65f7954ed9210c9d7af1b4f9ef57c7a
SHA1 5c2cfe024f9d3e5e2b1f77716c1b1bbaac2c3932
SHA512 8227e6d0f6e544b12586dd49750c5c3c162ac29b9ed743dbf4b70d0083ed8c5a9393dcfe26cc4f5a65b05491df44c737cabf600efc15d96f36a9b98aa3291715
TLSH
T132B0120580422310C0068370122090743B60CF34D0212399C1E01D01D8350B06167108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4d85.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a4d85.TMP
Size 96B
SHA256 09fd3a3ef6232275c4ae6f2838d7dc6765564b70af32ffb538d0c154d0f627bf
MD5 3d20918bda8eb08a97283247939e056c
SHA1 c515b8879f6a13a65cc4dc17c8b1cf8505c6d4ea
SHA512 c461848ec74fefe286422116ca9903033b553f1979f05cec9646a57a439069071fff7f03620b77e287a8f01ec3e89ba18893674c742e5deebd0d301a8dbd4495
TLSH
T1E8B002A5D602A222C04243B03A9595F971A1DF35C603E657D2E12E76EC266B04675961
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 9af0094955861e9f8e05c1d368d22d443e1638bfd7d6bf9da69bd97c3c257e9e
MD5 ad33455de95cdcc712c2d70dd1e23604
SHA1 fb645285ce3df3cf8b11a0662c06af06eaef5e14
SHA512 4c9ff8a2c150884e316ba7e2aa6676e34e1ff7fdcbe310525f68798991901e8c640d980def4c9398e5092232086d367d5c06d57592f413ff91df9e8d97a2fe12
SSDEEP 6144:dIQrWMy4s+Je+Otv7eSOu67+hFD+7t56OD9ZfSAppre:tiMJs+YlKSh67yFSXD9ZfS4c
TLSH
T11D4422723657FEFB99781142A00B72005DF9FEF892A65E5544C19F8DE1EF4480AB3B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

e38329d7-e68c-4a77-a480-216f9995ece2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e38329d7-e68c-4a77-a480-216f9995ece2.tmp
Size 130KB
SHA256 a007703f55077a48ebd52febc1299c9c43146c313af0214106522af9ccc49832
MD5 26feae9029f9d8c812762bbc692d42c9
SHA1 cd25e7092ab3c23807c857e16c57337681711aba
SHA512 81da58feeda4a2257158b656e08d0fbafdb465d6b199b25277ca2313d87bf4052bd05a169a55365fd14e46616a62bf1154286047c3b2c1c54d2ec1b28cbf1bb2
SSDEEP 3072:U++lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:U++hFD+7t56OD9ZfSApprB
TLSH
T19CD31232AA91D8BBC9BC6141B157A300CE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afterpatch.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-MGPQT.tmp\afterpatch.tmp
Size 3.6MB
SHA256 2c2908a094afaf33007b00394bb603e3fec1bb2942f2e7da784f3af10110a93a
MD5 3d8a8559b54dd95453dbd8078607fbfe
SHA1 ab3adf4facc398f67f862d59336acb2ae1ef0da1
SHA512 90bab7072555b45c04f94f5c64603a46c4a96459fea153eb5df63980387907b37a0dfe9a40983618dfd663c2ded68c102ccca5c32f04e6ace2125b21b64cca00
SSDEEP 49152:kviYUtaivJlWSM0WXo7FhDGS6Yh2ewYAJpg7xmUzWc8UecQ3/fmmowkTOE333rX:5goDyS6Oy/+z333rX
TLSH
T135064913F244713BD35E1E35843BA79489377661AD2A8D276AFCAC4C4F791402E3BB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-1-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/1228-13-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/4188-159-0x000001C0F2D40000-0x000001C0F2D41000-memory.dmp

Download

memory/4188-155-0x000001C0F2D40000-0x000001C0F2D41000-memory.dmp

Download

memory/4188-154-0x000001C0F2D40000-0x000001C0F2D41000-memory.dmp

Download

memory/4188-153-0x000001C0F2D40000-0x000001C0F2D41000-memory.dmp

Download

memory/4188-161-0x000001C0F2D40000-0x000001C0F2D41000-memory.dmp

Download

memory/4188-160-0x000001C0F2D40000-0x000001C0F2D41000-memory.dmp

Download

memory/4188-163-0x000001C0F2D40000-0x000001C0F2D41000-memory.dmp

Download

memory/4188-165-0x000001C0F2D40000-0x000001C0F2D41000-memory.dmp

Download

memory/4188-164-0x000001C0F2D40000-0x000001C0F2D41000-memory.dmp

Download

memory/4188-162-0x000001C0F2D40000-0x000001C0F2D41000-memory.dmp

Download

memory/4760-5-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/4760-12-0x0000000000400000-0x00000000007B7000-memory.dmp

Download