Overview
overview
7Static
static
3Hydra_1.0....up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Appraiser ...nd.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ds.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...es.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ng.exe
windows11-21h2-x64
1Appraiser ...ew.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ...ll.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ct.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ge.exe
windows11-21h2-x64
3Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...or.exe
windows11-21h2-x64
1Appraiser ...th.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...wg.exe
windows11-21h2-x64
1Appraiser ...b1.dll
windows11-21h2-x64
1HydraBackend.exe
windows11-21h2-x64
7Analysis
- geolocation tags
asiadelhiinindia - user interaction
yes - max time kernel
300s - max time network
312s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:56
Behavioral task
behavioral1
Sample
Hydra_1.0.2_x64-setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
Appraiser X/AppraiserXBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Appraiser X/Tesseract-OCR/classifier_tester.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral11
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Appraiser X/Tesseract-OCR/shapeclustering.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
Appraiser X/Tesseract-OCR/shapeclustering.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Appraiser X/Tesseract-OCR/tessdata/ScrollView.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Appraiser X/Tesseract-OCR/tessdata/jaxb-api-2.3.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-core-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-extras-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Appraiser X/Tesseract-OCR/tesseract-uninstall.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
Appraiser X/Tesseract-OCR/tesseract.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
Appraiser X/Tesseract-OCR/tesseract.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Appraiser X/Tesseract-OCR/text2image.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral23
Sample
Appraiser X/Tesseract-OCR/text2image.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Appraiser X/Tesseract-OCR/unicharambigs.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
Appraiser X/Tesseract-OCR/unicharset.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral27
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Appraiser X/Tesseract-OCR/winpath.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral30
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Appraiser X/Tesseract-OCR/zlib1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
HydraBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target Appraiser X/Tesseract-OCR/classifier_tester.1.html
- Size 19KB
- Sample260415-ynyf2aby6x
- SHA256 5454792d8f7813aad67795ffb48b6ba3742fbcad5ad7e95b3aa4e73accc032c6
- MD5 592a41340cd07568fe900b4e67d9a76a
- SHA1 5f195dfc5994dbc96b72bc65c3d417df517363cf
- SHA512 2ca00cc8ec350989dee19fd54d02816299c63eb986639ab5458bca5f2dc57510e045b8498f5a05457f0f1503594143191b0474d118c61b0d3bb121bd788c8381
- SSDEEP 384:Jic/7NlHRV3nP73SXoFn1EppMkm9HOKTUn2Q8a:Qc/7/HRRD3nippMH+n2Q8a
- TLSH T14A92E86A9D526C2616B3CB71EF53E200FF9541308E4B6265BABDF142AB40D7015E3EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3200 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207569642499304" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 3092 chrome.exe 3092 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5064 wrote to memory of 2032 5064 chrome.exe 78 PID 5064 wrote to memory of 4092 5064 chrome.exe 79 PID 5064 wrote to memory of 4092 5064 chrome.exe 79 PID 5064 wrote to memory of 3200 5064 chrome.exe 80 PID 5064 wrote to memory of 4216 5064 chrome.exe 83 PID 5064 wrote to memory of 4216 5064 chrome.exe 83 PID 5064 wrote to memory of 2604 5064 chrome.exe 84 PID 5064 wrote to memory of 2604 5064 chrome.exe 84 PID 5064 wrote to memory of 4304 5064 chrome.exe 85 PID 5064 wrote to memory of 4304 5064 chrome.exe 85 PID 5064 wrote to memory of 1248 5064 chrome.exe 86 PID 5064 wrote to memory of 1248 5064 chrome.exe 86 PID 5064 wrote to memory of 4236 5064 chrome.exe 87 PID 5064 wrote to memory of 3436 5064 chrome.exe 89 PID 5064 wrote to memory of 1204 5064 chrome.exe 90 PID 5064 wrote to memory of 3852 5064 chrome.exe 91 PID 5064 wrote to memory of 3092 5064 chrome.exe 92 PID 5064 wrote to memory of 704 5064 chrome.exe 93 PID 5064 wrote to memory of 704 5064 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Appraiser X\Tesseract-OCR\classifier_tester.1.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc483c728,0x7ffbc483c734,0x7ffbc483c7402⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,17082201346819200655,8354413559404231723,262144 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1952 /prefetch:22⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1432,i,17002654851938342502,13602746910549952399,524288 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2232 /prefetch:112⤵
- System Time Discovery
PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,6637090675036924212,8109173055275235581,524288 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2284 /prefetch:132⤵PID:4216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,15017582962387278878,2068465267999324308,2097152 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,10588398970250719718,17087519248162159009,2097152 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4356,i,16780714964300356348,3967793467007289411,2097152 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4372 /prefetch:92⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,10973423243873894458,13474995075174762432,524288 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5252 /prefetch:142⤵PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,13838386945229785211,3265527902041172068,524288 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5592 /prefetch:142⤵PID:3436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,7309888098930337355,7286454072320399196,524288 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5600 /prefetch:142⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,15098490198921529647,12704616340635818629,524288 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5472 /prefetch:142⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4992,i,5777311398194859127,2611104462504431518,262144 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=744 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,15684934873115611493,9737756531016302982,524288 --field-trial-handle=1956,i,16739244968025959279,327664098316009145,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5276 /prefetch:142⤵PID:704
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:764
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 9c699a8fab6a4eb3e202a891c7bbcb77bb6aaef6392ca234639fd24751a7c157
- MD5 f2ec651024d385edde12b45fbcaad008
- SHA1 112150480d1cdae5e97ea3fa549b27da081f835c
- SHA512 5d27566731c1cefd2c446f1218d9c1b2531d45186d88d168af91da2b81c84584a44d27fee8774d292773f6f5ffc4a5133a7950ac7ae66e74ce306869d3d5f75f
- TLSH T17DE02BE9EA31DC6B08FE07A860544B46F720136B3740984F3B3C910C4FB167F068686C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 8f07b5686a512c7d3e53727f13d5066524c2b179ceb32f3f344089287d17d490
- MD5 39e2e3796a40513adcc9eef42c1fb647
- SHA1 b79398743adfa5a95fdca57a74c32fe1ee42b7eb
- SHA512 5bd665659b8dcc1f162413fe7eb11916d4ffb6b5f49f0f12004dda6522e18e2328300706c74482bd298e20ff669a0cf263d5d806460dfe908c9f766b8da08eac
- TLSH T16D51C0F797F4867D861196F4EA106E2FCE6D0924031C7C6289E4AE1B43F2872D20038F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 b4c0945cc47b3699d239d28ed715c3a511d4799cba9dd1b561e39f795b8ef0c0
- MD5 0f4900f45903d587b57fa2a7f8389699
- SHA1 9ddd87076efab6aa3a249748f5cd5198a192ef5d
- SHA512 eaeadaad20e3598a72cffc45e94122fb377a7b76e82ee428b1c25fa09955f9039be6e6f19a9cae1005e5ccfca211c9173c8d81fe01ab06725d4cc97fda4583fa
- TLSH T18051DDB3C3E8997D881156F4AA246F2BDD7A0A14531C3C56C8D8AE0F57F28B6E21124F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 aad1f54a79a452224129e4940df065f533e87705d91422f91a05c6cdc219cd25
- MD5 abbc5aa150c3776a169a3f26ff747302
- SHA1 0636078d4560ee8d864f028cc534f005b1f158c1
- SHA512 61f5e5d020f8f4a7997d45133ed54af782b4d7e4c3f0c76880ca730bb26752068180920fce55977c27d6090cc326967405471d70d3cf07f889a064a34c0c1677
- TLSH T1B0418CF797B4967E851196E4DA14AE2FCE6D0924031C7CA689D4AE1B43F2972D20138F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 ef0762dc9d7f616d958dffa4bf4478c77760ce0797eb3fb112093ee62593a273
- MD5 45cd365863036ebb6c665cf283d92fe4
- SHA1 262f796e2f423dbf9129d3ba42db39c6e2cc4cf4
- SHA512 93f77e03cb9e52b64b46bcd0344f1a5e2d1c0b1e46587910ca58f375078dd03540e037b2785f50ad60fff1fae3f8bb7a8bdde9f94e6be015a93eb90576d872cb
- SSDEEP 192:2RstYrs8QOwYv7ApAPRp2eq9qHsb+WNnAHPhd3Ana8iVyIsnAUge:2RstMyEsUXS4wQPHCaFe
- TLSH T1B242D92EA918793B5CCBD22DFA61BB53E7F5102161842E98E7FC8A2C15E75CD2217027
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 de72efeb7fabbb083052843c2b69e1b1892e488dfa6488df0c27cb5f0a772e24
- MD5 11269f81f0a954a69164f68968417b33
- SHA1 7541a0d1c99e50f86b47cc11b1281a4729983009
- SHA512 7fe9c47bef5138e8451250eae673f03207a1f20c5a32d8477905349eb2e2a1212340397a1ba7064711eb6db901e4dd453ad07e5467d8ea08a94658fbabb39eff
- SSDEEP 192:2RstTrs8QOwYv7ApKPRpgeq9qHsb+WNnAHPdd3Ana8GVyIsnAUgE:2RstvyEsmXE4wQPbCazE
- TLSH T1E452E91EA918693B5CC7D22DF961BB53E7F5102161902E98E7FC8B2C15E76CD3217027
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
- MD5 e1d791f76039330e35fa0e1827d639ea
- SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
- SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
- SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
- TLSH T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 3684c4dd85e113e8ce4d60527c3e6aece423a59904ed1e414a0a3f9d0857303d
- MD5 699f2c28a3fd6c439a19ad97fde44461
- SHA1 b692b7e626c54eedc85ca90a60c4da74dc1b9b2c
- SHA512 32a47f9003625579c523b2247aba9f379469cc2ae70bf1ad8010b92755f6d216c0b21b0acf9e55962a825b5398245c6d5028b1e816f3aea1d72beb10c41883ee
- TLSH T1DAB0126084019642C04302F415925CC83234EF119B85170563E06AB298265D04028164
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586d9a.TMP
- Size 96B
- SHA256 b59ca2b9bab877b6aaafd55fb444dbc743eb285c31fd61a97304126830599a13
- MD5 8587eef5986ee7a2ddae8f5d0cd7493d
- SHA1 492884af44ae58647b88f99812f15113ccbae804
- SHA512 f32cc8f94899724a08bcb21a89ba539a2577dd3b0e7544cd3a79fe165ceb5018b919698091880f1f43c60279d1d5182d1c502f77d73b26bc622fc408abe9b29e
- TLSH T13EB02222C003A302C00203B02BE2E2C83020CF30CA03020282E00A2AEC38AA082AA322
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 3228e62a36c9ccabfb56176a7151451d317b612f0233c1866bb9e3e2af940f57
- MD5 bde0601ca9a607a00684b4ec91a1fd36
- SHA1 aae15b37b670aacf71a4a3cb77bb4922fe4b1cf9
- SHA512 0409f23237b24c4d483fb09dd2837adf45542d1899c41cff0d5963a50f1500fe13dbd00a1cf7efa1b09e5ac96c6c28ac94060a23474f7d8c8974581e3464076e
- SSDEEP 1536:VVw9P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:6++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T17B9302B9981E7D3913ABD2A6E0079CAD8CE398DE1114557C31C76F1E14AA393A30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 af72763f649f12ba9bd0d24f6f9c334ea55144f6d96e9336c11667be868ca322
- MD5 8a1c9104c87dc2203e84f411bc245e8a
- SHA1 801dd0df2e6840250023b5f091e2bf7840d673c2
- SHA512 93b7f5cfcfdbc810d02d6def6a742cc576f01a655f22d9647449936e00b3991c6bdab772f32ba92b5d22b5f2e08151aec75cbe04aba1ce572e1acbf3f5885d11
- SSDEEP 1536:gVw9P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:Z++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T1D79302B99C1E7D3913ABD2A6D0079CAD8CE39CDE1114557C31C76F1E14BA393A30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 132KB
- SHA256 08bb5750ea86650735ad76b79667e2fb4f50b956294493b024e1b2bd40be3350
- MD5 88ab26c7ad76dce8a4654a92747d5117
- SHA1 0e5eac2452538252c8e08c4bb8168d3061d1caed
- SHA512 35b797d828794f6d32547cd3a2871fd62c68f1ab6d77f13539665584b4e5994818fa9b0c3f93e8e1586b559e5f77bca8281693f9a403670e3e0c39b4bd22680c
- SSDEEP 3072:ifjNJlBuUYArHx++J3qUQm08KMWF0bFTcVHr6zT:if5xXtx++JjcMW2VcVLm
- TLSH T17ED31266DD2F2E79536FE6AAA0079DDD4CC3488D1015107C308B6AAF11BB3E763178A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 697a5a7c08045a1bc24391fbf2bdece172dc0f642925438e1003817aecf804db
- MD5 0f61d93db3c09e63d6a3080e480ae7cb
- SHA1 beb1177975b6d11735c0e684f57975f4f2087322
- SHA512 2f196654083e72d4c2a928e7e2884169a295c443f272a8e3fbad8657013ad7af89d94cc2591d4bce8ff7454afcd2814405037b9571e5d828d734c698106a66e7
- SSDEEP 1536:hZWP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:U++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T17B9312BA591E7D39636AC396D0079CAC8CE3CCCE1514557C30C7AB1E18BA393A31B8E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d6140409-80b7-4cef-a213-df9c217aaf7e.tmp
- Size 91KB
- SHA256 87f2307404685a6d770fd69a9bc57d01d24a001e00038e03ddc00cf381680664
- MD5 8e422a1ee47102e14256254e53ecf274
- SHA1 41e307c2d80c7634c41492d5f67509d132e9ee1e
- SHA512 6e96bfa49ad5884f4bcc6c229a1f607e7706772eaac176f5b397300adf69c1c7e73557cf254977be6042d60ddcb6447a29e645821001aa3317569f1c1faff649
- SSDEEP 1536:pVnoP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:Du++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T11F9302B9981E7D7913ABD2D6D0079C9C4CE38CCE1518647C30C7AF1E14BA397A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH