Overview
overview
7Static
static
3Hydra_1.0....up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Appraiser ...nd.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ds.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...es.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ng.exe
windows11-21h2-x64
1Appraiser ...ew.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ...ll.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ct.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ge.exe
windows11-21h2-x64
3Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...or.exe
windows11-21h2-x64
1Appraiser ...th.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...wg.exe
windows11-21h2-x64
1Appraiser ...b1.dll
windows11-21h2-x64
1HydraBackend.exe
windows11-21h2-x64
7Analysis
- geolocation tags
asiadelhiinindia - user interaction
yes - max time kernel
299s - max time network
307s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:56
Behavioral task
behavioral1
Sample
Hydra_1.0.2_x64-setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
Appraiser X/AppraiserXBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Appraiser X/Tesseract-OCR/classifier_tester.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral11
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Appraiser X/Tesseract-OCR/shapeclustering.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
Appraiser X/Tesseract-OCR/shapeclustering.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Appraiser X/Tesseract-OCR/tessdata/ScrollView.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Appraiser X/Tesseract-OCR/tessdata/jaxb-api-2.3.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-core-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-extras-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Appraiser X/Tesseract-OCR/tesseract-uninstall.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
Appraiser X/Tesseract-OCR/tesseract.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
Appraiser X/Tesseract-OCR/tesseract.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Appraiser X/Tesseract-OCR/text2image.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral23
Sample
Appraiser X/Tesseract-OCR/text2image.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Appraiser X/Tesseract-OCR/unicharambigs.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
Appraiser X/Tesseract-OCR/unicharset.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral27
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Appraiser X/Tesseract-OCR/winpath.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral30
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Appraiser X/Tesseract-OCR/zlib1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
HydraBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
- Size 18KB
- Sample260415-ynyf2aby6x
- SHA256 e5848c9eb844d9f4002b1bde9da6a373320e6ef31757e486103aeca64c26c5c1
- MD5 740f854f25912f1da00d2519ae41adf4
- SHA1 97e4f4e766d329a8c51658f73015e65e30b88b26
- SHA512 7a2a11c04491ac8c043191b97b01286c18ec8e77da0a1805a9e14ae356075a56166f9ef6174acbe1368ef6d961022064380a64793a0f4de8f0d9b54e7fa5f6fc
- SSDEEP 192:I25icth7o14c2mgjzapG9hAKFg7Ce+xgrXQto8npJ+u3S1VwMKhMsY01EppM9a7U:Zic/7NlHRV3nP73SXoFn1EppMkm9es8a
- TLSH T19282DA6D9D52682616B3CB71FF13E200FBA501318E4BA265BAFDB242EB4097015E3DDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6104 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207569494690277" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 3340 chrome.exe 3340 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe Token: SeShutdownPrivilege 5192 chrome.exe Token: SeCreatePagefilePrivilege 5192 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe 5192 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5192 wrote to memory of 2368 5192 chrome.exe 77 PID 5192 wrote to memory of 5624 5192 chrome.exe 78 PID 5192 wrote to memory of 5624 5192 chrome.exe 78 PID 5192 wrote to memory of 6104 5192 chrome.exe 79 PID 5192 wrote to memory of 5664 5192 chrome.exe 81 PID 5192 wrote to memory of 5664 5192 chrome.exe 81 PID 5192 wrote to memory of 3636 5192 chrome.exe 82 PID 5192 wrote to memory of 3636 5192 chrome.exe 82 PID 5192 wrote to memory of 5448 5192 chrome.exe 83 PID 5192 wrote to memory of 5448 5192 chrome.exe 83 PID 5192 wrote to memory of 3968 5192 chrome.exe 84 PID 5192 wrote to memory of 3968 5192 chrome.exe 84 PID 5192 wrote to memory of 2348 5192 chrome.exe 86 PID 5192 wrote to memory of 3556 5192 chrome.exe 88 PID 5192 wrote to memory of 5764 5192 chrome.exe 89 PID 5192 wrote to memory of 5112 5192 chrome.exe 90 PID 5192 wrote to memory of 3340 5192 chrome.exe 91 PID 5192 wrote to memory of 3540 5192 chrome.exe 92 PID 5192 wrote to memory of 3540 5192 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Appraiser X\Tesseract-OCR\set_unicharset_properties.1.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd43f4c728,0x7ffd43f4c734,0x7ffd43f4c7402⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,7459109743369142255,1663245168202995438,262144 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1944 /prefetch:22⤵PID:5624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,7387152931577858808,4716582133417639178,524288 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2252 /prefetch:112⤵
- System Time Discovery
PID:6104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,18048598339170274612,3695418034607964565,524288 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2356 /prefetch:132⤵PID:5664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,907293434234061334,11441877370207511363,2097152 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:3636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,4931005552980947254,176567091794878806,2097152 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:5448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4188,i,5619319508994208879,7510762963602678014,2097152 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4248 /prefetch:92⤵PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,41161500137574456,1987731495188687693,524288 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5248 /prefetch:142⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,14329025046195859735,10172234866485822308,524288 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5268 /prefetch:142⤵PID:3556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,3832636759078438103,7095343171559966531,524288 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5304 /prefetch:142⤵PID:5764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,9129789531662453966,7805457894407026775,524288 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5344 /prefetch:142⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5252,i,11139154066080830028,5722635865120620666,262144 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=996 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,10263913995424606663,11033986688374625343,524288 --field-trial-handle=1948,i,10371669573083593016,14287690623256666830,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4284 /prefetch:142⤵PID:3540
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 f0727feb74e3d12e6d6094730978747795e537345abc24fa3d3478f590dfc7b3
- MD5 1c26fb39e586d8377cf965bdf481f7f4
- SHA1 8a10fa3748a59bc5a7860618b9894f847e0cdb61
- SHA512 9aff5ac3f325428ae7ed35414dce7bc13a91c7ab38c54e513dd90870a14f2a9df84301dffd53439e7c6bcc1af431d0ae166ef53fc894061d57925cd8eddd0c49
- TLSH T1FDE02BBAC975EC371CFE071850904742FA5113A73740491B7A3D820C8F7463F0586C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 699b970d2e341b328de5f3dd8fa9f5a9e25cee33880971528ccd60b01870331d
- MD5 22da8d38b66e0cb5e9bffecacf8e2205
- SHA1 8baaeb15b10820dc8da4c4e2e4977d19146889d5
- SHA512 445912a959399fea0312a227264098464328f8763bc62dd5e9d6113598487f9c6a1c589c49d989f91703ee9bfba7dbbc8f82fb9968a08012ee2ad5d085eb2557
- TLSH T1DC41ACF793F4997E851196E4DA24AE2FCE690524031C7C62C9E4AE1B43F2973E20139F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 e17f28ff72fc43deeb7a46b207911ecded2f0237e6dad41f6137e5125b108d07
- MD5 13494d476f9dc193d7c4d508166a1430
- SHA1 462c01d02dc3358150bda54a3587ca0c8f5e5747
- SHA512 6f25a16f64e37ca44ba38c6bfafd2dbdc131464978a45628e8f3b46a95b60d41200a583f8c7c1f40898878c7a4bd5b84a60fe310dd3ad1211b9c6d89f2a92d67
- TLSH T15A519CF3C3EC997D890156E4A6256F2BCD790A64535C3C57C8D4EE0F93E68B6D200A4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 29b5715b2eec1fd90607c88a32dccc683747551641764992996e17c0495aaba2
- MD5 c50b52d0db248340d7cfb8f67eb8096a
- SHA1 eb7049520207f8b4bde87718d8fcfaa86109ab33
- SHA512 882e7f828d7638b5d27042fd355dd2521502f3592d293ed80a76b889e89beb0bafd5b61f02b1cc5dcd227099ce6fdd07fddf211925806057945cae4f78908a45
- SSDEEP 192:zREWYrsyEvFGTxkQv7+FpAPRp2Lr9hHsb+WNnr+PNklUecBcSF+yVyIsnAUgE:zREWMdtkM6FUXIbwSPylmB9E
- TLSH T12242C77EF91469375CDAD229FE617B57E7F2103260901E84E6FC8A2C15EB9CD612301B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 21ab6282eb48505ba172ecb2efec0bc33a4dd5752f9f1edb3991398ba4ba0523
- MD5 261b01b9da80d37c6c4e0dc51655d152
- SHA1 b020bc253ac85ccbf99cfec1cd69ed7c13580fb6
- SHA512 608e1d935631feaa70a356a338c3b95861b66fd27d02d27ae179248a2b4e09b1e401daec6c9c6dceb2d3c9f28b8bbb6e9617c94e8d1ab6b6b712182a7d28a555
- SSDEEP 192:zREWYrsyEvFGTxDv7+FpAPRp2Lr9hHsb+WNnr+P6klUecBcSF+8VyIsnAUge:zREWMdt76FUXIbwSPTlmBHe
- TLSH T1F142C67EFA1465375CDAD229FE617B57E7F2103260901E84E6FC8A2C15EB9CD212301B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
- MD5 80e775e497e26256725722f158c1a7e7
- SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
- SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
- SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
- TLSH T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 0bc9eb617bb1295e8e0cce7ee8d47f3b81f5a1199c619afe31e33fe15a2259b7
- MD5 f7628266b239b6d9e91366c2cc600508
- SHA1 9a809de4a02f97f1005c4c726ce6058deeb5e4ea
- SHA512 df9b12a2ae5af14901449ae66ac84b0037a02ddd22bedb95b17f7a637ad5521f258e3af465569feb9bc45e15f2f2de2df38369b87fce66f3301ef60a88d585ec
- TLSH T1A8B0129080019512C01303F41282049C7558DF209B0A230553E06971A82A2A04015250
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a534.TMP
- Size 96B
- SHA256 27e264686ee8487b42f9a526852129f7360b36fb98d4aa68e7a57e64dced23cd
- MD5 c63946e9cfcc2d0f9e9c2bc7744a1dc7
- SHA1 2931f9639de9c4a5288c16a31a5a071546221f21
- SHA512 ee974150c2203433ac7cc34bf86de2b7d5c60b9e7f2ce815b5a3501750878ec3be06e54830f68e0dab02a10da22d0688056566ea742fbe20581aa56ab77dbec6
- TLSH T1B0B00255D503F312C0424BB029D595D971B8DF3AC603521AE6E05AA6DC256E0463AE60
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 124KB
- SHA256 168b3efb129e22cadee79ecbc9dcb694b9cc97a14737af3f6b44d677178011a9
- MD5 255b632fd84ee8f5d639367ce6f6c016
- SHA1 e3837173bb613a17f5bcadd0f2f0e6f86d991684
- SHA512 45e8520394460215510209b03a08a45bc23b6497c91b0f005cb85a820d1e7a2a27adcb05d8f6c63f13f0ec4b15aa3503aa573c45d8f6872776cf0cc5a51e505e
- SSDEEP 3072:76Urc6//pC0kNdKw++J3qUQm08KMWF0bFTcVHr6zD:79GKw++JjcMW2VcVLK
- TLSH T1D9C312F55A2DBC3613AEE5AAD017ADDD4CD3CC9F501865BC30D31B4E106A787820B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 8847d7f6d82fd67df209534f2775e2d89bc635028cd19f51e74ee1f316aa0e92
- MD5 1b237dedb9ba3fdc33c041530a1e59c4
- SHA1 583bb4b8599bc035a934e700c2bee078af854c19
- SHA512 4dab80b27e57c2c64bfa7a920315278c5a20b38c490477df872db2080568c20251e7709e9c95949fb4a1bbe8985af99909baa18f5930e7b30923fbaadbe947dc
- SSDEEP 1536:lGDiP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:0I++J3qUQm08KMWF0bFTcVHr6zD
- TLSH T15E9312B9991E7D3563ABC7E6A0079CAD8CE3DCCE1514117C31C79F1E14AE392A30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 c3fe8aae74a0fd6ebc3f012e03f16a12c83ae778399c83096272dbe202f872d9
- MD5 289479e8b04993da9b485e7d2374896b
- SHA1 9fd5f2f5fec06513ebd522dd310e26e034ac9e09
- SHA512 50d4c99715aaa8d9d9fc50ae65b107abc8736a04dc5b47d9d6c40b5baf43a44de719b5c23746b1b7f43fa355c6b06b929f517d6307ceff99ff33d82b157ced67
- SSDEEP 1536:2GDiP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:vI++J3qUQm08KMWF0bFTcVHr6zD
- TLSH T1DA9312B9991E7D3563ABC7E6A0079CAD8CE3DCCE1514117C31C75F1E14AE392A30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 23bced21d2a9984947908a37c1e9719a5753f9c639677948317e9db81058014d
- MD5 2d98918e7050332fde3ef8dc99b2ce91
- SHA1 f3da7f030d5576c55a4456a93064893094b76ab7
- SHA512 2425db7eec4a846dbcea519adbae33a2233df2a71a3d4ee36fb979a6b1bd9e5cb16196dc1f8f5558eeae97c74658813b977ac0a138caf349cbca1238903ad4b6
- SSDEEP 1536:lGsWPP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:7W3++J3qUQm08KMWF0bFTcVHr6zD
- TLSH T1579312B9981E7D3623AAD6D690079CAC88E3CCCE1518217C30C76F1E14BA393D31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 9c3ac27d1319df076c3004e5ba6279bb5aa51501d0f455ed218ae2695aa41e5c
- MD5 0f405d29e9ac84053445573f024072e1
- SHA1 81a99ba6b95022bb21283c51109ac4b11ff93d6c
- SHA512 5e4bc75fd51429521f3616aecd9aa2690eea1e55cc15f250dcbd0f51285f2c02cf1500443fe308dd48177559b8936e7722f8b8c4cf0222c75b40224ffc3081a5
- SSDEEP 1536:eGqj0P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:2K++J3qUQm08KMWF0bFTcVHr6zD
- TLSH T1D79302B9991E7D75636AC6D690079CAC8CE3DCCE1514117C30C7AF1E18BE393A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH