Overview
overview
7Static
static
3Hydra_1.0....up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Appraiser ...nd.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ds.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...es.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ng.exe
windows11-21h2-x64
1Appraiser ...ew.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ...ll.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ct.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ge.exe
windows11-21h2-x64
3Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...or.exe
windows11-21h2-x64
1Appraiser ...th.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...wg.exe
windows11-21h2-x64
1Appraiser ...b1.dll
windows11-21h2-x64
1HydraBackend.exe
windows11-21h2-x64
7Analysis
- geolocation tags
asiadelhiinindia - max time kernel
299s - max time network
308s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:56
Behavioral task
behavioral1
Sample
Hydra_1.0.2_x64-setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
Appraiser X/AppraiserXBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Appraiser X/Tesseract-OCR/classifier_tester.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral11
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Appraiser X/Tesseract-OCR/shapeclustering.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
Appraiser X/Tesseract-OCR/shapeclustering.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Appraiser X/Tesseract-OCR/tessdata/ScrollView.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Appraiser X/Tesseract-OCR/tessdata/jaxb-api-2.3.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-core-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-extras-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Appraiser X/Tesseract-OCR/tesseract-uninstall.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
Appraiser X/Tesseract-OCR/tesseract.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
Appraiser X/Tesseract-OCR/tesseract.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Appraiser X/Tesseract-OCR/text2image.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral23
Sample
Appraiser X/Tesseract-OCR/text2image.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Appraiser X/Tesseract-OCR/unicharambigs.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
Appraiser X/Tesseract-OCR/unicharset.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral27
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Appraiser X/Tesseract-OCR/winpath.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral30
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Appraiser X/Tesseract-OCR/zlib1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
HydraBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target Appraiser X/Tesseract-OCR/shapeclustering.1.html
- Size 18KB
- Sample260415-ynyf2aby6x
- SHA256 95391fb8bac0f788eeab08038c3cefd17a591c43555356a16a6350add59f48b2
- MD5 351555f81844b4f43729b9ba2234c0bf
- SHA1 a8b9cbcbca1fdf62a651de44f8409e5cca949bf3
- SHA512 d2ba177d5dc5aaf831e78d778ec402e79e23973056a8d1ebf79f79afad72ec6114a1c15fdb7cf64a7c00c0182fb20d70f7bf5c89be414fb172f69511e503f212
- SSDEEP 384:Dic/7NlHRV3nP73SXoFn1EppMkm9OE38a:Wc/7/HRRD3nippMOE38a
- TLSH T1A492FA6E9D92681A16B3CB71FF13D200FB9501318F4B6265BABDB142EB4097015E3EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1896 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207569913276074" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 3440 chrome.exe 3440 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 776 chrome.exe 776 chrome.exe 776 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 776 wrote to memory of 3452 776 chrome.exe 79 PID 776 wrote to memory of 2496 776 chrome.exe 80 PID 776 wrote to memory of 2496 776 chrome.exe 80 PID 776 wrote to memory of 1896 776 chrome.exe 81 PID 776 wrote to memory of 436 776 chrome.exe 83 PID 776 wrote to memory of 436 776 chrome.exe 83 PID 776 wrote to memory of 1308 776 chrome.exe 84 PID 776 wrote to memory of 3316 776 chrome.exe 85 PID 776 wrote to memory of 1308 776 chrome.exe 84 PID 776 wrote to memory of 3316 776 chrome.exe 85 PID 776 wrote to memory of 4976 776 chrome.exe 87 PID 776 wrote to memory of 4976 776 chrome.exe 87 PID 776 wrote to memory of 1140 776 chrome.exe 88 PID 776 wrote to memory of 3368 776 chrome.exe 90 PID 776 wrote to memory of 3660 776 chrome.exe 91 PID 776 wrote to memory of 3352 776 chrome.exe 92 PID 776 wrote to memory of 3440 776 chrome.exe 93 PID 776 wrote to memory of 3016 776 chrome.exe 94 PID 776 wrote to memory of 3016 776 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Appraiser X\Tesseract-OCR\shapeclustering.1.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa15b2c728,0x7ffa15b2c734,0x7ffa15b2c7402⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,4130986540462606675,10694717052346960896,262144 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2020 /prefetch:22⤵PID:2496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,12905205219371502070,6535307696067664238,524288 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2212 /prefetch:112⤵
- System Time Discovery
PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,16371605099843570983,7609705946151197978,524288 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2364 /prefetch:132⤵PID:436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,180998171022871744,9546614412353645209,2097152 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,9596239920839983568,1684134418132077210,2097152 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,10757513485673195688,17515827752354930557,2097152 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4260 /prefetch:92⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,16815377715874037066,5007450186328009389,524288 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5148 /prefetch:142⤵PID:1140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,16410572728724090696,13400599482277845483,524288 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5196 /prefetch:142⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,11883680305837236109,5843623372962863693,524288 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5492 /prefetch:142⤵PID:3660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,7753356113353761456,8302529118234330048,524288 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5628 /prefetch:142⤵PID:3352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5440,i,8249684868773236013,3680122327623665638,262144 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5600 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3708,i,15923301211306514476,5600043207835030569,524288 --field-trial-handle=2024,i,16545706223109045496,16251265656652455474,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3724 /prefetch:142⤵PID:3016
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 bfc844fcdf507d554db9f3afcd87ccbcb8e35ce1c58959b69483c176f8c25061
- MD5 6e8c1c20c67b0e8455dd69c9b788836e
- SHA1 c099d91bb0e939ef58cab500e46c1e5b551f6dc9
- SHA512 eae1b304d3e067d46e8a0c6bd1977c52b5ad9c18fd04ebdcd1da4d2772bba91f4457c03adde1c75bfea5818665dc0249ed9984233a97f1d02c089e75d0c61885
- TLSH T12DE02BAADC21D83719FE0B1960104B86EB60135B6740858B7A3CC10D4FB167B86D581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 8cbc2065573bee22746c4a53bf30e0261a8302c0f86e133a1c18c37c9bb1c644
- MD5 0054861c3e574c48af5df4f10fbadc90
- SHA1 fe338abbb3253b56fb1c8b47d8537d42a583391f
- SHA512 dc1e4f24473dfba21e9c50f7e4b9bc57df6a58c8c23f89491d45ea2428f81852ead9d334652ddaab92f67f6cfad8da8775155c8e5957097c2f4591c7c26975bb
- TLSH T19241AFF793B4957E851192E4DA15AE2FCE7D0525031C7CA2C9D4AE1B43F2972E10178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 1d3f81b8c1a9a65250ae9db541477b6d2127cfd71c382cd36d4db7d235a1e605
- MD5 5ba5816f1f6cf3fb6039b292960c3725
- SHA1 c89d2c32ad83a7cb1e2688546e9253e2ee4085fe
- SHA512 4966869207df4df6d239fbeddfc6fd34ea4f4861416014f5ef5cd570f4db449a68a802cd00b61f8e14645ed876035764733ad90e4698921972bd672c98b66529
- TLSH T1AF51CEB3C7E88A7D850156F4AB242F2BDD7D0A24132C3D56C8D4AE0F57E2CB2D21468E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 a4f0a87f02c4d3f8b252487931444db1b307574eb03bdc69efe52e42365e3798
- MD5 b1b77990d0196f34c8b0e8b1d87b2cb9
- SHA1 8dd2624c0162845a706edb62dad2a6f68652a637
- SHA512 122613ab751e60d0ef331473b1c63373800e4b823a5fe6823b3bccd504a44060311fbd6ff97f67a1727a3f9b3cf5ef3d671b39e28010052121177089ef916473
- SSDEEP 192:NRF8PuBYrsXBD/v7dpAPRp25L9ZHsb+WNnJpPP+2CBmV9C5WkwS0eCaVyIsnAUge:NR+PuBM2XpUXWHwPPm2CBmV9C5Wy0tae
- TLSH T17042B66EE914693B9CCAD229F9617B67D7F5102171902E84E6FCCA2C05EBDCD222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
- MD5 6c2a084e9725415d6e6f241570b51988
- SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
- SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
- SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
- TLSH T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 c233b3b3d53f78a7e19a8d5f9bc7f7e84e74cd42bd604678f64e7d370c02992b
- MD5 5dd009a70ea351d4761df134c59ddb6e
- SHA1 277d526247c66e519d13ca8499d24a0543bde586
- SHA512 c818936c8d7be3dc31f40ff4ceb5aa064bf4b46853b95fc8ad49599691bccfdb84fce36efa97d13d83b39bde48a6f21d714f76354593015a17b3161b1f8db454
- TLSH T17BB0125080C1DA11C10702F513C614C8B174EF658706230263E0A97598361924014151
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58addf.TMP
- Size 96B
- SHA256 27dfdcc0ff3a8709ce38c82bd397a15d1f3c8312fad758ece2cb4d1ec01253c4
- MD5 499a80b5605e2a44a1cc2a7a81b7f810
- SHA1 dd938d2d50d13ebda2dd57c6ce4c5df79d8d14fa
- SHA512 99e5c9be231384f7b7f8e757aa603db4eb1feb95d4b44acc97da9c558505706e51abafda848456f3a8cd3c2c4e001cc14e776bfc8ff2c147760b849e59696612
- TLSH T155B002D6C142A716D4C203B07995D9E8B960EF66CB13222692E42B6EDC2566185356A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 17c9c7a4a334dc1752e02756c268be810f9da780b3a0d5a926341746bc84f94c
- MD5 e539f8c7cebfa838b1d3f285eedffb82
- SHA1 bea6f2620a7eda2d5dab6f761aec4107a9c3863a
- SHA512 cf2214bcee42b2c450b6cad288dd76316c13177e319e6be9a0f773b3638a84c94c3d35ba45ed5af7ab76ed987561a24a8cf6e938d566da8b4fe66819fcbb4f82
- SSDEEP 1536:arxm3P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:8q++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1459312B9AD0E7C75236BD6A690079CAD8CE3DCCE1614157C31C76F1E04BA393A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 94f0e440f93171bf16d71f1c846bdce8b26e43ea76993deddb69fb8bd700636e
- MD5 3efb1ce9f0a310bccf5979c3fa8f568c
- SHA1 350e893e733791f71c962f2c33ea88393ce80e5b
- SHA512 e92dafdee35447e510b866713361bae2451b4f4d62993e27b87dd8e0898ccc9148af705654759227c9c6368898451f8a028c431cfbae28fba0953172e444a747
- SSDEEP 1536:eOP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:j++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1319312F9991F7C7953ABD6A690079CAC8CE3CCCE1514157C30C76F0D14BA3A2A35B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 132KB
- SHA256 76e735e122dbae5c9cd802d2f116ad038848e49f00462bebe168ef4b32906e97
- MD5 2da2f66103fecba0438daea6f0a71916
- SHA1 747b485ce244ca6558b0e2edf897a9c6dc62f579
- SHA512 a4cccd980870e92dbac8f5d714ac42d8c7cce3d62a1ca9c833bbdafd7ed05db3c50fa8a3ec87b53457eca9838073bf64f3a9f3477b1e50caea18453538ebfe72
- SSDEEP 3072:rIszeX6fGMf2WMCW3++J3qUQm08KMWF0bFTcVHr6zb:rIszeXC2WpW3++JjcMW2VcVLa
- TLSH T185D312BD991F7C2A937EE68690078C9DC9D1DCCD1804037A72DB6F0D18B5363A35BAA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 ffc13c6783430701bb3f2b1b7a9a17b2d39715ce52f459f70cb1fd39ae5019fb
- MD5 6963a2cf27dcbfcd99fc3510f609397e
- SHA1 8ea843d45f134fbb978dea1b1c850fcb1d660486
- SHA512 27edde23187895f30d19e36e54167da4dff6e524d8dbc2698704930c6e5a94de3cf6671966218c8a13c58e20992fe2329cb8c5faae9bfa624ed88b146e318d47
- SSDEEP 1536:Drxm3P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:Zq++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T13D9312B9AD0E7C75236BD6A690079CAD8CE3DCCE1614157C30C76F1E04BA393A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 8678e290995938484f24b9738911008a288ba17e84fa82a6218f19d3f77914a9
- MD5 660bcd0cc39b1e98d015619d96955b94
- SHA1 9188076563e38bcf4b67b5143fac77e40d3dac4a
- SHA512 68d6a4db0093ad02f9d757f068a79eaef6eaff8ba65fcb9af2b695ddb0db005bd9156faddf9ad58487ab4ec6e962afabac8b5283523cae678612acf4f4e5a6d5
- SSDEEP 1536:XhP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:Z++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1349302B9591E7C79536BC696A0079DAC8CD3DCCD111451BC30C76F1E14BA3A3A31B8A6
- MD5 SHA1 SHA512 SSDEEP TLSH