Overview
overview
7Static
static
3Hydra_1.0....up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Appraiser ...nd.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ds.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...es.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ng.exe
windows11-21h2-x64
1Appraiser ...ew.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ...ll.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ct.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ge.exe
windows11-21h2-x64
3Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...or.exe
windows11-21h2-x64
1Appraiser ...th.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...wg.exe
windows11-21h2-x64
1Appraiser ...b1.dll
windows11-21h2-x64
1HydraBackend.exe
windows11-21h2-x64
7Analysis
- geolocation tags
asiadelhiinindia - max time kernel
300s - max time network
291s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:56
Behavioral task
behavioral1
Sample
Hydra_1.0.2_x64-setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
Appraiser X/AppraiserXBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Appraiser X/Tesseract-OCR/classifier_tester.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral11
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Appraiser X/Tesseract-OCR/shapeclustering.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
Appraiser X/Tesseract-OCR/shapeclustering.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Appraiser X/Tesseract-OCR/tessdata/ScrollView.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Appraiser X/Tesseract-OCR/tessdata/jaxb-api-2.3.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-core-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-extras-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Appraiser X/Tesseract-OCR/tesseract-uninstall.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
Appraiser X/Tesseract-OCR/tesseract.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
Appraiser X/Tesseract-OCR/tesseract.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Appraiser X/Tesseract-OCR/text2image.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral23
Sample
Appraiser X/Tesseract-OCR/text2image.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Appraiser X/Tesseract-OCR/unicharambigs.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
Appraiser X/Tesseract-OCR/unicharset.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral27
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Appraiser X/Tesseract-OCR/winpath.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral30
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Appraiser X/Tesseract-OCR/zlib1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
HydraBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target Appraiser X/Tesseract-OCR/tesseract.1.html
- Size 41KB
- Sample260415-ynyf2aby6x
- SHA256 bf41994d01d89e7082bb35c7b0fa4f5d6dcbf368ab35829b4d0098421f19dc01
- MD5 2f3e9258df15e5c341a9dea90c80d269
- SHA1 ad46cc5002d4aeb8873d44df04452194f36f4f99
- SHA512 95aa44e8821720238fdc1e83af24a5c1b506ff3d6673b8043f3849f6e090173eb0c816332adeb5137deddd4cd6334b929d4fe76d8d24007e320bc8b73ee03676
- SSDEEP 768:hc/7/HRRD3nippMCfPFtUcbUZ08kD3wsajK:u/HRVXiICfPzb2hoAfjK
- TLSH T19213C6669541AD1E0D7382B29A15931FF69D91ACFE0B81C035EEF2B39B44C6016B3F9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 892 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207569473776769" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 232 chrome.exe 232 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe Token: SeShutdownPrivilege 5888 chrome.exe Token: SeCreatePagefilePrivilege 5888 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe 5888 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5888 wrote to memory of 2252 5888 chrome.exe 78 PID 5888 wrote to memory of 5368 5888 chrome.exe 79 PID 5888 wrote to memory of 5368 5888 chrome.exe 79 PID 5888 wrote to memory of 892 5888 chrome.exe 80 PID 5888 wrote to memory of 3592 5888 chrome.exe 83 PID 5888 wrote to memory of 3592 5888 chrome.exe 83 PID 5888 wrote to memory of 5208 5888 chrome.exe 84 PID 5888 wrote to memory of 5208 5888 chrome.exe 84 PID 5888 wrote to memory of 6108 5888 chrome.exe 85 PID 5888 wrote to memory of 6108 5888 chrome.exe 85 PID 5888 wrote to memory of 5352 5888 chrome.exe 86 PID 5888 wrote to memory of 5352 5888 chrome.exe 86 PID 5888 wrote to memory of 2568 5888 chrome.exe 87 PID 5888 wrote to memory of 1352 5888 chrome.exe 89 PID 5888 wrote to memory of 1840 5888 chrome.exe 90 PID 5888 wrote to memory of 4592 5888 chrome.exe 91 PID 5888 wrote to memory of 232 5888 chrome.exe 92 PID 5888 wrote to memory of 5304 5888 chrome.exe 93 PID 5888 wrote to memory of 5304 5888 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Appraiser X\Tesseract-OCR\tesseract.1.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde5b1c728,0x7ffde5b1c734,0x7ffde5b1c7402⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,7825347521144414784,12115369768354228426,262144 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:5368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,14925840927562656377,17606389772107916047,524288 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2256 /prefetch:112⤵
- System Time Discovery
PID:892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,7094651830638081737,2351376220124515162,524288 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2408 /prefetch:132⤵PID:3592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,16772996946743185460,11986579589037009947,2097152 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:5208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3100,i,16978942483721095868,12510651796301967706,2097152 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:6108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4188,i,500380203358825339,15371430043403421866,2097152 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4216 /prefetch:92⤵PID:5352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,15411172186082760785,13045954149020485843,524288 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5208 /prefetch:142⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,2330274226414622816,2773598011013993319,524288 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5244 /prefetch:142⤵PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,12509238813273286907,1933775461818652402,524288 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5528 /prefetch:142⤵PID:1840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,11165479658978152143,5845086309548557378,524288 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5524 /prefetch:142⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5420,i,5452259805388005686,1638174426251772082,262144 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4316 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3808,i,5816683505705525750,5118192459909594585,524288 --field-trial-handle=1940,i,11681158069949221126,13348477821780465737,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4276 /prefetch:142⤵PID:5304
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 fa934749ea265639b4499d790043727d3c42eea93cdc4c84de7139aa82f6b2a0
- MD5 e3019be2900ed8286303b82e2904adeb
- SHA1 1edcdeb60d1dd052a877c918c33c2c8e5d4bae23
- SHA512 8070603d4b6c7491d08faa4c6c0d63dad410975f1e90952463032bee5841b5d093dbdb55b2fdf258d8bddc79f941ed7e2d58338b44b476c311ebfb458d73490c
- TLSH T19AE022EEC821EC2B18FD0B1C60514B46E6281B6B2B90898B3E3C81098FB563A05DAC5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 ab03a04220a0ae5def8045835de20f9f24f0228607980d013c92877ba23bebb6
- MD5 7b12f458b20af1d2fcae02055d62b415
- SHA1 7923d0dfe0d23b646d8ab8a0d4a0d79cccea6d1e
- SHA512 016b8c9cee26ad3037bca63a8c6a43c89f96e8c7b625e22d995de6f0b07b86a819007b29bf9523d79490db554295d7712aca2b003d673b2f098893c7fc1b4a27
- TLSH T11B418CF793F4997E861192E4DA14AE2FCE7D0524031C7C6289E4AE1B43F2972D20178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 dc4378e0630e79a42505483c869dd084e652726651879d7b753528f181438459
- MD5 83ad9df4c573efd79b9a2362a96b3bda
- SHA1 41e03cadd3fd059feb67c7524ad31ae0726c4cfb
- SHA512 86ce8a3d154bc8b49c1990b312dc0930b7c7eeddaa02aefc3609f6a9f6efa4902d353e1cf803159fcc36a88fe07a46d8b1a8d07d94120a5f762a532eb0c64565
- SSDEEP 192:xQRmMeYrso9XhQv0Rwv7XpAPRp2uv9BHsb+WNnG4PRW4aacny5+VyIsnAUge:mRmTM9Aes7UXrDwNPnaE2e
- TLSH T16942B82EAD18293B9CCBC329FD217B53D7F6102161942E98E6FC862C15E76CE621B017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 b348ef89a2004de3932b2d422cfbadcb8511ef1f7a57517647d45e46cced5182
- MD5 b0d1f07abc4aceeca25ae213a8bbac55
- SHA1 a12bc0ba5cc6482694c623f530bb61f84aa919e1
- SHA512 31718e2157284309c07a2a635a298c85d9a7fbefa24d929b57b0b42e496770d473b3856a02414740260339a70352d551dfa116ce6cda0e72e227cf4c48e62db6
- SSDEEP 384:4qj0v7KxkXqKf/pUZNCgVLH2Hfgsl0X7pLuLcifa7XOD0z+ErU3W8HGWTStBdUV:460v7KxkXqKf/pUZNCgVLH2HfgsyX7p0
- TLSH T1AE72F867AC4C9A770F94C6CDDC26BA4FADB5024B65DD886483FB581903C5BCB110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 92925de0a1401499f5bfd010704a4635672d651d37ef548fe93cc8f5608ed438
- MD5 b6fa0497203323b1ecf787cbe9bc128b
- SHA1 3c19baa16179bd7222c51efa9c6cfc4a77d10d24
- SHA512 1451ddc5816aa33c73dd4fc71d542d7c5e653e2c564cedc47d112e81819ab7cd2d56b0c3ae65fdbc9390abe31c3abf4024366a80bd43846821f7eba1688c7bb1
- TLSH T134B02200C3822222C00203B030AA80C832A0CF30C203030283F00A22ECA823302B0030
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 8b1326f0e3c2514866b9fa390a26fbfa9438f6556bb48dbf38288fcd47785d5d
- MD5 feb3c89a4510bdc647f6967ab6de2fd7
- SHA1 42af213d73dd3e732cba6f3a037c01c279812561
- SHA512 af04dd153f13bbc98e37b03c2635dbd4e2fd658b07c134f1b5bb9c20775c9ae23c8b4678e02840aa20d0bc0cd4f24633e7a6ff8b26c63c070f6d2f1e8d03a76f
- TLSH T180B01260C0019701C15303B115C2049931189F30870D130353F069B1D82A1E14514360
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 124KB
- SHA256 3de3c40edb7609112607ca36c38fb62cbfe846de3bc7f1f950f6f24215c1653c
- MD5 f1572f7946fbef0cc9df37cc55fd6d19
- SHA1 aad70f7287f701bc1f42ff33b53d85a1737a91f5
- SHA512 2e3e0f11f7a228cc3bc789856c15f761ce5394922952ffe556185e840af1d8f065a8ca20a962e076c978736f2ef35ff5b26ed3c9b97c35466bc44a59c1fd1f65
- SSDEEP 3072:f86p8PU6qcCYlhHoqiI++J3qUQm08KMWF0bFTcVHr6z2:Esr6IEGI++JjcMW2VcVLL
- TLSH T1DBC312F4281E387843B996D5811BAEBD4C93DCCF6708453C31866F1E05BFB92A35B895
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 4235b262ab117748275d24c09c871bc6fef66e211c5c941394a92051742c8d38
- MD5 d14ea005c861243c0a3f6ab48f597d38
- SHA1 f336e392d6a8e62f3c7f3ee26832abf8ff634c54
- SHA512 01c876bc0da30c1394bbfe38c28e480393054c2c1ce0e627097a315751cd1eafe3896b7a95966f5539c720c79927e5be5bd45420169a738348c2fc162d92aaed
- SSDEEP 1536:yP/qbP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:l++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1839302B8A91E7C7953ABC69690079CAC8CE3DCCE1214157C31C75F1E04BA393A34B8A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 1d4e70afb13637333bc37ef98cc40dbfe926d61453c6b53556856f8e7a453a5a
- MD5 e4494c4dde5ba570d6a5aae5350e06bc
- SHA1 3981108a64acd29280a1852019ee1ba580b1e4b7
- SHA512 b00cc9c14a71b2171a6133bf66ac1e74f8bffafcb73ef7529af496b06bb5556c2f6443bc7a9f34fb9edbfaca6d1e2c197718bf2d98bf676a3ca328f27055dd17
- SSDEEP 1536:eP/qNP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:P++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1559302B8981F7D7953ABD6A690079CAC4CD3DCCE2618257C30C76F1D04BA392935B8A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 af60c8b63add0b0390a6313a1948c956cba8704aec9b7d3d93c175eadcab3684
- MD5 e31628e9a105d0998aaa1ae2799783c9
- SHA1 a4cfaae2eb1de0633ec83ec4a5585ef3a0940ceb
- SHA512 3c3820a9bf1af13174f9371b440dc0252bd8c16e170668115c1ec7c56a60cd4af3c1079ce9a389c706410f440b2e68a859d6a7f6ca1810ac483e9463fb7a4652
- SSDEEP 1536:BP/qbP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:g++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1899302B8A91E7C7953ABC69690079CAD8CE3DCCE1614157C31C75F1E04FA393A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 17a9387502835695a8c612a5ef103fc2995759671efedab71a447a31fdd825c3
- MD5 04434db0bc70973e3faaff460ccc8729
- SHA1 d8d9a24cf3ec0d9d48845fc4f1ec638cec8e6659
- SHA512 6ce4a0638114e3de2a79d983452969dd383d4d6be95665b27471f630fdbee0474b5f49e9658d90c7b210b3e3c73fe73bc267d4a8b42322555106fa8438e8368a
- SSDEEP 1536:aP/TuP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:1++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1DB9302B9991F7979536BC6A690179CAC8CD3DCCE111421BC30C66F1E18BE393A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH