Overview
overview
7Static
static
3Hydra_1.0....up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Appraiser ...nd.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ds.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...es.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ng.exe
windows11-21h2-x64
1Appraiser ...ew.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ...ll.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ct.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ge.exe
windows11-21h2-x64
3Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...or.exe
windows11-21h2-x64
1Appraiser ...th.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...wg.exe
windows11-21h2-x64
1Appraiser ...b1.dll
windows11-21h2-x64
1HydraBackend.exe
windows11-21h2-x64
7Analysis
- geolocation tags
asiadelhiinindia - max time kernel
300s - max time network
303s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:56
Behavioral task
behavioral1
Sample
Hydra_1.0.2_x64-setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
Appraiser X/AppraiserXBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Appraiser X/Tesseract-OCR/classifier_tester.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral11
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Appraiser X/Tesseract-OCR/shapeclustering.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
Appraiser X/Tesseract-OCR/shapeclustering.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Appraiser X/Tesseract-OCR/tessdata/ScrollView.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Appraiser X/Tesseract-OCR/tessdata/jaxb-api-2.3.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-core-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-extras-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Appraiser X/Tesseract-OCR/tesseract-uninstall.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
Appraiser X/Tesseract-OCR/tesseract.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
Appraiser X/Tesseract-OCR/tesseract.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Appraiser X/Tesseract-OCR/text2image.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral23
Sample
Appraiser X/Tesseract-OCR/text2image.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Appraiser X/Tesseract-OCR/unicharambigs.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
Appraiser X/Tesseract-OCR/unicharset.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral27
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Appraiser X/Tesseract-OCR/winpath.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral30
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Appraiser X/Tesseract-OCR/zlib1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
HydraBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target Appraiser X/Tesseract-OCR/text2image.1.html
- Size 25KB
- Sample260415-ynyf2aby6x
- SHA256 65dd8b72ee345e7ea95aa24c932fd1534d83e764b74f1ab459475f5898876c1a
- MD5 20d6fb679e0ef7d899a31f6ce677ceae
- SHA1 c5df16884f7812fde766f2a2f49e4d1dd3370ae0
- SHA512 a5209f36029250056a33d2de4362390065990a8f0ad41dbc1d981da697445670318bec26261e21410b38f846bca9a77b3393aa9d09b939d0b2fbebc4f9dd91c7
- SSDEEP 384:mic/7NlHRV3nP73SXoFn1EppMkm9mSVyfZU89QJqE4zVNVJb7a8a:tc/7/HRRD3nippMm2WQJqE4z/VJb7a8a
- TLSH T1A3B2937EA9427E1E05B3C7B2FB669200FB9241345E0A7365B6FFB1539B44D6001E3E89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3744 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207569467131748" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4436 chrome.exe 4436 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe Token: SeShutdownPrivilege 4760 chrome.exe Token: SeCreatePagefilePrivilege 4760 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe 4760 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4760 wrote to memory of 1944 4760 chrome.exe 79 PID 4760 wrote to memory of 3684 4760 chrome.exe 80 PID 4760 wrote to memory of 3744 4760 chrome.exe 81 PID 4760 wrote to memory of 3684 4760 chrome.exe 80 PID 4760 wrote to memory of 3540 4760 chrome.exe 84 PID 4760 wrote to memory of 3540 4760 chrome.exe 84 PID 4760 wrote to memory of 5036 4760 chrome.exe 85 PID 4760 wrote to memory of 5036 4760 chrome.exe 85 PID 4760 wrote to memory of 3256 4760 chrome.exe 86 PID 4760 wrote to memory of 3256 4760 chrome.exe 86 PID 4760 wrote to memory of 2288 4760 chrome.exe 87 PID 4760 wrote to memory of 2288 4760 chrome.exe 87 PID 4760 wrote to memory of 236 4760 chrome.exe 88 PID 4760 wrote to memory of 4492 4760 chrome.exe 90 PID 4760 wrote to memory of 4396 4760 chrome.exe 91 PID 4760 wrote to memory of 2156 4760 chrome.exe 92 PID 4760 wrote to memory of 4436 4760 chrome.exe 93 PID 4760 wrote to memory of 1324 4760 chrome.exe 94 PID 4760 wrote to memory of 1324 4760 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Appraiser X\Tesseract-OCR\text2image.1.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1b52c728,0x7ffc1b52c734,0x7ffc1b52c7402⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,3572981189039711179,6698170229054079117,262144 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:3684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,16385226120665729805,10425287093254547909,524288 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2052 /prefetch:112⤵
- System Time Discovery
PID:3744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,2096453753151450878,5877949762145961528,524288 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2496 /prefetch:132⤵PID:3540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,9841264917046446576,10645130157435253593,2097152 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,14652730250224387848,15712555460261207697,2097152 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,5502498814380603135,10772409357238089258,2097152 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4224 /prefetch:92⤵PID:2288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,15777260059959887467,18373221818862612952,524288 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5124 /prefetch:142⤵PID:236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,2348322730202909168,16499076442125977336,524288 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5468 /prefetch:142⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,11195345503496790585,4992321973579277743,524288 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5488 /prefetch:142⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,2507146351697356885,10490450975120234642,524288 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5564 /prefetch:142⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5436,i,5866289505042473689,11753974002690975434,262144 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5412 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3840,i,2325699390310667447,7578567074640817633,524288 --field-trial-handle=1940,i,2307832015687037545,16259865772350786664,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=988 /prefetch:142⤵PID:1324
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 62c1b914f772482828cd12cce9c7230c416682c665ff550aa4b8287fe628f257
- MD5 3c51da31c43849069873a55122a95304
- SHA1 d6faba385f640fc1f7f5c40c57ddf195e2addf85
- SHA512 d4f73227711d41287c804b1d42cb9cf5b84e48760318727f7dd80e5ed4c88cb1aa32a01b55ce2b271e3ebfdcd3c63cd069b4aa86735e45f777db858007569d61
- TLSH T10EE02BAEE971DC3709FD0B1860504B47F661136B2B50941F3A3C850C4FF1A2B854186C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 7692de6dd8bb8c0dfa480ca00902f79cef4d9cf301aace1872ce4d8595676183
- MD5 344dfed3a08024981c2f0a68e67b3a2c
- SHA1 0a46493012834970db09ce2e453a00ad2d5806c5
- SHA512 34bccc29c52e3a436eed027a995fd08fa242dce33a36694e3db08c02b0ebcbad10163ebe6304da82a91b07372bd96a66254b0dd8cdf5eead01258493b1dc9076
- TLSH T17C419CF793B4997E861192E4EB156F2FCE790524131C7CA289E4AE5B43F2972E10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 83e8a98a6283047eecaf1d498874a677713810c2bd9193d7353c7102b39f6a78
- MD5 78a351626ad9805501048d3f61372fdb
- SHA1 632636dcaf8aff9a2c874227cf3cf36f3bc6d101
- SHA512 2face7ff9aad8175ce7035beea643b6e6b4b7ef483fc01a75a395613a7c961c1ce8315da9cfc723f294ef9247d2aee7b643f910a2d8efd3d8706874258f2b8f3
- TLSH T10C41AFF793F4857D861196E4EB156F2FCE690524032C7CA688E4AE1B43F2972E10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 725674741ccf97a1f42ed9a2d7a8e79750809a9717ffa739d92537e96ca99776
- MD5 879525760cf299d993bf0162d6059adb
- SHA1 597a0d30c3d59a52be0de19ab817b99bac152687
- SHA512 cb092105365da38ffeebf691a814eb6fa42f46c1187a2a7979564cf27d81cc2a32849a1ca5e1d640dcb237f104055e9aa89ca7fb7f462a2b48e065d81133703d
- SSDEEP 192:NURItYrsQ1dqUv7HYpAPRp22l98Hsb+WNndXPcMeUbmZau+VyIsnAUge:aRItMQQEUXd6w1P1Cau2e
- TLSH T17842D72DAD14357B9CCAC22EF922BB53E7F9242161D42E84E6FC8A6C11DB6CD2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 bb8325a13fb776722a6c1d85d70f71d51d2d7dd0a39efb1408a7b90e6822736b
- MD5 b0303eafb30bcad77d654b5fac96f29d
- SHA1 0e3d69560cb8479b20b8cc15649a3ac2f9921d5b
- SHA512 58ef2c31eaf3b17ce78f6e089af44c9acea605e9f5c03381d082917b03e89ce2062b38882d6326dfec0e4aff4e6234ea5558f087cef7db9d4f8e035d6ae66504
- SSDEEP 192:NURItArsQ1dqUv7HYpdPRpd2l98Hsb+WNndXPtMeUbmZai+VyIsnAUgE:aRIt0QQETXE6w1P+Cai2E
- TLSH T15052E72EA914357B9CC6C22EF926BB57E7F9242161D02E84E7FC8A2C15DB6CD2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
- MD5 40aba898dc4efcd9988ec53e06a8b15c
- SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
- SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
- SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
- TLSH T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 685c6a8d2d62ae06fcb5a8286b643823432e24811900bbe79493507f93f5d7c4
- MD5 3e5013819e96232a0560997672fbc7fb
- SHA1 d85879cdb3862e6a91af16bf6b61e9effd8cc985
- SHA512 b6c6d0c3f70307480683a55dfab6643826115519dca1c4cdcd4baf11ed8280fd822c4a19dec172b1664f85e08ab07c7c2c82c4ebf7dc37489a8ce9374e7f994b
- TLSH T1B3B01291C8419501C00302F4118244D8B115EF268B05274597E07A7198262A04014290
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58df30.TMP
- Size 96B
- SHA256 4aa8eaabc31e71805daaadab6dfbaf86d0685ef5d72f8165f8e01324b864b098
- MD5 b74cd6df81f552aca844d77addfef65b
- SHA1 8c23066b0436d444ef5c15bd68ab91ca63ecb68b
- SHA512 7126131078e80dfb1c524866d95b8a6ac0801f834d99d7764e0dd1dad74597530d470bf625077e6325a5f981e9b443ed603dd76041b4bb5ed74660894fbe388a
- TLSH T1FFB00256C142B212C04343B06DE595D87561DF39D7472217B2E51A67DC296644635660
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 98409fea7609b9a0c807b2b5851d853924b79b60866c7b4ac44de0937f7eab01
- MD5 29245539cb4e9d0fedc17c686be56686
- SHA1 dcd5530c42f8eacddc47e94393880e8f53d15285
- SHA512 48d7bc04ba779a24acf2746a8da493bb269c4bbe8709fedf4ef176c59418a36ec7fc5776738abb97925dc50e250837124a720164746388607ed6081dba47d877
- SSDEEP 1536:hSwwP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:32++J3qUQm08KMWF0bFTcVHr6zf
- TLSH T1AA9302B9991E7C7923ABD3D690035C9D88D3DCCE2518247C30C75F1E14BA393935B8A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 124KB
- SHA256 890026d327e47c0f29ad2f96fcd68b7f16704bdc5bd64c018be4b54004c77363
- MD5 ed9d0e11f5c01393f4a48c34186c07af
- SHA1 f0956d6b0cfdcc9b9a96c649b3855e6b510600b3
- SHA512 9bc73baba37fcca70fa9be7c05d8b58e5d6f093c2228fd5c9193aaec7961054dcd89d9a016eeacf7af21ca42c40dbdb36175993838907dccdb356145386668a1
- SSDEEP 3072:S9umGv/+k++J3qUQm08KMWF0bFTcVHr6zf:S9Y3+k++JjcMW2VcVLu
- TLSH T1ABC31271951E7878835DFBD8D217ACE88CD3E88D2601657C30865B0E04EEBE69327CE6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 cf23eedb29137ee761c5e8a6be35e169635184a0aac5a67b05443d2ff6d30119
- MD5 dfcd48141f5c5286b8e4c790aa1404c5
- SHA1 5ed3fecff7f541e8bb4bd47158dca44ddb4ab275
- SHA512 568a1db3436389148d1407d11d26871c804b795551adade8987153be6fa1b2bd5e5d107981a4bc72d75070a21bda1019c99272f330a728b4efac8e5ad3ecac18
- SSDEEP 1536:ZSKP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:j++J3qUQm08KMWF0bFTcVHr6zf
- TLSH T1729302B9991E7C3923ABD3A6A003AC9D8CE3DCDE151415BC31C75B1E14BB393A31B895
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 dd720c1ada89ce3b1419b47c225ef618f8455172918d3333770a4dc1e266a3d8
- MD5 fb6800e22af51e0d00c1b0c216a8aa13
- SHA1 1bb7abf6a39c97313970c8f83b2948a1d43af0ac
- SHA512 ffebf301c3de19f7d4815ad711d8d9f87e942ecf8dfdfcb026eb5c1e018c366b6d9c8c853f440d3712e8cd1fc55a3d9c9fd143de87d9fbc9ffc6b46fdb2b6ce0
- SSDEEP 1536:oSKP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:O++J3qUQm08KMWF0bFTcVHr6zf
- TLSH T1769302B9991E7C3923ABD3A6A0039C9D8CE3DCDE151415BC31C75B1E14BB393A31B895
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 b7d532983afaea3146f214e4cf80866e80a5dc0017db30abf75e965dd92e4ecd
- MD5 3ef128f2e175a0fdcfc747fcc9bef54d
- SHA1 940f063dc9ff10db6d474c62adc9de460f40f9a9
- SHA512 5ecef6635becb591cf1561a2977f48ab33a9337110581cdc6ef4966483f7d96a3b8dee9f1cfc4a49660c67226eb17e459903f776b247a8e286ac01036497b4bd
- SSDEEP 1536:wSgP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:A++J3qUQm08KMWF0bFTcVHr6zf
- TLSH T1FB9301B9991E7D39236BC39AA0179CAC89D3DCDE151410BC30C66B1E14BB392A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH