Overview
overview
7Static
static
3Hydra_1.0....up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Appraiser ...nd.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ds.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...es.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ng.exe
windows11-21h2-x64
1Appraiser ...ew.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ...ll.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ct.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ge.exe
windows11-21h2-x64
3Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...or.exe
windows11-21h2-x64
1Appraiser ...th.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...wg.exe
windows11-21h2-x64
1Appraiser ...b1.dll
windows11-21h2-x64
1HydraBackend.exe
windows11-21h2-x64
7Analysis
- geolocation tags
asiadelhiinindia - max time kernel
300s - max time network
308s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:56
Behavioral task
behavioral1
Sample
Hydra_1.0.2_x64-setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
Appraiser X/AppraiserXBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Appraiser X/Tesseract-OCR/classifier_tester.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral11
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Appraiser X/Tesseract-OCR/shapeclustering.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
Appraiser X/Tesseract-OCR/shapeclustering.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Appraiser X/Tesseract-OCR/tessdata/ScrollView.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Appraiser X/Tesseract-OCR/tessdata/jaxb-api-2.3.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-core-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-extras-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Appraiser X/Tesseract-OCR/tesseract-uninstall.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
Appraiser X/Tesseract-OCR/tesseract.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
Appraiser X/Tesseract-OCR/tesseract.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Appraiser X/Tesseract-OCR/text2image.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral23
Sample
Appraiser X/Tesseract-OCR/text2image.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Appraiser X/Tesseract-OCR/unicharambigs.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
Appraiser X/Tesseract-OCR/unicharset.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral27
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Appraiser X/Tesseract-OCR/winpath.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral30
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Appraiser X/Tesseract-OCR/zlib1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
HydraBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target Appraiser X/Tesseract-OCR/unicharambigs.5.html
- Size 20KB
- Sample260415-ynyf2aby6x
- SHA256 0353dbd91477b479dbe4a38994c0c488d48b86a581dd64cb7804fe131565446d
- MD5 4c77efa9d9157125f4ca8a47b1e2fab1
- SHA1 04bc46f1dfeb16ede6e5e8660ead392321626a44
- SHA512 9bcb44ad7a0234fad1a847c869a0164dd07281ab9251dae5034735909378e341d010a241c4d0b05d2ca51131981ef124b572428d30ed55b4eae02ab022225991
- SSDEEP 384:zic/7NlHRV3nP73SXoFn1EppMkm9PHQWu8+pPr60a:Gc/7/HRRD3nippMPHQ38+Fr60a
- TLSH T18B92FA698982682616B3C771EF17E640FB9501348E0B61A1FAFDB242EB45DB015E3DDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2828 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207569887213547" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 748 chrome.exe 748 chrome.exe 748 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe Token: SeShutdownPrivilege 748 chrome.exe Token: SeCreatePagefilePrivilege 748 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe 748 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 748 wrote to memory of 2572 748 chrome.exe 79 PID 748 wrote to memory of 2828 748 chrome.exe 82 PID 748 wrote to memory of 2848 748 chrome.exe 81 PID 748 wrote to memory of 2848 748 chrome.exe 81 PID 748 wrote to memory of 4000 748 chrome.exe 83 PID 748 wrote to memory of 4000 748 chrome.exe 83 PID 748 wrote to memory of 4676 748 chrome.exe 85 PID 748 wrote to memory of 4676 748 chrome.exe 85 PID 748 wrote to memory of 4324 748 chrome.exe 86 PID 748 wrote to memory of 4324 748 chrome.exe 86 PID 748 wrote to memory of 800 748 chrome.exe 87 PID 748 wrote to memory of 800 748 chrome.exe 87 PID 748 wrote to memory of 1772 748 chrome.exe 88 PID 748 wrote to memory of 1580 748 chrome.exe 90 PID 748 wrote to memory of 2728 748 chrome.exe 91 PID 748 wrote to memory of 1608 748 chrome.exe 92 PID 748 wrote to memory of 4764 748 chrome.exe 93 PID 748 wrote to memory of 4716 748 chrome.exe 94 PID 748 wrote to memory of 4716 748 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Appraiser X\Tesseract-OCR\unicharambigs.5.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8babfc728,0x7ff8babfc734,0x7ff8babfc7402⤵PID:2572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,11312588596462556443,9649208564820887743,262144 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1964 /prefetch:22⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,6484776017663043240,17415346793397747816,524288 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2188 /prefetch:112⤵
- System Time Discovery
PID:2828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,15868300802498595095,15446485342799038459,524288 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2380 /prefetch:132⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,634015507320896386,5514786106853302154,2097152 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,2096197332274625370,9908493467305475831,2097152 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4220,i,6495048645400222886,6228037612022709849,2097152 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4204 /prefetch:92⤵PID:800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,493518337035303797,1259617953485423876,524288 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5248 /prefetch:142⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,13310382745875285352,17726343045348457006,524288 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5476 /prefetch:142⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,2750830402277332494,409943383635022384,524288 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5240 /prefetch:142⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,4436951290970911730,9107969235292162171,524288 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5512 /prefetch:142⤵PID:1608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5588,i,10355214506623852587,15911294399346257185,262144 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5456 /prefetch:102⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5108,i,15724708282027118475,4879155656939113263,524288 --field-trial-handle=1968,i,9295053616356418388,11796188422480056327,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5336 /prefetch:142⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 d8d085fe2994b2458d7caaddeaf35cacf9d942d5d408777371eca908b43ba3ce
- MD5 7738ec40c018d3caac8ee2caced6f36a
- SHA1 3dc6b4826930bd3563f491121abcc3ffc6a36cfd
- SHA512 cf1c68f57aba79fa6dff5184190dfa968f5f36caf6622d9d55ff647ddb84932bdc3905faa33c5563b57cc365b8453bb03e1e46483ae90f89fb219db145dce4f0
- TLSH T15DE02BEBCD21EC2729FD0B2964104F82FB5007176740854B7B3D810D4FB167B01D582C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 9e34730e77a0e31720e5ea6c1ef336dc4d63e82c0d95f407c8de9cf6731ebdd4
- MD5 805accc95ce4f18c53c3729cdac21e1e
- SHA1 dcd7678a1ddbb5a543f1b5da8488e7d4c8714369
- SHA512 7491c3b5818b0accab4eede467c4a830058588758c3a40cbc1ad9d4f73ef2b38a7f5f1d049a58f3c77eab7dda6f2498ea3abe57a41b0f562767a8a88c5a76c83
- TLSH T1AE419CF793B49A7E851192E4DA15AE2FCE790525031C7CA2C9D4AE1B43F2972D20039F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 1d3f81b8c1a9a65250ae9db541477b6d2127cfd71c382cd36d4db7d235a1e605
- MD5 5ba5816f1f6cf3fb6039b292960c3725
- SHA1 c89d2c32ad83a7cb1e2688546e9253e2ee4085fe
- SHA512 4966869207df4df6d239fbeddfc6fd34ea4f4861416014f5ef5cd570f4db449a68a802cd00b61f8e14645ed876035764733ad90e4698921972bd672c98b66529
- TLSH T1AF51CEB3C7E88A7D850156F4AB242F2BDD7D0A24132C3D56C8D4AE0F57E2CB2D21468E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 8705f9dcff3340c7a5d8900f4b8bf2059c8033af1762dc32a7e0a227f577ff15
- MD5 b68cba86e329859b3b0be2be95b9402f
- SHA1 5cea83cb2f741013467f60565c3bae6331a224f8
- SHA512 d98ff4b561951dffff5d6fa2c0c0b9e8f1fb711a568a2c7d40423a6d27d9f1383dc1fd3f5b4c8459f6fed1ad013e752a254a9be8c3419877449820ca78eea976
- SSDEEP 192:NR8XFuBYrsg5Tc/MZv7dpAPRp25s9ZHsb+WNn2gPKh2WwJC6VyIsnAUge:NRAFuBMR5pUX1Hw9PS2W96e
- TLSH T1EC42A52EE918293B9CCAD229F9657757E7F5102561902ED4E7FCCA2C04E7ECD221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
- MD5 6c2a084e9725415d6e6f241570b51988
- SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
- SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
- SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
- TLSH T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 08cb37e7aef3b71c76032ddc0c5bb6e081917f6d132eff858326f653c810c034
- MD5 1c693e4fe79378290f75164dc9d0a6ca
- SHA1 01edcffb32a15bab6912201fe00259a36af3d3f0
- SHA512 7234b68d3bbf400c6a6da760fe14eaf2af9faaab64f867dae4f5928c20a57a1841bac38b98baf2ff670b23e9e17dd10872d3c17d8d435f7c3679594459d306ec
- TLSH T184B0126088019542C04302F112C218CCB1149F108705230193E6E9BAD82E2A34014151
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e8f4.TMP
- Size 96B
- SHA256 1ae479f7e33978079253c799bc1929d5f9a984ff1e84dbf41ac10fad9d37bf7e
- MD5 0700e3994f7e265c811232bf81b3ef80
- SHA1 aba0d1d827f2357a0c6d5aff924424585605174e
- SHA512 a70c60a130d485cd8472489db1770f2d277855065dafc736bbd0b908d119621fc8186e8049b58c4c5c0ad90acc597650faeebb748fe41b17939e6d801822778b
- TLSH T1B1B00255C102B323C14603F025DDD9D8B160DF26C6472656AAE01A6ADC7D6724537172
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 1bcaf5c074b00b49f5c6bc7d91248d293954d2ddc52f65b633859a65c911a66d
- MD5 17e7629f4f4cf5c58a6ad6e338f2fdfe
- SHA1 f95b48c7625c8a253412a99e090e7d107eb300db
- SHA512 a4ff9ab99212840f4ee33fa139614522499c265e81303fcdccd0649e5b8db3c3afe20f5ad46ef3d890e71eec7fc6c6b3240ff149da6a92a41a9297b05ef8da40
- SSDEEP 1536:NlP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:v++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1C29302F9991E7C7953ABD6D690079CAC8CE3CCCE1514157C30CB6B0E14BA3A2A35B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 7eebcf050cda660b2e2d49cf6ebfabe0876a3f23204174ac39fed96bd82f79a0
- MD5 b11e5d90735283ac103ad517bccd231f
- SHA1 03048a6c5ff24447254a8be2cdd20b97d5a327ab
- SHA512 1a34d0144f5980c503b4b9479e8bfaa0436bcbf41b20381365d845fa8ddfdee0b6ce0f021158b59d768bc238510c61496fc3ccce94556a2e8537c6e32143ba09
- SSDEEP 1536:h8xmRP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:E4++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1349312B99D0E7C75235BD6A690079CAD8CE3CCCE1614157C31C76F1E14BA393A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 132KB
- SHA256 dd13aba5ecf183649e6bf5d8b6cc7fa03f37509636343fd54c6e218838cee76a
- MD5 6a172b87c8876d9690a833e30d436781
- SHA1 3d92db27a5ccab7b3ae6ad0fb3ec2da05e0a8b46
- SHA512 f437b44e0a61f2b855b08f3fbd3af048a72733915323329eaf40d1696db3541c68e4bdf87bbdeec36b6ec179da94acb2cc66cd878b688f2cfef2f6fbe05389f1
- SSDEEP 3072:ZIszeX6fGMf2WMCWD++J3qUQm08KMWF0bFTcVHr6zb:ZIszeXC2WpWD++JjcMW2VcVLa
- TLSH T1EFD312BD991F3C6A936EE68690078C9DC9D1DCCD1804037972DF6F0D18B9363A35BAA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 086f3adf16945554eaf8d0dfc48a0afc43d7905b9a2cd170d7a1ea2aee6d5220
- MD5 088526add4a3c14207fa2d6390559d32
- SHA1 efe3f104c99d556e407b524a8cafa6192d73acef
- SHA512 04df2d404dbfce94e188525a1897663854d2e6a98d60cb064445bd7c8f41eeaec3de7a2eb9c722f456db3bed234e942aa5ef87bc345995845dbc92b268c7ef85
- SSDEEP 1536:W8xmRP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:h4++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1FA9312B99D0E7C75235BD6A690079CAD8CE3CCCE1614157C31C76F1E14BA3A3A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 a8ed1f77ef33f20a96a4c352aefbbb99c5e873892072930e5e4a1d2379a435c3
- MD5 adbb60a498af2d5ac8724deeafe49871
- SHA1 1a052638694b5446610ae6a1fa4e020c549c0e9f
- SHA512 735ea87bacd0c5d10ee7370a165290462f4de137dd7518692fb09418496de33a5ce36cbe809512bb82466ea5a2dbdd4431fbc70673491b1419d758a6d19ea2a4
- SSDEEP 1536:XXP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:v++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T12B9302B9991E7C79636BC696A0079DAC8CD3DCCD111451BC30C76F1E14BA3A3A31B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH