Overview
overview
7Static
static
3Hydra_1.0....up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Appraiser ...nd.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ds.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...es.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ng.exe
windows11-21h2-x64
1Appraiser ...ew.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ...ll.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ct.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ge.exe
windows11-21h2-x64
3Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...or.exe
windows11-21h2-x64
1Appraiser ...th.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...wg.exe
windows11-21h2-x64
1Appraiser ...b1.dll
windows11-21h2-x64
1HydraBackend.exe
windows11-21h2-x64
7Analysis
- geolocation tags
asiadelhiinindia - max time kernel
300s - max time network
307s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:56
Behavioral task
behavioral1
Sample
Hydra_1.0.2_x64-setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
Appraiser X/AppraiserXBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Appraiser X/Tesseract-OCR/classifier_tester.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral11
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Appraiser X/Tesseract-OCR/shapeclustering.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
Appraiser X/Tesseract-OCR/shapeclustering.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Appraiser X/Tesseract-OCR/tessdata/ScrollView.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Appraiser X/Tesseract-OCR/tessdata/jaxb-api-2.3.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-core-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-extras-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Appraiser X/Tesseract-OCR/tesseract-uninstall.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
Appraiser X/Tesseract-OCR/tesseract.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
Appraiser X/Tesseract-OCR/tesseract.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Appraiser X/Tesseract-OCR/text2image.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral23
Sample
Appraiser X/Tesseract-OCR/text2image.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Appraiser X/Tesseract-OCR/unicharambigs.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
Appraiser X/Tesseract-OCR/unicharset.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral27
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Appraiser X/Tesseract-OCR/winpath.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral30
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Appraiser X/Tesseract-OCR/zlib1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
HydraBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target Appraiser X/Tesseract-OCR/unicharset.5.html
- Size 23KB
- Sample260415-ynyf2aby6x
- SHA256 b2df74b3abfad11c529ba7e167cc573ec345c66b285f1a688739df95cb2bfbff
- MD5 add858b22059097884e051b23d6804c8
- SHA1 77be9aaeacc25b7d0d326cc4033f7f7453c024a3
- SHA512 1de78227236cc58e2f7809199827179e52855428f376b291ed9340a538c3952d6d6f2eae94187a012f65d327c40430e1c91e6e6db6802b8893c81a8f1c0f2248
- SSDEEP 384:8ic/7NlHRV3nP73SXoFn1EppMkm992tLf+oB5a:3c/7/HRRD3nippM90f+ona
- TLSH T198B2FA6A99826D3A16B3C771EF27E200FB8541349E0B9251B9FDB243AB45CB015E3DDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2508 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207569294955503" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe Token: SeShutdownPrivilege 5024 chrome.exe Token: SeCreatePagefilePrivilege 5024 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe 5024 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5024 wrote to memory of 1680 5024 chrome.exe 78 PID 5024 wrote to memory of 1088 5024 chrome.exe 80 PID 5024 wrote to memory of 2508 5024 chrome.exe 79 PID 5024 wrote to memory of 1088 5024 chrome.exe 80 PID 5024 wrote to memory of 3444 5024 chrome.exe 83 PID 5024 wrote to memory of 3444 5024 chrome.exe 83 PID 5024 wrote to memory of 2108 5024 chrome.exe 84 PID 5024 wrote to memory of 1968 5024 chrome.exe 85 PID 5024 wrote to memory of 2108 5024 chrome.exe 84 PID 5024 wrote to memory of 1968 5024 chrome.exe 85 PID 5024 wrote to memory of 3916 5024 chrome.exe 86 PID 5024 wrote to memory of 3916 5024 chrome.exe 86 PID 5024 wrote to memory of 2844 5024 chrome.exe 87 PID 5024 wrote to memory of 2120 5024 chrome.exe 89 PID 5024 wrote to memory of 72 5024 chrome.exe 90 PID 5024 wrote to memory of 2344 5024 chrome.exe 91 PID 5024 wrote to memory of 3088 5024 chrome.exe 92 PID 5024 wrote to memory of 3032 5024 chrome.exe 93 PID 5024 wrote to memory of 3032 5024 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Appraiser X\Tesseract-OCR\unicharset.5.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xd8,0x110,0x7ffeff6cc728,0x7ffeff6cc734,0x7ffeff6cc7402⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1940,i,11012259963740456961,10537889733264704202,524288 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2080 /prefetch:112⤵
- System Time Discovery
PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,7926893350989527561,8666280518785786259,262144 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2040 /prefetch:22⤵PID:1088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,14351921940128101616,8033472171396930082,524288 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2544 /prefetch:132⤵PID:3444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,9449222289049653873,6377766389050275837,2097152 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,10053294569023534784,12616968785923961814,2097152 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4236,i,7273232941923454356,2250906661291710169,2097152 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4248 /prefetch:92⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,3134240196856537943,5900117471277940057,524288 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5240 /prefetch:142⤵PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,6971027234600800123,8285361553886226637,524288 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5248 /prefetch:142⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,5775001817806919901,7749632287499328188,524288 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5548 /prefetch:142⤵PID:72
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,10072214544385883366,14525848366436369734,524288 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5556 /prefetch:142⤵PID:2344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5416,i,6202748545932905010,6155431014116999711,262144 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5588 /prefetch:102⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,9167438334909187640,15055891619724658849,524288 --field-trial-handle=2044,i,9794213958429816074,7410536770363433077,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4844 /prefetch:142⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 41a87cc64244fdff5eb23bf74dcba3b179423c14e5ceaf1bdb892bda0120cf1a
- MD5 4820d4bb71e3d9c374f1e0f3949c0c55
- SHA1 5f9e6bdc91be0cd91bdf1e3b3249ea6122d57f16
- SHA512 2049908ab8383c8400735c67573931b32ffdf011a4466c1b1da237631e89571782bd30934676b34e19449361e75ab5ec050ce33a53c23ecc26d458b8f7e6ee10
- TLSH T14FE02BE9D921E93709FD476A60554B46F73013572B41884F3F3C811C4FB063B058585C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\563d4da1-d408-4b02-beda-1f4d291dc318.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 b4c0945cc47b3699d239d28ed715c3a511d4799cba9dd1b561e39f795b8ef0c0
- MD5 0f4900f45903d587b57fa2a7f8389699
- SHA1 9ddd87076efab6aa3a249748f5cd5198a192ef5d
- SHA512 eaeadaad20e3598a72cffc45e94122fb377a7b76e82ee428b1c25fa09955f9039be6e6f19a9cae1005e5ccfca211c9173c8d81fe01ab06725d4cc97fda4583fa
- TLSH T18051DDB3C3E8997D881156F4AA246F2BDD7A0A14531C3C56C8D8AE0F57F28B6E21124F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 a7bf924d95c3fd685ae480bf2ff2741da74a3a9e1c6ef303c5c1150aba3496f0
- MD5 88551a10ede0a3ad67f7284115a2eec6
- SHA1 e8fc9de133f6566b32f533eeb2dce4508ccc26df
- SHA512 2cc20b4b85d969179e05f15f2a3d30fa33bebdc3cb9c9a539ebe8f774297f46678c48567690da516a6c051911c14720f013cae79b11f942d005ba3c1e197efdb
- TLSH T1F2418CF793B4957E861196F4DA14AE2FCE790524031C7CA289D4AE1B43F29B2D20138E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 0ac75070cc9435efdbd1d45f11d1ddec8660657108eee76ca8eaaa7f4155dcdf
- MD5 809ab66a6bbbdcf16c970998ae0677dc
- SHA1 4ce215143441cbe37f5e4704cf33b1833b54dc43
- SHA512 2ab6139dbaf2161be844f8c25716531d4ac61c80c5291af598958103e8d11bfe335043e96420afac6d3cb5034267b78aac691fc2209154b77e23fa16cc1b0339
- SSDEEP 192:2RorYrsY42qllS+azjv7ApAPRp2eB9qHsb+WNnv9PNVy9FiVyIsnAUge:2RorMj42TvsUX54w1Pv5e
- TLSH T12D42E82EA918693B5CCBD229FD61BB53E7F1103161942EC8E7FC8A2C15E79CD6127027
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
- MD5 e1d791f76039330e35fa0e1827d639ea
- SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
- SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
- SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
- TLSH T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 146ed62b0ee414fc831271e22b5eda5da83cd6a63c4f680fb1cb75af9ede2201
- MD5 18bf3d2dd14821aa683bf7a7b0db4035
- SHA1 5b9a75da089f0730f4fd1f3d1213348b68103cf8
- SHA512 29e9cf8ba69f7ec9d721e98e3f7737280a98a85dcf350ef83f1376522d51ee7149529bf373cfed032b75a93e5386cb617aaa027683c820929575c507509afe19
- TLSH T15AB0121080019901C08303B0658648DC31149F108B1E130153E47A72D8261B14014199
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585cf0.TMP
- Size 96B
- SHA256 bfa976f5da4199e4b73406ae7dba54f13479e60d31187287cf2503b26b4b3c3b
- MD5 8f85b6256ffefc704b281c54c326f1fa
- SHA1 f2eade5cd8eb1968201f148ce39416dc1aa2bda8
- SHA512 d93a4c0f00aa7c64b25940808ad78de2fcc74010cc018f30bab71e221b3d9c208f3babbae125c46a5bf50642ba0bf36bfaa65604fd33d70c9af248f74ce06747
- TLSH T135B02200C282A203C20303B02288C0C83020CF38C3030282C2E08AA3CC22230022A030
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 a933f620c1ec0d33f6e6da7e7fc0576d241487a89274a4da5a1114e93c1f38e3
- MD5 ecc1f91d2f100e64921c780d22af5aec
- SHA1 f634ed7076fdb9363185ca25adf121627f508c1d
- SHA512 8c2a16959eb5d5ee58ef0252ca9632982581b3e128857af062e8c4a19b1985685ec1b42c79075f48ff3c82bb4cc33330f051ee1b976a1327949209278bfde252
- SSDEEP 1536:nSd5P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:g++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T12C9302B99C1E7D3523ABD2A6E0079CAD8CE39CDE1114557C31C76F1E14AA393A30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 b4dbf4d059f153dd0c6fbaff7dd38b3000d0278d7532115115eef329b05343cc
- MD5 ec2a5c2a02524e8cc4b35c3d3928892a
- SHA1 b01cb11eeaf9884c1da746ca9704fbd3c0a1165c
- SHA512 1d422c5cae39bec9bc3affa32b0abae82d6fce197f3a7a0a19fd3d0b3194fd83733159f3f025c2301548e04d59c9696438ae4f71652ca5daa748d6b00d4b8284
- SSDEEP 1536:nSmTP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:FL++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T1E29312B9981E7D7923ABD2E6D0079C9C4CE3CCCE1518647C30C76F1E04AA397A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 640b542e552212b52ad5456e8ac508de962108f38ffe97931922aca00640c5c9
- MD5 6abd5f6b6e899fb6072ed7f65246ba62
- SHA1 e30948ea68bc504f29be49ee40279bba63fd9446
- SHA512 4a1ae7c03936f89cd21aee11230e137b0a4f7e658abf64fa1178c828d0ec0f417d33b3b558570000c82f8ee7275667a74da18f395a539e677a7d2789632b21ac
- SSDEEP 1536:2Sd5P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:/++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T11D9312B99C1E7D3523ABD2A6E0079CAD8CE39CDE1114557C31C76F1E14AA393A30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 132KB
- SHA256 b0802a6553f5617845d13c27e6dde5a8b34f858ecdce0c9371e4d711da96afe8
- MD5 e66cf4ce6b20836ea509023c61840415
- SHA1 1d7411e946553e61235e52eac6d169564d7b6d7b
- SHA512 838d84b9d78feae38862c9b573eb9fb80475bb110dbde810e397bcebf0b16a3dae1b675d08dc94333b60ca7754df6c3c994793a76d54191e0457dc466c5e6ade
- SSDEEP 3072:PfjNJlBuUYAroJ++J3qUQm08KMWF0bFTcVHr6zT:Pf5xXCJ++JjcMW2VcVLm
- TLSH T134D31266DD2F2E79536FE5ABE0079DDD4CD2488D1015207C308B6AAF01BB3E763178A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 e912193648a0f47eaf1e819ebf0de66c955f79c7fd3470dec2c507e0cb0fc148
- MD5 0edfc9873a09791a63e2e91b1fdf5ea7
- SHA1 707de2e5ff54b636da7162d0f681b7caa843b1d5
- SHA512 c745b2cd49452db71cfa4d43105996f96c4f4e0a86873057e36867509cab19f0695575989edeea603a71234472a3313d99d0f800393a01232b753119816a64c9
- SSDEEP 1536:hZmP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:k++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T12B9312BA591E7D39636AC396D0079CAC8CE3DCCE1514557C30C7AB1E14BA393A30B8E5
- MD5 SHA1 SHA512 SSDEEP TLSH