Overview
overview
7Static
static
3Hydra_1.0....up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Appraiser ...nd.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ds.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...es.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ng.exe
windows11-21h2-x64
1Appraiser ...ew.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ...ll.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ct.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ge.exe
windows11-21h2-x64
3Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...or.exe
windows11-21h2-x64
1Appraiser ...th.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...wg.exe
windows11-21h2-x64
1Appraiser ...b1.dll
windows11-21h2-x64
1HydraBackend.exe
windows11-21h2-x64
7Analysis
- geolocation tags
asiadelhiinindia - max time kernel
300s - max time network
307s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:56
Behavioral task
behavioral1
Sample
Hydra_1.0.2_x64-setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
Appraiser X/AppraiserXBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Appraiser X/Tesseract-OCR/classifier_tester.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral11
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Appraiser X/Tesseract-OCR/shapeclustering.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
Appraiser X/Tesseract-OCR/shapeclustering.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Appraiser X/Tesseract-OCR/tessdata/ScrollView.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Appraiser X/Tesseract-OCR/tessdata/jaxb-api-2.3.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-core-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-extras-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Appraiser X/Tesseract-OCR/tesseract-uninstall.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
Appraiser X/Tesseract-OCR/tesseract.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
Appraiser X/Tesseract-OCR/tesseract.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Appraiser X/Tesseract-OCR/text2image.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral23
Sample
Appraiser X/Tesseract-OCR/text2image.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Appraiser X/Tesseract-OCR/unicharambigs.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
Appraiser X/Tesseract-OCR/unicharset.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral27
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Appraiser X/Tesseract-OCR/winpath.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral30
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Appraiser X/Tesseract-OCR/zlib1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
HydraBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
- Size 18KB
- Sample260415-ynyf2aby6x
- SHA256 ad8140c54167f8d46ddc7b42f47963a3a46869ffda3c43fbec2f88124e92ef00
- MD5 80d8793c79fad44eabdce71c6d2909e2
- SHA1 2e88d18511a62232f58381649e164c2856e425aa
- SHA512 a7d52eb13c610488f9711adc956acd75db582e26c8c9ff782dbc218118cb021d1f022674df45f5e794a450539561ef687ab55e6bd9488068e5d8b8e5264b801b
- SSDEEP 192:ZU25icth7o14c2mgjzapG9hAKFg7Ce+xgrXQto8npJ+u3S1VwMKhMsY01EppM9ab:zic/7NlHRV3nP73SXoFn1EppMkm94b8a
- TLSH T18982E96E9D52652516B3CB71FF13E600FB9501348E4FA261BABDB241EB409B015E3EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2160 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207569770691311" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 3552 chrome.exe 3552 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe Token: SeShutdownPrivilege 4352 chrome.exe Token: SeCreatePagefilePrivilege 4352 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4352 wrote to memory of 5828 4352 chrome.exe 78 PID 4352 wrote to memory of 5012 4352 chrome.exe 80 PID 4352 wrote to memory of 2160 4352 chrome.exe 79 PID 4352 wrote to memory of 5012 4352 chrome.exe 80 PID 4352 wrote to memory of 6140 4352 chrome.exe 83 PID 4352 wrote to memory of 6140 4352 chrome.exe 83 PID 4352 wrote to memory of 2904 4352 chrome.exe 84 PID 4352 wrote to memory of 2904 4352 chrome.exe 84 PID 4352 wrote to memory of 5980 4352 chrome.exe 85 PID 4352 wrote to memory of 5980 4352 chrome.exe 85 PID 4352 wrote to memory of 4420 4352 chrome.exe 86 PID 4352 wrote to memory of 4420 4352 chrome.exe 86 PID 4352 wrote to memory of 2536 4352 chrome.exe 87 PID 4352 wrote to memory of 5416 4352 chrome.exe 89 PID 4352 wrote to memory of 2032 4352 chrome.exe 90 PID 4352 wrote to memory of 768 4352 chrome.exe 91 PID 4352 wrote to memory of 3552 4352 chrome.exe 92 PID 4352 wrote to memory of 4468 4352 chrome.exe 93 PID 4352 wrote to memory of 4468 4352 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Appraiser X\Tesseract-OCR\unicharset_extractor.1.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc912c728,0x7ffcc912c734,0x7ffcc912c7402⤵PID:5828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,5040091113415860564,3407115722898581639,524288 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2168 /prefetch:112⤵
- System Time Discovery
PID:2160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,2871168067907713995,8445663211967231368,262144 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,7982875687237980936,7181865352385180939,524288 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2508 /prefetch:132⤵PID:6140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,14398005550108379125,2540887706000410881,2097152 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:2904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,17580085878072687614,120039053566840927,2097152 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:5980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,15973091024772133397,8614316356203933280,2097152 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4348 /prefetch:92⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,6776583968408107697,16539022893996341829,524288 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5212 /prefetch:142⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,16686634581161523652,2986903349215431453,524288 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4888 /prefetch:142⤵PID:5416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,15197303114876376439,10656773747180870103,524288 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5516 /prefetch:142⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,5022577168784002820,3907321628925281226,524288 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5528 /prefetch:142⤵PID:768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5388,i,18153527616476678234,2767539316761299883,262144 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5212 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,13225873277057032408,2968938227675766813,524288 --field-trial-handle=2144,i,13543555564295051644,9652519348484586877,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5532 /prefetch:142⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 827e07be0b12f1117f98419c0b9f2ff07498f905d8b10dc34ba7b2be7b71846f
- MD5 ab8f65393984d4bde78979076662be42
- SHA1 7fd846fa39ac7c4b6e9bf40b1b64edb74fbef0b0
- SHA512 db7158c1b8ab38bfe4515303d24359465bbeaba7707b64cb71003f252c8b7f3009a80b7949b986f3c98cab18158b5cabb3acd69d5d0e62a97a49d68686258df5
- TLSH T129E0E5AAC824DC3718FE071960545746EA6013162B81890B7B3D82198FB162B0586C1D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 c65a07452bdf6add214475e848f668283c666b1ee984f188a11ef2e53db0c90f
- MD5 c16d2b3e8970071b1a3ff7121308b6e5
- SHA1 b9d71699c89946c2edfba7510a1c9476867b9dcf
- SHA512 361410a78b954cbcf31d554960ff7f0d9454cabd37c28d7a1e40973585b3a7d56391eb47eedb1b6cc9892e5a3db89912b8515a4bab75c70f7d6fb6636a5447bc
- TLSH T1B6518EB3C7E8997E890156E4AA153F2ACD690958532C3C5AC8D4AF1F53E28B6D24054F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 42d75ff376bbbb1b61ba66111bc70bc48940004dce26c0637ec7d752ec68a2b3
- MD5 2ce1b7a595defa31d0940d3fd73a6144
- SHA1 83ba085c60b7d0685e5d20e147377b0b7a2a81e1
- SHA512 a6fea143e523a330fb5ce8dcb92af10af539394d3610f33ef8e75af3e9ec2fcee69a74109a482b289e702ada52298427218e8cbaac3ac0f71894b99078d00be7
- TLSH T191419FF793B4997E861196E4EB156F2FCE690525031C7CA289D46E1B53F2972D20038F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 6ec8e28744be32d45aecbc8130cba61450b0ec1ac14b68842a0bf1ba07b36482
- MD5 cf037a19c10be5da5ea367a2d61323a4
- SHA1 f0d3adfc6b9c5cec8e83552c9f8e4ac4d1acc1e0
- SHA512 40a5b2af7698bab2ff758c1b1e6c75d9188f64d64094af476d0a104648262eb71315affd9d8cdacc75e5cfa7094f86051848edf10c103fff6d1e958c0affef63
- SSDEEP 192:ERrqgeYrsL1q4/mn/f3xetua4Pv7pFpAPRp2Q19YHsb+WNnDgPxCkdJsBpaFEVyz:ERGgeMzjbUXbOwcPxLdJsTe
- TLSH T12842D82DB948697B5CC7D229FE217B57EBF5102560942FC4E6FC8A2C15E7ACD2223017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 ec4a903f15e7bdf3f3306276ec497a94f5ecc0cfe46f4956b91f8c32fb987381
- MD5 a9b38a7fd38a423245bbc64b5157e740
- SHA1 444e42ed3eb92d5060f3c390b31117c69fa5f486
- SHA512 bdd45345fe0990700a3984e107b91daf90763a96ac36d28c9b2f68d70e223e9ed79f5de1c818366b89b7fce6fee1bbe5126598b23aeb5b0aa42e03529dfc8b72
- TLSH T13FB0121080029501C08303F41283088873549F108707170153F06D71F8265B24018294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589cc8.TMP
- Size 96B
- SHA256 e954846257ff89a0a9594b83d19f2722722ef8d5d1a09960e8169d08724f8f84
- MD5 6d4b779c195448d844e89f3d4144f289
- SHA1 f5e4cafe0bfc1a2d1f9db008123a8dd130bce8d4
- SHA512 2029abbc61926a9f21c9645123b224d4e13d1638c2a6122da94e0fe4b4835021de8c9b54cb707f041fe7ea9c53e862a7b5c0ab10c5227fb5b005fd1f4945b758
- TLSH T114B00265C147B713C08313B025D5D6F8B1A0EF69CA03133693F41E67EC25673452D174
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e22e359c-97ac-4fcf-95c8-b186fd7b995e.tmp
- Size 17KB
- SHA256 21e81c420f3d017ae32c8b64d4e6d75c94b8234e6b16495dd8068581d8c1d8ae
- MD5 00354c26d974dd37c82892cc4543401d
- SHA1 998a31960482acf892a8127374d96c3a440e9e8d
- SHA512 002a30061d299c004f2cb1f953a686553784e46d60be4a0ead8a5803cc85dda5c5d4c62a1b8c130db4c0b1023316a356061b53cd0cdbc9a204299c12d96f29e7
- SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLcifMtXODql+ErU3HtHGDu9P:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17p+
- TLSH T1BA72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA982A03D5ACF110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 6c0252415a9c9074cc81485401d543410703d607bb6a8316a0f1c154635396ed
- MD5 74c7aaadb736d73ce7ab21efda7d228d
- SHA1 71d1472f6d57390cc46c39ae06e154cc1be6172b
- SHA512 9ae18a0bde74b84509ae5180633048f9d34750a834acd7eb563f46e63abea16715db68820f69104c05f20fa80e5e2816cd5321cb2019d548286a1be0dafa2a7a
- SSDEEP 3072:8Gnov0pVJX52gsAwgcOZ++J3qUQm08KMWF0bFTcVHr6zo:8rYVJXSAwgcOZ++JjcMW2VcVLB
- TLSH T108D312A45E2E7879236AE9D6611BFCED0DE148EE4404613C32CB9F5D257D382930BC9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 d7f062322291d7d7d92cde720dd5361bf9154a290373c094dfa46c0b59d4f45b
- MD5 7ced9637fb5fe9bdbd8c6ed6e98514b6
- SHA1 932091d5a5a59ea160b177c34ec960bd666b042d
- SHA512 d160d7df0ae72f4f74373438f81d460a7706ae9fa6267be4efc6cdb6cf8d95f461c3840e52e9582e3eccbcbd8798e58d928c4131b9e33dfb622d0359d96975e3
- SSDEEP 1536:aSP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:Z++J3qUQm08KMWF0bFTcVHr6zo
- TLSH T13C9312B9991E7C3523ABD6A690039CAD8CE38CDE1514157C30C75F1E14EE3A3A34B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 aaa4034375f9dbe91a1e87c7e54b6ef2d74d7a35d9ab59524f5b956f6cf1e476
- MD5 30964a997c6cf692e35cf3eeebf6cbed
- SHA1 d38eca187f79f7decf79c025360f73bc5404bc84
- SHA512 0a80b9b833aaf22730ff4c644d894792c62e413c54fb7df12243e32c124896252f810366cb634b5ea6f1c294738deed7aff4262cb4331d2b281e4919af8ecf1d
- SSDEEP 1536:fSP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:g++J3qUQm08KMWF0bFTcVHr6zo
- TLSH T1D09312B9991E7C3523ABD6A690079CAD4CE38CDE1514157C30C75F1E14EE3A3A34B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 031f2fabd899446a9701a4cecec35203a894ac868ed8eee029114c225157ba2d
- MD5 f8f6f76097e8a254fdc76d66de635c2b
- SHA1 5491746a6e2a032ca05d330c37ebaa9bd6e1c7c1
- SHA512 82bbcff1915d2afa2c72bbd007abb53752c190cfd747ceb9bda73aef10e1147639731b325ed165708bb4d532bb21aa8e4d2945078fe0dd2ae24efa64236f1d8d
- SSDEEP 1536:SlhP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:YJ++J3qUQm08KMWF0bFTcVHr6zo
- TLSH T1BE9312B9991F7C7963AED69690079CAC4CE38CDE1514247C30C76F1D14BA393A34B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 010d4be95cca40ac993423308a081fa9ea7b2195529bb32f2c440cd062b87b86
- MD5 d8b3e4f29195a0d82ad00d4dd6650503
- SHA1 1cd57f1372c61428c8a6022978dbe0f16a7b32fe
- SHA512 581e2362e692bc97760b82ffa346fe9b0dc43f1b9fff7b4d26fd2fa280ef335b19dfc00cbb14bdc45ae67a00f82013fc7a399d5cfdaa99f60bb8d3a8c27e85b5
- SSDEEP 1536:SNP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:G++J3qUQm08KMWF0bFTcVHr6zo
- TLSH T1CB9312B9991FBC79636EC69690179CAC4CE39CDD151014BC30C65F1E14BA3A3A34B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH