Overview
overview
7Static
static
3Hydra_1.0....up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Appraiser ...nd.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ds.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...es.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ng.exe
windows11-21h2-x64
1Appraiser ...ew.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ...ll.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ct.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ge.exe
windows11-21h2-x64
3Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...or.exe
windows11-21h2-x64
1Appraiser ...th.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...wg.exe
windows11-21h2-x64
1Appraiser ...b1.dll
windows11-21h2-x64
1HydraBackend.exe
windows11-21h2-x64
7Analysis
- geolocation tags
asiadelhiinindia - max time kernel
300s - max time network
314s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:56
Behavioral task
behavioral1
Sample
Hydra_1.0.2_x64-setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
Appraiser X/AppraiserXBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Appraiser X/Tesseract-OCR/classifier_tester.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral11
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Appraiser X/Tesseract-OCR/shapeclustering.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
Appraiser X/Tesseract-OCR/shapeclustering.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Appraiser X/Tesseract-OCR/tessdata/ScrollView.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Appraiser X/Tesseract-OCR/tessdata/jaxb-api-2.3.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-core-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-extras-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Appraiser X/Tesseract-OCR/tesseract-uninstall.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
Appraiser X/Tesseract-OCR/tesseract.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
Appraiser X/Tesseract-OCR/tesseract.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Appraiser X/Tesseract-OCR/text2image.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral23
Sample
Appraiser X/Tesseract-OCR/text2image.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Appraiser X/Tesseract-OCR/unicharambigs.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
Appraiser X/Tesseract-OCR/unicharset.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral27
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Appraiser X/Tesseract-OCR/winpath.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral30
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Appraiser X/Tesseract-OCR/zlib1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
HydraBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
- Size 19KB
- Sample260415-ynyf2aby6x
- SHA256 1b9931074dd228953f385a6b703f334fe9ecf8fdbbca8b2f7f957f882c28529d
- MD5 531355ca6b05220053715e73f94b8cb1
- SHA1 b23f0872a1380a280799cb3cb5d8890773e8d492
- SHA512 6848340428db260eaa7721397d834d93ed7ce7443047bd21d40b0843d1ee637570ca0cfa7ec3c47383a09e515332d35d7ffd62a40830e2800ea3cea2c8c9a8eb
- SSDEEP 192:O25icth7o14c2mgjzapG9hAKFg7Ce+xgrXQto8npJ+u3S1VwMKhMsY01EppM9a7Z:Tic/7NlHRV3nP73SXoFn1EppMkm9S8a
- TLSH T19192F96A9D52691616B3CB71EF13E700FB9601348E0BA161BABDB241EF40DB015F3DAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1164 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207570116110210" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 1172 chrome.exe 1172 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4104 wrote to memory of 2736 4104 chrome.exe 78 PID 4104 wrote to memory of 384 4104 chrome.exe 79 PID 4104 wrote to memory of 384 4104 chrome.exe 79 PID 4104 wrote to memory of 1164 4104 chrome.exe 80 PID 4104 wrote to memory of 4604 4104 chrome.exe 82 PID 4104 wrote to memory of 4604 4104 chrome.exe 82 PID 4104 wrote to memory of 3040 4104 chrome.exe 83 PID 4104 wrote to memory of 3040 4104 chrome.exe 83 PID 4104 wrote to memory of 3824 4104 chrome.exe 84 PID 4104 wrote to memory of 3824 4104 chrome.exe 84 PID 4104 wrote to memory of 2168 4104 chrome.exe 85 PID 4104 wrote to memory of 2168 4104 chrome.exe 85 PID 4104 wrote to memory of 5088 4104 chrome.exe 87 PID 4104 wrote to memory of 3140 4104 chrome.exe 89 PID 4104 wrote to memory of 4008 4104 chrome.exe 90 PID 4104 wrote to memory of 936 4104 chrome.exe 91 PID 4104 wrote to memory of 1172 4104 chrome.exe 92 PID 4104 wrote to memory of 2984 4104 chrome.exe 93 PID 4104 wrote to memory of 2984 4104 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Appraiser X\Tesseract-OCR\wordlist2dawg.1.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0x104,0xd8,0x7ffe8e03c728,0x7ffe8e03c734,0x7ffe8e03c7402⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,12582879973330202389,9496349195283690643,262144 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1932 /prefetch:22⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,14286101471393428760,1443759008267055033,524288 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2248 /prefetch:112⤵
- System Time Discovery
PID:1164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,17455160774647201802,11614296711204223496,524288 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2476 /prefetch:132⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,10687273495680175870,14639757458272556651,2097152 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3148 /prefetch:12⤵PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3116,i,12821853953318249247,14869187184927733483,2097152 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4232,i,2876149383902187809,14574461179509763146,2097152 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4248 /prefetch:92⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,3463375219810951850,5267769436918695263,524288 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5216 /prefetch:142⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,6298019254608423341,1941222601463633234,524288 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5508 /prefetch:142⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,2396944840131746304,2379840664697859549,524288 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=212 /prefetch:142⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,17480730837681484221,8467717670973523652,524288 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5600 /prefetch:142⤵PID:936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5416,i,879413878113000813,3311410540412567323,262144 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4200 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,12261551164535097605,12765356215389726062,524288 --field-trial-handle=1936,i,11120877502675391262,6005160626956505014,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=752 /prefetch:142⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5068
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4308
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 8aa3ba792bbd6e63c7881db6a6b0d6e0ce412a37076a9f588f50b685b8fac3b7
- MD5 85e2e9424ec6ff0a3db8e85dcb464362
- SHA1 3363e24ee844f61a6d9318c481c90a44c59c716f
- SHA512 1a076fa9c1b031e6f01a99e4b805a21f2a4ea115c14534c9b0a854788e56ee30775e2a9c4c2a4ee05b1f91e0207390dd8ef86917f7468aef9f6597f638cf84bb
- TLSH T14AE0EDAAD822D82B19FE0B2A60204B86EB1003176A40854B3A3C810D8FB032A019586C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 d28e7bea534bd67674faf9ff50c98883b12439a58a1a1395124cf9e71be8dc44
- MD5 60f9a5c62fdcf23c46b15f675af1a2d5
- SHA1 f05d9e00995f5492b87db1ce6680e200dba33442
- SHA512 53c513868c3e7e561e299e81aebde60198056316c718443ac7eac1b3c63821e14db6845c0ccb540b576a17868fde468de04b9590b1d25cb6e147ec64c726a4a5
- TLSH T119419EF793B4997E851192E4DA156E2FCE7D0525031C7C6289D4AE1B43F2972D20079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 1d3f81b8c1a9a65250ae9db541477b6d2127cfd71c382cd36d4db7d235a1e605
- MD5 5ba5816f1f6cf3fb6039b292960c3725
- SHA1 c89d2c32ad83a7cb1e2688546e9253e2ee4085fe
- SHA512 4966869207df4df6d239fbeddfc6fd34ea4f4861416014f5ef5cd570f4db449a68a802cd00b61f8e14645ed876035764733ad90e4698921972bd672c98b66529
- TLSH T1AF51CEB3C7E88A7D850156F4AB242F2BDD7D0A24132C3D56C8D4AE0F57E2CB2D21468E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 38743d75491babbdbf14d36484a9e7332fe7fc7af55ab0f1b44b354c82001c7d
- MD5 09ba290073bd63a2eb542c1306983530
- SHA1 be85ab1bf1c3ad65306825842a2ae02aeb4b3519
- SHA512 e70e13a2731523918cc30216ca2fac2de9b80431412b170f21e74c7d01f1ca524aaeab52be321b9cf7826527186c511c373426b71ee76316e040cdd530a4b61f
- SSDEEP 192:NRVL9uBYrsmVYrfSVv7dpAPRp25E9ZHsb+WNnvbPn0401kw6C6kVyIsnAUge:NRR9uBMrVYulpUXlHwzP04mh/e
- TLSH T10242C62EA918257B9CD6C229F965B727DBF6102172941E88E7FCCA1C14E7DCC321742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 9efdcf027d28096002d5b49274a9804a0d49c54cdcd1ef488e8567a0a095529d
- MD5 6aad7ebd56bf7f91a7ac786b19a1ffe6
- SHA1 f82bd51b04776c5dd6b05621983fadf870239000
- SHA512 c720bb505a36495898e8db6a3faea90b253fc5af9c315a734b8e167cc94d0db774656662fb75b7405a7b1c73387df8d07098277f4023ff95b4053d1779727322
- SSDEEP 192:NRVL9uBTrsmVYrfSVv7dpEPRp25E9ZHsb+WNnvbP20401kw0C6kVyIsnAUgE:NRR9uBvrVYulpkXlHwzPr4mL/E
- TLSH T17E52D82EB914257B9CD6C219F955BB27DBF6102161941E88E7FCCA1C18E7ECC321702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
- MD5 6c2a084e9725415d6e6f241570b51988
- SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
- SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
- SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
- TLSH T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 998b1233e03de6d828eec16a123f4fc14f445c967be38c04803d1d95fee15534
- MD5 a16d47be4ea779e92b585a4242586a1d
- SHA1 22d3721a3f5092c4728a4da2cf5a7e103c1f442b
- SHA512 b363a3ed1724ffaedff84e21fee33d3d78326772485984ee91eb77c9d1e53ba97eaa4f80cd414b16352d63f70fb11b6362e310f787ce9efddda6da6462031dde
- TLSH T1CDB0127580019601C10302F815B208883154EF14C7061301E3F8A971EC261D1C014194
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589064.TMP
- Size 96B
- SHA256 58661955c268bda0de677b5684dc63f0ae1f2d6c48758716911a32537fb2d9cd
- MD5 03f00496a69d1c93d1e97d912946c71a
- SHA1 7b73b8c4a6abfa38fc02335a2d052c6353c9b56d
- SHA512 800258b9c0a78e114db6beed7ac4063908e2a9d47259857aadd2e76ae93b2d932ee0703215bbbd574f785fb92da0c678a1494c0a5f4484556acff5a80038b785
- TLSH T1D9B0228AC202A202C0C20BB03880C0C83030CF22C303222282E00A32CC20B200020830
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 85fb4378bcc02397acf64047cdaae5b21951f9acc7a1c9b9402bb92c492ffbe2
- MD5 e54b3337b60b8ab9f405647ae70f6482
- SHA1 7888ffd6835c943ccbd7682c1db610264c15f245
- SHA512 bc6fa268a5eec04310f87598b3c24326f1911c00667bccae434429fe599546699c2a0db51b71307328cb16dbc0cc9a595c803b7205aa8eeccfeebd5590d4df71
- SSDEEP 1536:afxmSP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:ex++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1BE9312B9990E7C75239BD296A0079CAD8CD3DCCE1618157C31C7AF0E14FE392A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 617120f71c3b7f9469789ed1771894eef887be8941f7a512cbf0390a7433791c
- MD5 aeefe7aca6f30a747f8a88b1a572159b
- SHA1 1ba9714863a32fa8135aa0e42c74530fde136bf8
- SHA512 9bec2970b9bd381f99101257a30f1069d6c0d110c91966ad15a8839b9674e61ca757564545f41577f4f0fffbb507bd046ffb8afc9720234145a5c72e68a832c9
- SSDEEP 1536:e+P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:V++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T18D9312B9981F7C7953ABD6D690079CAC8CE3CCCE1518157C31C76B0E14BA3A2A35B8E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 132KB
- SHA256 3eff3f964ba334830fed7548aacdcbae076e3bd727e68eb648d3f6ade7dbb522
- MD5 af06bee90a4152d8248bbab804a804c6
- SHA1 53fdbbfcc344648d00d2ade4fc260af37574959d
- SHA512 b8c70c395e33f63d5f0ab58f4ee7a703de470dcdcbcef37f943a2bc5b7fe0a66f2125362d52da6ed03a98c145afefc011c3a7f60b950e43607e46210dd8ab2ef
- SSDEEP 3072:cIszeX6fGMf2WMCWy++J3qUQm08KMWF0bFTcVHr6zb:cIszeXC2WpWy++JjcMW2VcVLa
- TLSH T105D3127D991F7C6A936EE68690078C9D89E1DCCD1808037932DF6F0D18B9363635BAA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 02c676715a9fd4b097e4be5e31a4b7acd8458c25cdf2219b848e789366a2d8a6
- MD5 f4c26d09f27dc507f0bec4e07c3ead56
- SHA1 b22b86428309bf8d491749b8f63d7a6fe365990c
- SHA512 5a19462ab45c615230fba78c6852f0b87457e53e0277bafbbf9e620521cbd13a42456af7eaf66ed81a6b4afb3bf0e6406999d295f35df91f6624f38ea8594b14
- SSDEEP 1536:DfxmSP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:9x++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T12C9312B9990E7C7523ABD29690079CAD8CD3DCCE1618157C30C76F0E14FA392A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 0e09774a8f5eb2d92ea2a54f6ba11c41095fe67da9c1995c16e40e4844b91451
- MD5 080060322500750618ec37652171a724
- SHA1 fdbfe184a2e542fb38b49f1f1b9753af23ccbadb
- SHA512 7250acdaa8492e367161dd116c30f7b0981e7f7a73eb98cbd9c559663adda38776b43ebfa846b0140a2ac502b1d8ddd349bf588dd5bb916c64713e2af5576c57
- SSDEEP 1536:XSP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:o++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1409302B9991E7C79536BC696A0079DAC8CD3DCCD111451BC30C76F0E14BA3A3A31B8E5
- MD5 SHA1 SHA512 SSDEEP TLSH