Overview
overview
7Static
static
3Hydra_1.0....up.exe
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Appraiser ...nd.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ds.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...es.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ng.exe
windows11-21h2-x64
1Appraiser ...ew.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ....1.jar
windows11-21h2-x64
1Appraiser ...ll.exe
windows11-21h2-x64
7Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ct.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...ge.exe
windows11-21h2-x64
3Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...5.html
windows11-21h2-x64
4Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...or.exe
windows11-21h2-x64
1Appraiser ...th.exe
windows11-21h2-x64
1Appraiser ...1.html
windows11-21h2-x64
4Appraiser ...wg.exe
windows11-21h2-x64
1Appraiser ...b1.dll
windows11-21h2-x64
1HydraBackend.exe
windows11-21h2-x64
7Analysis
- geolocation tags
asiadelhiinindia - max time kernel
300s - max time network
320s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:56
Behavioral task
behavioral1
Sample
Hydra_1.0.2_x64-setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
Appraiser X/AppraiserXBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
Appraiser X/Tesseract-OCR/ambiguous_words.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Appraiser X/Tesseract-OCR/classifier_tester.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral11
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral12
Sample
Appraiser X/Tesseract-OCR/set_unicharset_properties.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Appraiser X/Tesseract-OCR/shapeclustering.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
Appraiser X/Tesseract-OCR/shapeclustering.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Appraiser X/Tesseract-OCR/tessdata/ScrollView.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Appraiser X/Tesseract-OCR/tessdata/jaxb-api-2.3.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-core-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Appraiser X/Tesseract-OCR/tessdata/piccolo2d-extras-3.0.1.jar
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Appraiser X/Tesseract-OCR/tesseract-uninstall.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
Appraiser X/Tesseract-OCR/tesseract.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
Appraiser X/Tesseract-OCR/tesseract.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Appraiser X/Tesseract-OCR/text2image.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral23
Sample
Appraiser X/Tesseract-OCR/text2image.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Appraiser X/Tesseract-OCR/unicharambigs.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
Appraiser X/Tesseract-OCR/unicharset.5.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral27
Sample
Appraiser X/Tesseract-OCR/unicharset_extractor.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Appraiser X/Tesseract-OCR/winpath.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.1.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral30
Sample
Appraiser X/Tesseract-OCR/wordlist2dawg.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Appraiser X/Tesseract-OCR/zlib1.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
HydraBackend.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target Appraiser X/Tesseract-OCR/ambiguous_words.1.html
- Size 17KB
- Sample260415-ynyf2aby6x
- SHA256 7361d4c477bd35d5fc66ce8a9bfb5c2b4ae9eab91e42148bed6873067d98997f
- MD5 b79f037021f0dad0bfae194a39a29c35
- SHA1 5a09ec2a451b0c1f9b3c723f005de1d036592571
- SHA512 9fe7398e81b3212ed4738edab960b0a5c51b7a5ab0384ce2aedb395db2e3db292ef8194ec09659eed19812813c1aa94c1aff0abf063cde223828f4ed88799e83
- SSDEEP 384:mic/7NlHRV3nP73SXoFn1EppMkm9mSj8a:tc/7/HRRD3nippMmG8a
- TLSH T10882D96D9D52651517B3CB71FF53E100FBA501304E4BA2A5BABDF101AB44A7016E3EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4072 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207569542663415" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 2552 chrome.exe 2552 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 8 chrome.exe 8 chrome.exe 8 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 8 wrote to memory of 3952 8 chrome.exe 79 PID 8 wrote to memory of 1372 8 chrome.exe 81 PID 8 wrote to memory of 4072 8 chrome.exe 80 PID 8 wrote to memory of 1372 8 chrome.exe 81 PID 8 wrote to memory of 4500 8 chrome.exe 84 PID 8 wrote to memory of 4500 8 chrome.exe 84 PID 8 wrote to memory of 1668 8 chrome.exe 85 PID 8 wrote to memory of 1668 8 chrome.exe 85 PID 8 wrote to memory of 2976 8 chrome.exe 86 PID 8 wrote to memory of 2976 8 chrome.exe 86 PID 8 wrote to memory of 3696 8 chrome.exe 87 PID 8 wrote to memory of 3696 8 chrome.exe 87 PID 8 wrote to memory of 2116 8 chrome.exe 88 PID 8 wrote to memory of 4916 8 chrome.exe 90 PID 8 wrote to memory of 4804 8 chrome.exe 91 PID 8 wrote to memory of 2168 8 chrome.exe 92 PID 8 wrote to memory of 2552 8 chrome.exe 93 PID 8 wrote to memory of 2516 8 chrome.exe 94 PID 8 wrote to memory of 2516 8 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Appraiser X\Tesseract-OCR\ambiguous_words.1.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccc21c728,0x7ffccc21c734,0x7ffccc21c7402⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,7474366936473221882,15563696466686398511,524288 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2188 /prefetch:112⤵
- System Time Discovery
PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,3368591872917148165,3615756508330659222,262144 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,7378792887180438972,8576386115602723184,524288 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2544 /prefetch:132⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,1091803095865058189,14962598800881094606,2097152 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,7145655712227852842,13593613563396755809,2097152 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4344,i,12839569650744842672,11986015212424447189,2097152 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4368 /prefetch:92⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,533592883869753662,12656588059729707454,524288 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5208 /prefetch:142⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,7911197106094854306,10591221272615567374,524288 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5508 /prefetch:142⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,8154932313255187673,4002791628997435859,524288 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5208 /prefetch:142⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,15749907071027768362,613520694293721180,524288 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5592 /prefetch:142⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5408,i,5944195498894651017,1628033866162213492,262144 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5548 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,4145472033245159402,14263836781598812661,524288 --field-trial-handle=2160,i,11743380508314397309,1813528049830733043,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5580 /prefetch:142⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 d5283f629e286f5b30382b0c233aa7f588921510d4f0032c2213b97d178b4d99
- MD5 0878b79ff45351ffc4a2b8458ea83a09
- SHA1 74f536f95cbb80b8bae66b705fcf7c480dc52bb3
- SHA512 af18f368547b04e9b757f9d37baf1cf7cc9b1d264a3808313147ba0c80e22b798514d22974b7d77680de049b7dfef3b96887a237e3ade4c5f6c843b7e5102fd0
- TLSH T1C2E0AB9AC8318C2705FC8B1850100782E660135B2B91555F3A3CC1084FF5A2F454189C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9e65910e-8d85-4f74-ad94-91bcff1da368.tmp
- Size 2KB
- SHA256 c26a24e074fbb3aa312a3ec8938fbc0cc94d3e51893ec62f4fdeb3e2089f867d
- MD5 8c55ae1e2c80ab2d52fe57039f3faf0b
- SHA1 f0a41e6aad6b43e6cfa177ddd36d74f84c400286
- SHA512 253319519ff623fbf5ced93d930721633278b8287abd3c9cb0dd2fe1c6c8af2c66a5153f127d3abfd305f09ca18f28871ae841711842e148f0e9a2dc9a0f746c
- TLSH T18A517BF3C7E8997E890157F4A7153F2ACD690A54532C3D56C8D4AE0F53E28B6E20054F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 e15a1e9ba232a6dead666315a54aee4b2367430a34ab9545cef06f3937ef66d7
- MD5 d037d5d5d549bc43c1a2458757e9a2fc
- SHA1 360472294a6df57f35a5f89ee925d0b24b0f785b
- SHA512 101ba65ed6382fb5d234fa7b15e4720af71e6cac5079b8efcfd0ad6c310efb9290497fd93be5b491030dd7686404128547f3635f86d7ab9f2d443c779cb3e462
- TLSH T135419DF793B4997E861192E4EB156F2FCE790524035C7CA289E46E1B43F2972E10038F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 f3b78bf174854deab1cbf4db453cde143b3de0b2519308fe44233b0832aedd8d
- MD5 9d7a0c0681908063a8e36853b8cd48af
- SHA1 f77f66d86cca3588e232175834a438092959d6f3
- SHA512 5f32201be24d6e5f8272e50350a063f6cb91d2d3402266d0e730d36016c5d5bd745c76a475c689bb73d233f6e205027fc7a7c5a0af3ed09a4123d9ab36d4871b
- SSDEEP 192:NUR3DYrsFIDOXuPvv7HYpAPRp22/98Hsb+WNn6oPNi2kw32MA+VyIsnAUge:aR3DM5nnEUXH6wtPk2XE2e
- TLSH T1F142EB2EB914753B4CDBD22EFD26BB67EBF5102161941E84E6FC8A2C14E75CD2117027
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
- MD5 40aba898dc4efcd9988ec53e06a8b15c
- SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
- SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
- SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
- TLSH T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 c46c6ea632dd0476e9faa7cacf5a02d0a223c5a59de26426a748a6145a0cdc34
- MD5 ad02c72da9d5fdda473cbf2defb5026b
- SHA1 4a7459d4f24fa01e17edee2a628627a4380329c1
- SHA512 60697f8115441305555b90da5ea6727c74826b70159534e9062cb44c51aec5dbdc5c743ab693904744f65c7400484e22be6ac6d0f3be915a856d52f815985e4f
- TLSH T140B012108401E901C85302B421C2048832249F30C705130553E0ABB1E836AA24114350
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e886.TMP
- Size 96B
- SHA256 721f6f10405e0b4b3f679b5b88a7ea15e149f97fa65b6cec85acf27358944b42
- MD5 3946e3e3929a1fd743399238d06b51a3
- SHA1 0625109f58e605a6f5980acbd9a5fb56d8b81369
- SHA512 579138f917e002cc088d3c9af41e6a92fb02ca3b00fbe6af0c4bd1c840cc6dfe3cdcb9091d38e538aaac107045250443805cd6362bf4465d1b8f75fd49bef361
- TLSH T146B00255C186B213C05307F026D6D6D87660DF36DA03125397E05AA6DC35E7AAA26274
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 f10e7a7d1aed0874f794caeb4faabb3c1c8d2c4ac373826a66eb0b8f68acb3c9
- MD5 86343db0f64812b90e9c22b19b42db25
- SHA1 f8ae46be8f9f9154eed0924c0825e43ad658735b
- SHA512 0b7aa0b64a208c3c2e1bc035bd8b6d5bd29b1147b70e0fe77b491d5907632dfe84ec586128d154e36b1e617f30f30c3ac0ff8bb8ec5618362e26870bc2d899a7
- SSDEEP 1536:nS3eP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:W0++J3qUQm08KMWF0bFTcVHr6zf
- TLSH T18B9312B9991E7C3913ABD2D690079C9D88E3DCCE1518247C30C75F0E14BB393A35B8A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 124KB
- SHA256 0338a2de4cf90e396d5b0239873792862ebd9ceaceeb216085afa556176420fd
- MD5 55791d70ee03fab2681c14bd89abe051
- SHA1 6d05cce3fd25fec6eb4a513481862172c24c0750
- SHA512 ae5063ed8287ca74f7da39f0b44c7a746f76a5d0212e23170f88e5f774cea09cd589571c03f0d293336bba14113bca5749fae0354460b7049a9e8ae91c52560c
- SSDEEP 3072:5iyBmPvpVEXFn7dXmYo++J3qUQm08KMWF0bFTcVHr6zf:RcPvPEVn7cYo++JjcMW2VcVLu
- TLSH T15DC312B5981E643D272FD39AE1239D5E88E39CDF5524593C30867F1E1CAD3C2620BCA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 297389a4c8694fc69f8524d40ffea4ab86cfdb072163f265d1fde1da07f9de0b
- MD5 7415577f612bbbf56ec50773f415d52b
- SHA1 4da3c91e35393aad16c66380f2e99404b112e696
- SHA512 1e113770d5f28ac576e1d19f97db6af0d17687605ac58e6830975f6f90e3aa5ee2871bbcd9a31aafe7eb144d2b7d9f5773769d58b5e29681032c71b75fa937c4
- SSDEEP 1536:DSgP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:P++J3qUQm08KMWF0bFTcVHr6zf
- TLSH T1F19302B9991E7C3923ABD7A6A003AC9D8CE3DCDE1514157C31C65B1E14BB393A30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 361f9d5229db4abe18cd147c5926416e137ba86921b5bd831386b64130ab7fda
- MD5 fa24c09ee9701db855b2e678df25193d
- SHA1 bc5aa99592db7df0db87fc65f3a9dbf09070299e
- SHA512 c0a45443d7e897c94ad9f8f2fe2d7486a1da6c1af9ffc2bd06a5627dffc60705b1a180692e3cb2570b197f7d9fe72cdf868bd5734bb12e07cc9c5a9e7b77f00d
- SSDEEP 1536:WSgP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:a++J3qUQm08KMWF0bFTcVHr6zf
- TLSH T10B9302B9991E7C3923ABD7A6A003AC9D8CE3DCDE151415BC31C65B1E14BB393A30B895
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 3dd0a53ef8dcbc2fe05fbedaaab83449e073175692c619d9a6e856200b1b7bdd
- MD5 2ed6a8fb91a7f6357c2ada722f798ff1
- SHA1 0a33960fe15b4283b8ffb895cbc79c1a24ea865b
- SHA512 c8295d4d154e4e3bd9d879918e95fd21941ca9ddabc5216072b4b6b6a4fc29208671cf7c8216d2e2e22f16cb767bc72e721dc22b4c7e9f00b16670fc82baa392
- SSDEEP 1536:wSDP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:h++J3qUQm08KMWF0bFTcVHr6zf
- TLSH T1009312B9991E7D39236EC396A0179CAC8CE3DCDE151410BC30C75F1E14BB392A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH