Analysis
- geolocation tags
- user interaction
yes - max time kernel
1693s - max time network
1696s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-uk - resource tags
- submitted
02/11/2026, 16:53
General
- Target hydra-installer.exe
- Size 10.9MB
- Sample261102-vee2jsdx8m
- SHA256 9ce0713c0173d8592633b2e31aba87cce30f7308a03336636c7e8b9f354dbdab
Malware Config
Signatures
- Contacts a large (1478) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 12 IoCs
- Loads dropped DLL 38 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 12 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 40 IoCs
- Suspicious use of SendNotifyMessage 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hydra-installer.exe"C:\Users\Admin\AppData\Local\Temp\hydra-installer.exe"1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=uk-UA --accept-lang=uk-UA --mojo-named-platform-channel-pipe=4948.4708.10041980493188595230 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f52⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView /prefetch:4 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffba7fb5fd8,0x7ffba7fb5fe4,0x7ffba7fb5ff03⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,17760923254141933528,1540471612248247382,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f53⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2052 --field-trial-handle=1768,i,17760923254141933528,1540471612248247382,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f53⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1768,i,17760923254141933528,1540471612248247382,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f53⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.hydralauncher.installer\EBWebView" --webview-exe-name=hydra-installer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=uk_UA" --mojo-platform-channel-handle=3512 --field-trial-handle=1768,i,17760923254141933528,1540471612248247382,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:ce3166232a46d9df721aaae272fb77f1645701f5 /prefetch:13⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /C start "" C:\Users\Admin\AppData\Local\Temp\hydralauncher-4.3.0-setup.exe2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hydralauncher-4.3.0-setup.exeC:\Users\Admin\AppData\Local\Temp\hydralauncher-4.3.0-setup.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Hydra.exe" /FO csv | "C:\Windows\system32\find.exe" "Hydra.exe"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Hydra.exe" /FO csv5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\find.exe"C:\Windows\system32\find.exe" "Hydra.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe"C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exeC:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\hydralauncher /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\hydralauncher\Crashpad --annotation=_productName=hydralauncher --annotation=_version=4.3.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=41.10.3 --initial-client-data=0x5ac,0x5a8,0x5c4,0x588,0x5c8,0x7ff653317514,0x7ff653317520,0x7ff6533175302⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe"C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hydralauncher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,927043395578023648,14188238854423952671,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,14534035587537930964,2675412004261461037,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1836 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe"C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hydralauncher" --cors-schemes=local,gradient --fetch-schemes=local,gradient --streaming-schemes=local --field-trial-handle=1840,i,927043395578023648,14188238854423952671,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,14534035587537930964,2675412004261461037,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2068 /prefetch:112⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe"C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hydralauncher" --cors-schemes=local,gradient --fetch-schemes=local,gradient --streaming-schemes=local --app-user-model-id=gg.hydralauncher.hydra --app-path="C:\Users\Admin\AppData\Local\Programs\Hydra\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1840,i,927043395578023648,14188238854423952671,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,14534035587537930964,2675412004261461037,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3692 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe"C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hydralauncher" --cors-schemes=local,gradient --fetch-schemes=local,gradient --streaming-schemes=local --app-user-model-id=gg.hydralauncher.hydra --app-path="C:\Users\Admin\AppData\Local\Programs\Hydra\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1840,i,927043395578023648,14188238854423952671,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,14534035587537930964,2675412004261461037,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3884 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe"C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hydralauncher" --cors-schemes=local,gradient --fetch-schemes=local,gradient --streaming-schemes=local --app-user-model-id=gg.hydralauncher.hydra --app-path="C:\Users\Admin\AppData\Local\Programs\Hydra\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1840,i,927043395578023648,14188238854423952671,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,14534035587537930964,2675412004261461037,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3904 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe"C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\hydralauncher" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,927043395578023648,14188238854423952671,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,14534035587537930964,2675412004261461037,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4168 /prefetch:102⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe"C:\Users\Admin\AppData\Local\Programs\Hydra\Hydra.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\hydralauncher" --cors-schemes=local,gradient --fetch-schemes=local,gradient --streaming-schemes=local --field-trial-handle=1840,i,927043395578023648,14188238854423952671,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1844,i,14534035587537930964,2675412004261461037,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4436 /prefetch:122⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\Terraria_1.4.4.9 v4_(60319)_win_gog\setup_terraria_v1.4.4.9_v4_(60319).exe"C:\Users\Admin\Downloads\Terraria_1.4.4.9 v4_(60319)_win_gog\setup_terraria_v1.4.4.9_v4_(60319).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-6RVMF.tmp\setup_terraria_v1.4.4.9_v4_(60319).tmp"C:\Users\Admin\AppData\Local\Temp\is-6RVMF.tmp\setup_terraria_v1.4.4.9_v4_(60319).tmp" /SL5="$18004C,608293720,192512,C:\Users\Admin\Downloads\Terraria_1.4.4.9 v4_(60319)_win_gog\setup_terraria_v1.4.4.9_v4_(60319).exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbc297c728,0x7ffbc297c734,0x7ffbc297c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1416,i,15641335724998083255,12911576989940561571,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,11413535785751499052,4686735920362945191,262144 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,16812032172635603391,8960982552343419983,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,11070908700281251674,13275406799999999102,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,1467642444364402526,1136616549976764049,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4576,i,4322233567228428113,10400199709695027875,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,16887800346885084851,8885511184387452547,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,18309388295660966706,12534091539912477990,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5480,i,12929808973206195154,11872169065776080164,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5524,i,1810851469165613306,14950046499070844187,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5856,i,15743237528698880544,2255279367155012534,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,5857071752174192546,14131761650447527757,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5968,i,7761414391343296779,15657584497164738248,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6316,i,9503947587248429328,10112250413286284164,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,5477750811105163808,17588080999254776921,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6324,i,4417279658544196715,2893891753272877238,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6052,i,2565835633655879743,12917371764837514403,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,8546406496761132299,10290778537497039326,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5412,i,13897310121794016227,2568213877465402708,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4888,i,11511815838494855805,9986725929598736432,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4620,i,18418466325169245234,15680302641250017363,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,8591850724284404170,6942193559231113578,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,10253388957886794439,2289982947094925930,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6264,i,13364026014221732699,5660884975032436131,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5756,i,2241377179130366361,9088632997111800191,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3888,i,8204520244341253139,1625482348029245685,262144 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3940,i,7846796529591486396,9973346388001768578,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3920,i,1542176821565090616,17436721236017852591,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3960,i,16798197351037154239,4073808160155458073,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=4160,i,12492069995715747719,5982799084320416050,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=4588,i,7225753485356144950,6874903872567672826,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=4660,i,17491809729936071462,1670521105442443602,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4212,i,4191386540305546565,11005055192665044046,2097152 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=uk --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,10085987325673093223,7663420203038997173,524288 --field-trial-handle=1908,i,13109172649852533413,2188171279977646615,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Process Discovery
1Query Registry
3System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
27d9c50f-b889-4f16-8656-31cde6f4124c.tmp
4a96ff18-bad3-404b-8db4-774c7e5384e1.tmp
691819f1-1382-495d-b19d-1cd5b78acdfb.tmp
8fb7ed3a-8af2-4955-92e5-671774cc3742.tmp
settings.dat
18f5612e-10d7-4128-ac2b-840e092eb54a.tmp
19eb9ff5-b636-4d76-aaf9-c88d9fe73a3b.tmp
319d294a-c2b3-4489-a809-02915d48a51f.tmp
3d048f65-ef48-41fe-99f2-2d011acc29fb.tmp
7758db98-fac0-47d2-acaa-d07f4b430506.tmp
f_000006
f_000008
f_000022
temp-index
temp-index
temp-index
the-real-index
messages.json
craw_background.js
4113fb78-57f9-40a9-9582-fd15a7fadb1f.tmp
4895bdcd-be4e-4762-9bab-3fe7e239b502.tmp
4eecc321-3c22-4122-9c5c-060fc5afba87.tmp
7b85afff-88b2-46fc-9a3b-78b68fb1d169.tmp
Network Persistent State
c65b669b-7ed2-40bb-abae-83e7b88a6c36.tmp
e8dc9f78-b3cc-435e-ae72-0d69662068b5.tmp
Secure Preferences
temp-index
temp-index
temp-index
the-real-index
f42851da-2589-4fd6-92eb-e3a706f14edc.tmp
index.txt
index.txt
MANIFEST-000001
a3e8d79c-a202-4282-85cb-8ff5c57b3e84.tmp
bb2de5fa-fded-4c02-b287-71e54037d01a.tmp
c49589f0-fc8c-4606-bfa6-c52999c85566.tmp
c5d1a342-30d4-4126-8a0a-4da7a66a4210.tmp
c816c624-2399-477d-b974-0c75f741f220.tmp
ca504a95-083a-4ed9-bc33-94a5deba2201.tmp
eca70118-91a6-48b8-b354-7565a4334045.tmp
e3869f0c-d0f9-497f-b3fb-21f16e312672.tmp
BigOK.png
EULAAccepted.png
EULAShow.png
GOG_new.png
background.jpg
btn_md5.png
error.png
error_icon.png
ok.png
progress_center.png
progress_left.png
progress_right.png
slideshow.ini
slideshow_01.png
slideshow_02.png
slideshow_03.png
slideshow_04.png
slideshow_05.png
track_center.png
track_left.png
track_right.png
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
7z.dll
7z.exe
app-update.yml
LICENSE
index.cjs
libvips-42.dll
libvips-cpp-8.18.3.dll
sharp-win32-x64-0.35.0.node
package.json
versions.json
LICENSE
UPGRADING.md
binding.js
classic_level.exp
classic_level.iobj
classic_level.ipdb
classic_level.lib
classic_level.node
leveldb.lib
classic_level.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
snappy.lib
classic_level.vcxproj
classic_level.vcxproj.filters
chained-batch.js
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
Lib-link.write.1.tlog
leveldb.lastbuildstate
LICENSE
Makefile
build_detect_platform
builder.h
c_test.c
db_impl.h
db_iter.h
dbformat.h
filename.h
log_format.h
log_reader.h
log_writer.h
memtable.h
skiplist.h
snapshot.h
table_cache.h
version_edit.h
version_set.h
write_batch_internal.h
memenv.h
c.h
cache.h
comparator.h
db.h
dumpfile.h
env.h
filter_policy.h
iterator.h
options.h
slice.h
status.h
table.h
table_builder.h
write_batch.h
atomic_pointer.h
port.h
port_example.h
port_posix.h
thread_annotations.h
stdint.h
block.h
block_builder.h
filter_block.h
format.h
iterator_wrapper.h
merger.h
two_level_iterator.h
arena.h
coding.h
crc32c.h
env_posix_test_helper.h
hash.h
histogram.h
logging.h
mutexlock.h
posix_logger.h
random.h
testharness.h
testutil.h
leveldb.gyp
leveldb.vcxproj
leveldb.vcxproj.filters
atomic_pointer_win.h
port_uv.h
port_uv.h.bak
stdint-msvc2008.h
uv_condvar.h
win_logger.h
snappy.lib.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
Lib-link.read.1.tlog
Lib-link.write.1.tlog
Lib.command.1.tlog
config.h
snappy-stubs-public.h
config.h
config.h
snappy.gyp
snappy.vcxproj
snappy.vcxproj.filters
COPYING
SnappyConfig.cmake
config.h.in
snappy-c.h
snappy-internal.h
snappy-sinksource.h
snappy-stubs-internal.h
snappy-stubs-public.h.in
snappy-test.h
snappy.h
config.h
config.h
snappy-stubs-public.h
index.js
iterator.js
package.json
classic-level.armv8.node
classic-level.armv7.node
classic-level.node
classic-level.armv8.node
classic-level.armv6.node
classic-level.armv7.node
classic-level.musl.node
classic-level.node
classic-level.node
classic-level.node
LICENSE
channel.cjs
channel.mjs
colour.cjs
colour.mjs
composite.cjs
composite.mjs
constructor.cjs
constructor.mjs
index.cjs
index.mjs
input.cjs
input.mjs
is.cjs
is.mjs
libvips.cjs
libvips.mjs
operation.cjs
operation.mjs
output.cjs
output.mjs
resize.cjs
resize.mjs
sharp.cjs
sharp.mjs
utility.cjs
utility.mjs
build.js
package.json
common.h
metadata.h
operations.h
pipeline.h
stats.h
utilities.h
achievement.wav
UMU-DATABASE-NOTICE.md
icon.png
linux-game-capture.html
screenshot-sound.html
screenshot.mp3
tray-icon-dark.png
tray-icon.png
chat-message.wav
elevate.exe
LICENSE-UNRAR
THIRD_PARTY_NOTICES.txt
concrt140.dll
hydra-native.node
hydra_torrent_bridge.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
torrent-dependencies.json
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
LICENSE
NOTICE.md
hydra-epic-process.exe
hydra-epic-process.json
legendary.exe
managed-legendary.pyz
AES.py
AES.pyi
ARC2.py
ARC2.pyi
ARC4.py
ARC4.pyi
Blowfish.py
Blowfish.pyi
CAST.py
CAST.pyi
ChaCha20.py
ChaCha20.pyi
ChaCha20_Poly1305.py
ChaCha20_Poly1305.pyi
DES.py
DES.pyi
DES3.py
DES3.pyi
PKCS1_OAEP.py
PKCS1_OAEP.pyi
PKCS1_v1_5.py
PKCS1_v1_5.pyi
Salsa20.py
Salsa20.pyi
_ARC4.pyd
_EKSBlowfish.py
_EKSBlowfish.pyi
_Salsa20.pyd
__init__.py
_chacha20.pyd
_mode_cbc.py
_mode_cbc.pyi
_mode_ccm.py
_mode_ccm.pyi
_mode_cfb.py
_mode_cfb.pyi
_mode_ctr.py
_mode_ctr.pyi
_mode_eax.py
_mode_eax.pyi
_mode_ecb.py
_mode_ecb.pyi
_mode_gcm.py
_mode_gcm.pyi
_mode_kw.py
_mode_kwp.py
_mode_ocb.py
_mode_ocb.pyi
_mode_ofb.py
_mode_ofb.pyi
_mode_openpgp.py
_mode_openpgp.pyi
_mode_siv.py
_mode_siv.pyi
_pkcs1_decode.pyd
_pkcs1_oaep_decode.py
_raw_aes.pyd
_raw_aesni.pyd
_raw_arc2.pyd
_raw_blowfish.pyd
_raw_cast.pyd
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ctr.pyd
_raw_des.pyd
_raw_des3.pyd
_raw_ecb.pyd
_raw_eksblowfish.pyd
_raw_ocb.pyd
_raw_ofb.pyd
BLAKE2b.py
BLAKE2b.pyi
BLAKE2s.py
BLAKE2s.pyi
CMAC.py
CMAC.pyi
HMAC.py
HMAC.pyi
KMAC128.py
KMAC128.pyi
KMAC256.py
KMAC256.pyi
KangarooTwelve.py
KangarooTwelve.pyi
MD2.py
MD2.pyi
MD4.py
MD4.pyi
MD5.py
MD5.pyi
Poly1305.py
Poly1305.pyi
RIPEMD.py
RIPEMD.pyi
RIPEMD160.py
RIPEMD160.pyi
SHA.py
SHA.pyi
SHA1.py
SHA1.pyi
SHA224.py
SHA224.pyi
SHA256.py
SHA256.pyi
SHA384.py
SHA384.pyi
SHA3_224.py
SHA3_224.pyi
SHA3_256.py
SHA3_256.pyi
SHA3_384.py
SHA3_384.pyi
SHA3_512.py
SHA3_512.pyi
SHA512.py
SHA512.pyi
SHAKE128.py
SHAKE128.pyi
SHAKE256.py
SHAKE256.pyi
TupleHash128.py
TupleHash128.pyi
TupleHash256.py
TupleHash256.pyi
TurboSHAKE128.py
TurboSHAKE128.pyi
TurboSHAKE256.py
TurboSHAKE256.pyi
_BLAKE2b.pyd
_BLAKE2s.pyd
_MD2.pyd
_MD4.pyd
_MD5.pyd
_RIPEMD160.pyd
_SHA1.pyd
_SHA256.pyd
_SHA384.pyd
_SHA512.pyd
__init__.py
__init__.pyi
_ghash_clmul.pyd
_ghash_portable.pyd
_keccak.pyd
_poly1305.pyd
cSHAKE128.py
cSHAKE128.pyi
cSHAKE256.py
cSHAKE256.pyi
keccak.py
keccak.pyi
PEM.py
PEM.pyi
PKCS8.py
PKCS8.pyi
_PBES.py
_PBES.pyi
__init__.py
Numbers.py
Numbers.pyi
Primality.py
Primality.pyi
_IntegerBase.py
_IntegerBase.pyi
_IntegerCustom.py
_IntegerCustom.pyi
_IntegerGMP.py
_IntegerGMP.pyi
_IntegerNative.py
_IntegerNative.pyi
_modexp.pyd
DH.py
DH.pyi
HPKE.py
KDF.py
KDF.pyi
SecretSharing.py
SecretSharing.pyi
__init__.py
__init__.pyi
_scrypt.pyd
DSA.py
DSA.pyi
ECC.py
ECC.pyi
ElGamal.py
ElGamal.pyi
RSA.py
RSA.pyi
__init__.py
_curve.py
_curve25519.pyd
_curve448.pyd
_ec_ws.pyd
_ed25519.pyd
_ed448.pyd
_edwards.py
_montgomery.py
_nist_ecc.py
_openssh.py
_openssh.pyi
_point.py
_point.pyi
__init__.py
__init__.pyi
random.py
random.pyi
__init__.py
common.py
test_AES.py
test_ARC2.py
test_ARC4.py
test_Blowfish.py
test_CAST.py
test_CBC.py
test_CCM.py
test_CFB.py
test_CTR.py
test_ChaCha20.py
test_ChaCha20_Poly1305.py
test_DES.py
test_DES3.py
test_EAX.py
test_GCM.py
test_KW.py
test_OCB.py
test_OFB.py
test_OpenPGP.py
test_SIV.py
test_Salsa20.py
test_pkcs1_15.py
test_pkcs1_oaep.py
__init__.py
common.py
test_BLAKE2.py
test_CMAC.py
test_HMAC.py
test_KMAC.py
test_KangarooTwelve.py
test_MD2.py
test_MD4.py
test_MD5.py
test_Poly1305.py
test_RIPEMD160.py
test_SHA1.py
test_SHA224.py
test_SHA256.py
test_SHA384.py
test_SHA3_224.py
test_SHA3_256.py
test_SHA3_384.py
test_SHA3_512.py
test_SHA512.py
test_SHAKE.py
test_TupleHash.py
test_TurboSHAKE.py
test_cSHAKE.py
test_keccak.py
__init__.py
test_PBES.py
test_PKCS8.py
__init__.py
test_Numbers.py
test_Primality.py
test_modexp.py
test_modmult.py
__init__.py
test_HPKE.py
test_KDF.py
test_SecretSharing.py
test_ecdh.py
test_rfc1751.py
__init__.py
test_DSA.py
test_ECC_Curve25519.py
test_ECC_Curve448.py
test_ECC_Ed25519.py
test_ECC_Ed448.py
test_ECC_NIST.py
test_ElGamal.py
test_RSA.py
test_import_Curve25519.py
test_import_Curve448.py
test_import_DSA.py
test_import_ECC.py
test_import_RSA.py
__init__.py
test_random.py
__init__.py
test_dss.py
test_eddsa.py
test_pkcs1_15.py
test_pss.py
__init__.py
test_Counter.py
test_Padding.py
test_asn1.py
test_number.py
test_rfc1751.py
test_strxor.py
__init__.py
__main__.py
loader.py
st_common.py
DSS.py
DSS.pyi
PKCS1_PSS.py
PKCS1_PSS.pyi
PKCS1_v1_5.py
PKCS1_v1_5.pyi
__init__.py
eddsa.py
eddsa.pyi
pkcs1_15.py
pkcs1_15.pyi
pss.py
pss.pyi
Counter.py
Counter.pyi
Padding.py
Padding.pyi
RFC1751.py
RFC1751.pyi
__init__.py
_cpu_features.py
_cpu_features.pyi
_cpuid_c.pyd
_file_system.py
_file_system.pyi
_raw_api.py
_raw_api.pyi
_strxor.pyd
asn1.py
asn1.pyi
number.py
number.pyi
py3compat.py
py3compat.pyi
strxor.py
strxor.pyi
__init__.py
__init__.pyi
AUTHORS.rst
LICENSE.rst
METADATA
RECORD
WHEEL
top_level.txt
managed-runtime.json
managed.py
LICENSE.txt
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_zoneinfo.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python.cat
python.exe
python3.dll
python313._pth
python313.dll
python313.zip
pythonw.exe
select.pyd
sqlite3.dll
unicodedata.pyd
vcruntime140.dll
vcruntime140_1.dll
winsound.pyd
config.yaml
ludusavi.exe
windows.vbs
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
nsDialogs.dll
nsExec.dll
nsis7z.dll
messages.json
138136b9-683f-4f64-894e-41ab20c6a2af.tmp
18ac9ae6-c416-4adf-bd6f-0fd26dadc78e.tmp
settings.dat
settings.dat
settings.dat
throttle_store.dat
1e5296ad-3faa-4c39-85e8-f02c76f1f8eb.tmp
temp-index
the-real-index
CURRENT
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
cd6825fa-da45-4fe5-9be7-82951a428573.tmp
fbb56a92-4122-45e1-a17a-532ea218ad90.tmp
MANIFEST-000001
c83d3d3c-f6f1-42f0-866a-8a26245a8251.tmp
data_0
data_1
data_2
data_3
Local State
c1b2f443-a25a-4c82-b8df-e8030b5d6e86.tmp
d9cd097a-f589-4f51-8bdd-180640cf6a03.tmp
default.exc
f_000009
f_00000c
f_00000e
f_000010
f_000012
f_000013
f_000014
f_00001a
f_00001b
index
temp-index
temp-index
the-real-index
5472301c-1549-402a-98df-11088a1cf9b2.tmp
6b1315d0-49a2-4f2a-920b-69f08fcbccc7.tmp
8c260733-fe42-42be-a0dd-03004ad51b59.tmp
9db9d412-1cda-4d08-833b-3c0a34878b16.tmp
Network Persistent State
TransportSecurity
bd492006-b7d7-4e9f-bd19-478e2a3a5fbc.tmp
c4ed5250-66de-47c6-af27-39ecdcbe0a1c.tmp
Preferences
ed61c2a1-df4b-4025-afd5-806ab6f905aa.tmp
000002.dbtmp
info.txt
network.txt
uk-UA-5-0.bdic
Hydra.lnk
memory/468-7519-0x0000000004D90000-0x0000000004D9E000-memory.dmp
memory/468-7634-0x0000000004A30000-0x0000000004AE7000-memory.dmp
memory/468-7466-0x0000000000CF0000-0x0000000000E42000-memory.dmp
memory/468-7444-0x0000000000CF0000-0x0000000000E42000-memory.dmp
memory/468-7476-0x0000000004A30000-0x0000000004AE7000-memory.dmp
memory/468-7632-0x0000000000CF0000-0x0000000000E42000-memory.dmp
memory/468-7633-0x0000000000400000-0x0000000000415000-memory.dmp
memory/468-7635-0x0000000004D90000-0x0000000004D9E000-memory.dmp
memory/796-4763-0x00007FFBC9860000-0x00007FFBC9861000-memory.dmp
memory/796-4762-0x00007FFBC9E50000-0x00007FFBC9E51000-memory.dmp
memory/1296-5670-0x00000194A71C0000-0x00000194A71C1000-memory.dmp
memory/1296-5671-0x00000194A71C0000-0x00000194A71C1000-memory.dmp
memory/1296-5674-0x00000194A71C0000-0x00000194A71C1000-memory.dmp
memory/1296-5675-0x00000194A71C0000-0x00000194A71C1000-memory.dmp
memory/1296-5672-0x00000194A71C0000-0x00000194A71C1000-memory.dmp
memory/1296-5666-0x00000194A71C0000-0x00000194A71C1000-memory.dmp
memory/1296-5664-0x00000194A71C0000-0x00000194A71C1000-memory.dmp
memory/1296-5673-0x00000194A71C0000-0x00000194A71C1000-memory.dmp
memory/2572-25-0x00007FFBC9510000-0x00007FFBC9511000-memory.dmp
memory/2764-7443-0x0000000000830000-0x0000000000869000-memory.dmp
memory/2764-7631-0x0000000000830000-0x0000000000869000-memory.dmp
memory/2764-7438-0x0000000000830000-0x0000000000869000-memory.dmp
memory/4664-112-0x00007FFBC9510000-0x00007FFBC9511000-memory.dmp