b420dc482745aba10ef5e99907e10b5ae8fb6dfe0160506097d0a5a0d19c6f9c

Analysis

user interaction
yes
max time kernel
118s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DupeMod (1).jar
Size 521KB
Sample260825-ctlhrsdr51
SHA256 b420dc482745aba10ef5e99907e10b5ae8fb6dfe0160506097d0a5a0d19c6f9c
MD5 b34d5aca877324e94612b6d3b06832b5
SHA1 224442bf02688abd09b22ab7de04139d34f79648
SHA512 894bfcfa9f49117459c021a85954543b268245b2bcc32bd5515fbf3672dd92e4cc1710f28cfbb735fc319e92a87a4fc79efafe3d5813dd2099b281d3427d42e5
SSDEEP 12288:hhcXoPb958oT3zY2NyXRbCnTecVIUFAbXQUnRgIkdC7G3DiRQUv:hhcMNTf4tCTHxWnvyzHUv
TLSH
T136B4238F729B29C6FC99087C610E495E0C0B41BC1987F84898973BAEB939D0B379DD5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2864	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 5152	2932	chrome.exe	91
PID 2932 wrote to memory of 2864	2932	chrome.exe	92
PID 2932 wrote to memory of 3144	2932	chrome.exe	93
PID 2932 wrote to memory of 3144	2932	chrome.exe	93
PID 2932 wrote to memory of 2804	2932	chrome.exe	95
PID 2932 wrote to memory of 2804	2932	chrome.exe	95
PID 2932 wrote to memory of 3468	2932	chrome.exe	96
PID 2932 wrote to memory of 2196	2932	chrome.exe	97
PID 2932 wrote to memory of 3468	2932	chrome.exe	96
PID 2932 wrote to memory of 2196	2932	chrome.exe	97
PID 2932 wrote to memory of 2128	2932	chrome.exe	98
PID 2932 wrote to memory of 2128	2932	chrome.exe	98
PID 2932 wrote to memory of 4568	2932	chrome.exe	100
PID 2932 wrote to memory of 4568	2932	chrome.exe	100
PID 2932 wrote to memory of 2704	2932	chrome.exe	101
PID 2932 wrote to memory of 2704	2932	chrome.exe	101

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\DupeMod (1).jar"
1⤵
PID:5624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdd5a0c728,0x7ffdd5a0c734,0x7ffdd5a0c740
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,6309396962210037387,14811660841205926520,524288 --field-trial-handle=1984,i,1151724091096157260,11530123054545265071,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,5973417221260674925,15954498245493441152,262144 --field-trial-handle=1984,i,1151724091096157260,11530123054545265071,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,7564674878765485064,6991493607494783966,524288 --field-trial-handle=1984,i,1151724091096157260,11530123054545265071,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,10541814529230605845,582174894777631217,2097152 --field-trial-handle=1984,i,1151724091096157260,11530123054545265071,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3348,i,13263927418072922970,12980589989239370307,2097152 --field-trial-handle=1984,i,1151724091096157260,11530123054545265071,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,12867281627369117346,580114228479265446,2097152 --field-trial-handle=1984,i,1151724091096157260,11530123054545265071,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,18048203196746722751,7235546337595032345,524288 --field-trial-handle=1984,i,1151724091096157260,11530123054545265071,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4864,i,1392929844511657129,12510574044062992899,2097152 --field-trial-handle=1984,i,1151724091096157260,11530123054545265071,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 bfe61a18b8a3c8392c460a302911e8049ecaaa7748198b4b576c2dbb90188d5c
MD5 a0f1c72fac2f5e0d0ff64ddb0664ff29
SHA1 9461ae34a8fe56bc1ec476ee7cc5289c599577f0
SHA512 1c486e3742bbb4597df748312cd6dc81da8faa2bad33ed5f04c3a66d0ff9cb75b618ab8aaae657cac62d8afda587454a1fa35d6f204e8f5772e0e3e60a2dc163
TLSH
T166C01202D5E44A4DCB4030F21022D94332723A1B94A7ABA3C6D463BEED23BF10131103
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 830d61767c795f381e4e4ab45dbed01845a5fac4b6d0b3d0b9ff1175e7b1cc6a
MD5 8e01a59d0ed6bfd075e475f5e9be6374
SHA1 94205435ce481db535638ec7b69bef4fce5551df
SHA512 7a2b0485a064085df393f753e02f187a9d3e1f4d1642dd2a2b92b0b74f891a56a4969e09ad301950c2bfa6330ac97f7e81a0f11559259b1e5b0375728581539f
TLSH
T15D518BF7C3E8C52D891156F8AB216F1FCE290914431C3C66C8D8AF1B93E28B2E24125F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f1095d4004c8d2e15264fcc585d40c616628076e293970fed0d504137ed95439
MD5 eab8dece08a6cdc9a5cf850f82a1d24f
SHA1 2fbe685d37696a0679f521ea5188cc7ed76c90ea
SHA512 4de9b21cb2c575f09cd6fd06932f34c9c4130e77d5e80365d1074cd65127b6f6f2c2219fb4a1b71cf7bc4b13e90e18f4db4a417988ebce3c9c99be942a60f6e0
TLSH
T181F0C9A3E67DB03384BD886B1E00BC06AABAA03202415CE0CE5A426EE0918F71F02403
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d8d1ea086887b052ecead399af64986fba4176602f6aeb26645117c3dcc05cb0
MD5 27e4d64cbb82baca80d7486d911f53b1
SHA1 bd36b29c9066b33663bbd7342c345a3a410fc23d
SHA512 69b8e80e11cc040ecc3d40dcf7d25378d828b10026fecc49a701e515dc523bb76a37dc5c5b15d9ee42ec9ca54f893537f0251f33d45f166827cd5ce3b53ce13a
SSDEEP 192:FRMZCAscv7hAPRp2PT98Hsb+WN03LMK4e42ei2sCKXaTDO8pXPyIsnAUgR:FRMZPfAXWuwUf62B290aTy8ZR
TLSH
T12B42B71ABA14797BACCBC22AF9717753D3F5102265E02E84E7FC496C15E75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 7cebb5cb49f1c275a3458195e145b6980aeb0df5646b9bbacf38665be8d01727
MD5 fd7a104b749445cf7ab1b5a3f43cd26c
SHA1 269c58e23f343788280145f00265187391520d9e
SHA512 d995deb101c95d509ce2bdc970af4be7ea63d041d4d0393ad9b1e83d22782d35eb7554ae77fa6f886af05f5baa225b701b17ea588b031199af548fdc7580c3d0
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKN9srtumtK7v:Majm97KxkXqKf/pUZNCgVLH2HfgslN1e
TLSH
T1CE32D727A48D9E7F0FD8D51CCC136F8B6CF5029662780D2456FB5D0803A5B8E115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5ad85eba73f7832073940cfcda04ab9a161c66695dba475dd6f2aed46d882038
MD5 e6e396ecf31f17a24d1b238ab7755c3a
SHA1 0b2b56d7b563e26c4acab546e6756a83d4398db1
SHA512 29d1e7108aebdbd4658a9029824b0502d65895f138a9271be753947dc05f9ecacd1fe432d022dd0e7124961f0d5fbe0e614498a1113447b111c3fec635ae41d4
SSDEEP 96:59C6id+oJm4V0FH+pqf+HBKyouDtVSl8h4otok5GDDtB6+GyvkfFl65zrte4GwFK:vC1HJm5FHuPg0iUDozWzFl6h44GwFU9
TLSH
T142C11AB1B87C6C7359F7D641F4432983CEE46157A990AE94DAF90F0D01E30EC2382527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 732d2e2cd91acb769f741963ecc3c14387a03f016257464400918139c1c69c92
MD5 4840501051e2b9f8825b405336a509a5
SHA1 089551c61dee89cbeff5564ce3e5579c7d9e49ff
SHA512 fc1e4457a7b864bd6cf0f964e583b1837267cecee54eec88cdadb0f6cfff604877cb6ad4dc13cbef5c72fe40c9d61f5e4bc7cb4f785d9f1a0653e7058274fa60
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5GHDtB6eGyvkonzLob1v4a:MC0HJm5FHuPgXDUDEzW8nzLobZ
TLSH
T149A12BB164694CB759B7D645F8932A83DEE4A227A9A0EF80D9DD1E0C11F31E81341927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5624-13-0x000001A8CDA60000-0x000001A8CDCD0000-memory.dmp

Download

memory/5624-2-0x000001A8CDA60000-0x000001A8CDCD0000-memory.dmp

Download

memory/5624-12-0x000001A8CC1E0000-0x000001A8CC1E1000-memory.dmp

Download