b56fdb0fdb73f4d481fe9ff80524cf2fe50bec7322385eaa5472179bedceeef9

Analysis

user interaction
yes
max time kernel
115s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bloomclient-crackedby648k.exe.jar
Size 2.0MB
Sample261101-13phsadv91
SHA256 b56fdb0fdb73f4d481fe9ff80524cf2fe50bec7322385eaa5472179bedceeef9
MD5 7ab5bf1922cbe8555b9050195a5269d2
SHA1 7197088de39976dd986eab6e298b0326e0044309
SHA512 9996ca1c7a06efa6a87bfdfc308f604502903c8b4fc40462f7f5880872ab94f2423b27f05dd576ff1491280d0fcb4c2fbb5744fd697e263896d4b1df47bbabf4
SSDEEP 49152:4iR6Mp1NCE/UTpofGLltU90MhIF0JRQPd+pdLmwDH63r+PH:rnVV+Bt9mHJiGgwDkr+f
TLSH
T184A5021C7EAEB77BF447E63B018F90B3F67819EA8800948363D5520F5850D466369BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3044	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{5A344AAF-A901-429F-90DC-3E63E7AEE45E}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3788	3048	chrome.exe	97
PID 3048 wrote to memory of 3044	3048	chrome.exe	98
PID 3048 wrote to memory of 2444	3048	chrome.exe	99
PID 3048 wrote to memory of 2444	3048	chrome.exe	99
PID 3048 wrote to memory of 1200	3048	chrome.exe	101
PID 3048 wrote to memory of 1200	3048	chrome.exe	101
PID 3048 wrote to memory of 1624	3048	chrome.exe	102
PID 3048 wrote to memory of 3948	3048	chrome.exe	103
PID 3048 wrote to memory of 1624	3048	chrome.exe	102
PID 3048 wrote to memory of 3948	3048	chrome.exe	103
PID 3048 wrote to memory of 3980	3048	chrome.exe	104
PID 3048 wrote to memory of 3980	3048	chrome.exe	104
PID 3048 wrote to memory of 1856	3048	chrome.exe	105
PID 3048 wrote to memory of 1856	3048	chrome.exe	105
PID 3048 wrote to memory of 4428	3048	chrome.exe	107
PID 3048 wrote to memory of 5028	3048	chrome.exe	112
PID 3048 wrote to memory of 5028	3048	chrome.exe	112
PID 3048 wrote to memory of 4448	3048	chrome.exe	113
PID 3048 wrote to memory of 3720	3048	chrome.exe	114
PID 3048 wrote to memory of 4936	3048	chrome.exe	115
PID 3048 wrote to memory of 1464	3048	chrome.exe	116
PID 3048 wrote to memory of 3692	3048	chrome.exe	117
PID 3048 wrote to memory of 1464	3048	chrome.exe	116
PID 3048 wrote to memory of 4428	3048	chrome.exe	118
PID 3048 wrote to memory of 1296	3048	chrome.exe	120
PID 3048 wrote to memory of 1296	3048	chrome.exe	120
PID 3048 wrote to memory of 1260	3048	chrome.exe	122
PID 3048 wrote to memory of 1260	3048	chrome.exe	122
PID 3048 wrote to memory of 2988	3048	chrome.exe	123
PID 3048 wrote to memory of 2988	3048	chrome.exe	123

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Bloomclient-crackedby648k.exe.jar
1⤵
PID:3080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff2505c728,0x7fff2505c734,0x7fff2505c740
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,12715508158367241961,13607705444657011393,524288 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,14681299999948137100,4384776084898436725,262144 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,5606632301710182971,14737632856027744745,524288 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,7421887066967749546,16074485148958596401,2097152 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2744 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3052,i,6468822022596396505,5505535410803002982,2097152 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,9813017617814928112,9405311506782171912,2097152 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,10074467008772550360,3761523099783954901,2097152 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,17737253964723755702,4278783575011579856,524288 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5560,i,1347762722442081285,2014416487853358050,2097152 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=240 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,13099121468115372514,14350822276862991395,524288 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,14256755309324367038,15736561476374958269,524288 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,12996441876208324070,12626502950642022894,524288 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,18286790400287579923,16792183953526586013,524288 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,12961761612800331355,17080070422894097360,524288 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,6032753409974349729,3209280794747099618,524288 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=864,i,5611682167226101744,11937762456093201811,2097152 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5708,i,7645223953113174246,8625397234076396591,2097152 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5400,i,10675576256478451933,5259397766544170049,2097152 --field-trial-handle=1800,i,8217748472486913703,16700312063560316092,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

205cd217-47c5-4492-bebb-0d96dd411bf5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\205cd217-47c5-4492-bebb-0d96dd411bf5.tmp
Size 130KB
SHA256 776a4a06b8afdbf7a77bcef6a4f0f3efc1e3ccbb9604dd639ac00e9815ee54df
MD5 a3dbb0318472bb48576f8169b3a83138
SHA1 692c13ae75616c982ea4fab3e95847202dd178e9
SHA512 438a62e10b700327333ec04c3c122230bed1a8ec869884e64f0f0be4ccbeef2b01b0b80f24f3fcd9b3adf58215547466ae91ab98260817dfee45c827186d1efd
SSDEEP 3072:xFv+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:Lv+hFD+7t56OD9ZfSApprE
TLSH
T196D30232AA95D8BBC9F86541B157A300DE766CED41DE3A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a6d4a6c-9967-47ca-bdcb-cc09e71a8d48.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2a6d4a6c-9967-47ca-bdcb-cc09e71a8d48.tmp
Size 414B
SHA256 2b428a7745f8f71f447513e8a26044354dc4f1fd7b154e197dfd8e4a903100a5
MD5 0692a51657440d36627d5c5c6e9cc00d
SHA1 f9130bf2d4c083a76ea52a80e460f048935e1cd9
SHA512 089a9bd6f5a1d28af17d170ff9bd0a3144b477ed72e96e0798e42a57f85cb12f7992524eb769df8d36bd93e9fddf514fc6e1d07c37d5db1bc29c9fed524dc256
TLSH
T107E02BA5CD619C6B19FC072C5064074AE65113572B41465F373C9A1C8FF923A018586C
MD5 SHA1 SHA512 TLSH

Submit Download

4e6f8a91-9645-4b35-b505-9b776774f3b5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4e6f8a91-9645-4b35-b505-9b776774f3b5.tmp
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b5729cf-1c61-4442-9dcc-77afe36620eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7b5729cf-1c61-4442-9dcc-77afe36620eb.tmp
Size 13KB
SHA256 1daf60d5c92ff304ea9c287c4977bb5cfefccb29d9d0dfe7dcc51c35fd233a50
MD5 e9f48f886d7df5cfb404658d033a3849
SHA1 55a83dd655365b1d1a6b0b21b7f16e1a2509b8dc
SHA512 1cca1c828d9891aa51350472c595a2ce3a2b5bc1a8e5b96b3a608fc31ddfbac9ae5f40ad8191cc7f02f1889dfa325ddd3e2db73156623ded261452bfffd38ad7
SSDEEP 192:BRLcBzYw8u5tv7TpqPRpgcJ+e9/Hsb+WNUqCg4gPEC/ASIwkw0ayVyIsnAUgraJ:BRLmzYQ5NfSXHhwJvElwUaye
TLSH
T12452B52AAC24393B6CEBC62AF9127B16E3F5102164952E84E6FC8D3C29E75CC7217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c3154ee-3b09-45b6-b703-a03aea7e5293.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9c3154ee-3b09-45b6-b703-a03aea7e5293.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 350KB
SHA256 9213695e49135b2b4210878deefb3175bda171b6b435beac015f402684e5ddd0
MD5 ec8b9b0c9f3c90635368e649421dfa07
SHA1 abe7ca6128a3b1b393c902eff3ed39605279cd9f
SHA512 2072062f4ed9d3a5f4d69ed6fa79c52c12336147b03b9e0258a61cfb7efa411ec230fc8c28f2dca7bb8253bc48ecfbc51a06083ae5433962dd0f85a56f96acb0
SSDEEP 6144:VatIoleCgd8D9UZrUqr3NI5bwvb8PgMvlYeUyPWzDL80niVq03XfEt:gl3G8DWiqru5bU2yeUueL80mXfy
TLSH
T132742317566A63A822A9DCAAFFF31F02D4EDC23150ACC45B412653BCD64E6933538F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 936B
SHA256 125714b35e7df1aaa34a338b7832c336d06a283425b36a1b19c85feb189cfa4d
MD5 ab41031f3a7661b08f2c3505b1d92006
SHA1 84f4a699986f2631dae467d9a042e100b09c7778
SHA512 2b100d5dda612c697cd65af494877aef02b747c48c9e5912fd35836af1fa4a6ca52a1fec5124156e75368372318da1127c8298d0c87b6989711e62a348223642
TLSH
T1FC11CBA9ADD3E343CF2845B02B6520D02D8494ACAD462EFE1CF18CFC319A66015005C4
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ff43f68c-9d56-4a4a-932f-a8207a25b1d7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ff43f68c-9d56-4a4a-932f-a8207a25b1d7.tmp
Size 7KB
SHA256 1160b5abe03f769f211334177494d0d768c7a3c80e6399f1745a1ed0794b88e7
MD5 683a78330e9576e5dbb225795aed6c4d
SHA1 f0fb94dbd952bab73ce8a58cb4c7c627afa4aecc
SHA512 890d5c180e189f66bda8e11f233d7af9c43a192b4415f3fad8e1baebd5c70f67b782543b0e62b58f26693b435befd7ffe7a36cc68262a8d914022df860981ab5
SSDEEP 192:DZG+4wLFH4DJZRaIATdR3Yu6maPtHXIUIZIXI/vauOfPdNP87R:DZG+4wLFH4DJZRaIATdR3Yu6malHXIUs
TLSH
T148F1ADF7C3D8C52D881156F49B26AF1ECE291A28431C3C67C9D8BE4B93E2471E25524F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 5a1125b9ca446f8d818412c715f586d7138d6c48e14a8b0fff7f529ae4e6c6c9
MD5 597c2b668d51550124a2d46990fbd38f
SHA1 c16718029489aba0ca7d54bee3a8acfd83911b4a
SHA512 658e2d2bcad1e41f8dcf8043f91b768ff7469964721b70cba4cb75d1be3cde111655e2c24152aba61d5687ba21773cefb5e19587fa666bde9510d16613fa8f48
TLSH
T16EB0220000808282E22003B8AEC008C83FA22C280B8F0C0300F0A2A0C3323C28202282
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a1535a20-46f6-4d67-a7da-b58d797cd228.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a1535a20-46f6-4d67-a7da-b58d797cd228.tmp
Size 12KB
SHA256 d14d35003c809f4c1a4d68865d914ef984180f01e660f193a165677b35bb2288
MD5 0edb7dfabd34a88b413ff10dc963f344
SHA1 62f8dba5f756991f865f4c1a43b16786f6c505e1
SHA512 5d0aaf838af75813aac3469333fd3184b18e4b79c05bd8e2d770c09338ec146eb80646b128ffc7190d793c1ea5f7e6812c1fe3e3a2e0c64cd42fd66ed45d9b8e
SSDEEP 192:BRLcBzYw8u5tv7TpAPRp2cJf9/Hsb+WNnCg4caYr/3SIwkw0a2VyIsnAUgraJ:BRLmzYQ5NfUXfhwd2Y9wUaOe
TLSH
T11B42C52EAD24393B6CEBC22AF9227B17E7F5102164952E84E6F8CD3C25E75CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7194e2e-d924-4cc3-b2b6-aa6710f8142e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a7194e2e-d924-4cc3-b2b6-aa6710f8142e.tmp
Size 12KB
SHA256 3a0dfad9534844862f2ae07c039572f2e93eeb595883556a0a1cea41e5a8395d
MD5 3cb50207d9d9f960e506b98bc2ee313f
SHA1 130060e2669d7dae76e134937ce866c94e19f117
SHA512 d4243b06a4a7f6972b85b857afe290a7a209e3dbc00f65320d29a4c0fee0c5167d6485a863d1ea65c5c5c9a7891cbe0df840b56a9623a501df36cb8786db8de5
SSDEEP 192:BR3cw8u5tv7UpAPRp2c+C9/Hsb+WNnCg4zp2ASIwkw0axVyIsnAUgtaJ:BR3cQ5NAUXvhwdq2iwUaX8
TLSH
T14742C42AAD24353B6CEBC22AF9227B17D3F5103164952E84E6F8CD7C29E75CC621B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0637c49-16d9-4843-a149-98aa4c18b22e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c0637c49-16d9-4843-a149-98aa4c18b22e.tmp
Size 269KB
SHA256 1a9997b6b7e778b627bd6422bcd6a420309f05c73a0b721c881670bd50b5d822
MD5 38d90c50195bf6c0906a677f32f3c672
SHA1 a309a8a1646e0a8acbdebf8721f3297bd62511b2
SHA512 c829d8ffdbefffaba6b778af234942e3b55ab41065152922f57719a9e8abfd32d7c39d746654044942ee301b0a7caab033100884ef238bcac625ef79c43fa20c
SSDEEP 6144:nx3IyQcfSxZLpN1YNTRJsX0qZcpYPgv3Y+hFD+7t56OD9ZfSApprI:nx3rfqrpnIlJsXzhQ3YyFSXD9ZfS4G
TLSH
T1D44412B7A5AADD3BC9759282F077B390CAB12CD8849D1F4508A25FCE626BC480357F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f290fd2e-1bd1-4f7c-bc0f-32084919ac3d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f290fd2e-1bd1-4f7c-bc0f-32084919ac3d.tmp
Size 270KB
SHA256 32da14bd3fd535ba617731ffdaabb3af4842ae66a8eb9e0a7ac2704cf51be88f
MD5 beb54e1b4ce5b9a85e6065ac107e6c09
SHA1 afd3726ed9b1dab292770b3e119df331107ecdf8
SHA512 030bdc0e84eac6b117bab850bb38a363f89eb293187ec7958cc0f1130b245a68bd2926f4166a87bbed563b9114465efb95d3c5e61406b0f17a36df00c8be4303
SSDEEP 6144:nx3hlyQcfSxZLpN1YNTRJsX0qZcpYPgv3Y+hFD+7t56OD9ZfSApprI:nx3ifqrpnIlJsXzhQ3YyFSXD9ZfS4G
TLSH
T1F84412B6A5A6DD3BC9B59242F073B380CEB13DD8858D5F4908925FCE626F8480713E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4bfb0de-014c-44b0-8dcb-29a8bf627b1d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f4bfb0de-014c-44b0-8dcb-29a8bf627b1d.tmp
Size 269KB
SHA256 e47f1cf99fedb27b4fe38ee20cf055053a9db419cff4b9c57157049a90e833c8
MD5 eaaf444ae0b6ee058b0b0ad41f9b5595
SHA1 c0b65f5fd7f7dd3a24e863cb305cc6746e839b9e
SHA512 f8080a4d713b8610d3e79411fc90272d2aa7cd12fcb9518e6e809b947cebcf69fb4f63fb664f6fa1bbe83ab39d59d14c783405222329895d93186c0d90721104
SSDEEP 6144:no3IyQcfSxZLpN1YNTRJsX0qZcpYPgv3Y+hFD+7t56OD9ZfSApprI:no3rfqrpnIlJsXzhQ3YyFSXD9ZfS4G
TLSH
T1304412B7A5AADD3BC9759282F077B390CAB12CD8849D1F4508A25FCE626BC480357F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html.crdownload

Path C:\Users\Admin\Downloads\index.html.crdownload
Size 16KB
SHA256 d6de90cb4e9c1af3802c68e415fdfeac6d690c4bcc6a4a3f91822ab3c58a6feb
MD5 4fc515986b29a7d197e2e44997c95cd2
SHA1 ad2a5a6509dbfe8dd81dfa126ad87d482672c1c4
SHA512 860eacc7103c25c3e3595de1836f7b047dd35b9cb389827e0acdf579fed155eb1f4ea67333ffb8031183d9e8d30a530c4f3af3fe736a12d9634b62fa23c16875
SSDEEP 384:lUQpp888+c1RcWPuZyIIeM+c1RcWGbKl82DOTDC8dwWbdnC+:lUQp18+wcZyIIeM+wYbKl836WbRC+
TLSH
T1A272C723A454503E012B47CDDE97F728726F722FFA450941F2FD86A69B97ED2E41B404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3080-11-0x0000018B11A20000-0x0000018B11A21000-memory.dmp

Download

memory/3080-12-0x0000018B132F0000-0x0000018B13560000-memory.dmp

Download

memory/3080-2-0x0000018B132F0000-0x0000018B13560000-memory.dmp

Download