hxxps://9f65q8hbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001KWeKRtfoXOkszVTMM_JkXIoR9084aOMT36DyIVGb81vVmT-S7jxhAP3LSf0QzjjbJS5oUka_ty9HNDj8u6zmWU08YTNQSBEAd-QD-7d9B1z-_rVM9TMcs8bRBp2sgvcEfchV4i1QyIJLcCOa8euPYw==&c=3WwCiTChwT_yvwRdvgLibMJnrAjFY6IUEMTTiazGL--0PbXReT5ZTA==&ch=Oba_TxmwWmquhMLQwlgS96kB4MKxbviTvme2DdbpQAhQwU1X44gnqA==

Analysis

max time kernel
10s
max time network
10s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://9f65q8hbb.cc.rs6.net/tn.jsp?f=001KWeKRtfoXOkszVTMM_JkXIoR9084aOMT36DyIVGb81vVmT-S7jxhAP3LSf0QzjjbJS5oUka_ty9HNDj8u6zmWU08YTNQSBEAd-QD-7d9B1z-_rVM9TMcs8bRBp2sgvcEfchV4i1QyIJLcCOa8euPYw==&c=3WwCiTChwT_yvwRdvgLibMJnrAjFY6IUEMTTiazGL--0PbXReT5ZTA==&ch=Oba_TxmwWmquhMLQwlgS96kB4MKxbviTvme2DdbpQAhQwU1X44gnqA==
Sample260416-2rbcfscv2l

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1604	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5276	chrome.exe
5276	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5276	chrome.exe
Token: SeCreatePagefilePrivilege	5276	chrome.exe
Token: SeShutdownPrivilege	5276	chrome.exe
Token: SeCreatePagefilePrivilege	5276	chrome.exe
Token: SeShutdownPrivilege	5276	chrome.exe
Token: SeCreatePagefilePrivilege	5276	chrome.exe
Token: SeShutdownPrivilege	5276	chrome.exe
Token: SeCreatePagefilePrivilege	5276	chrome.exe
Token: SeShutdownPrivilege	5276	chrome.exe
Token: SeCreatePagefilePrivilege	5276	chrome.exe
Token: SeShutdownPrivilege	5276	chrome.exe
Token: SeCreatePagefilePrivilege	5276	chrome.exe
Token: SeShutdownPrivilege	5276	chrome.exe
Token: SeCreatePagefilePrivilege	5276	chrome.exe
Token: SeShutdownPrivilege	5276	chrome.exe
Token: SeCreatePagefilePrivilege	5276	chrome.exe
Token: SeShutdownPrivilege	5276	chrome.exe
Token: SeCreatePagefilePrivilege	5276	chrome.exe
Token: SeShutdownPrivilege	5276	chrome.exe
Token: SeCreatePagefilePrivilege	5276	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe
5276	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5276 wrote to memory of 2888	5276	chrome.exe	79
PID 5276 wrote to memory of 4684	5276	chrome.exe	80
PID 5276 wrote to memory of 4684	5276	chrome.exe	80
PID 5276 wrote to memory of 1604	5276	chrome.exe	81
PID 5276 wrote to memory of 6124	5276	chrome.exe	82
PID 5276 wrote to memory of 6124	5276	chrome.exe	82
PID 5276 wrote to memory of 3360	5276	chrome.exe	84
PID 5276 wrote to memory of 3360	5276	chrome.exe	84
PID 5276 wrote to memory of 5696	5276	chrome.exe	85
PID 5276 wrote to memory of 5696	5276	chrome.exe	85
PID 5276 wrote to memory of 5388	5276	chrome.exe	87
PID 5276 wrote to memory of 5388	5276	chrome.exe	87
PID 5276 wrote to memory of 4696	5276	chrome.exe	88
PID 5276 wrote to memory of 4696	5276	chrome.exe	88
PID 5276 wrote to memory of 1616	5276	chrome.exe	89
PID 5276 wrote to memory of 1616	5276	chrome.exe	89
PID 5276 wrote to memory of 3648	5276	chrome.exe	90
PID 5276 wrote to memory of 3648	5276	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://9f65q8hbb.cc.rs6.net/tn.jsp?f=001KWeKRtfoXOkszVTMM_JkXIoR9084aOMT36DyIVGb81vVmT-S7jxhAP3LSf0QzjjbJS5oUka_ty9HNDj8u6zmWU08YTNQSBEAd-QD-7d9B1z-_rVM9TMcs8bRBp2sgvcEfchV4i1QyIJLcCOa8euPYw==&c=3WwCiTChwT_yvwRdvgLibMJnrAjFY6IUEMTTiazGL--0PbXReT5ZTA==&ch=Oba_TxmwWmquhMLQwlgS96kB4MKxbviTvme2DdbpQAhQwU1X44gnqA==
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8aacc728,0x7fff8aacc734,0x7fff8aacc740
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,12957392590514027558,9111267436427087619,262144 --field-trial-handle=1920,i,10297914461919289777,1163896197563012180,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1740 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,6719991708557831428,2104018644923427913,524288 --field-trial-handle=1920,i,10297914461919289777,1163896197563012180,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,16753939667139000335,11929074754095975458,524288 --field-trial-handle=1920,i,10297914461919289777,1163896197563012180,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2272 /prefetch:13
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,12126640894421892694,27833018952498100,2097152 --field-trial-handle=1920,i,10297914461919289777,1163896197563012180,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,7464080339009560925,9272529907233125712,2097152 --field-trial-handle=1920,i,10297914461919289777,1163896197563012180,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4352,i,7813909014323069095,2377354681345001908,2097152 --field-trial-handle=1920,i,10297914461919289777,1163896197563012180,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4368 /prefetch:9
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4664,i,3192362135715556424,6556867251484882364,2097152 --field-trial-handle=1920,i,10297914461919289777,1163896197563012180,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4912,i,5711684972183048079,4210816519934614315,2097152 --field-trial-handle=1920,i,10297914461919289777,1163896197563012180,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5092,i,12058750859710142060,7164486774358720192,524288 --field-trial-handle=1920,i,10297914461919289777,1163896197563012180,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5076 /prefetch:12
  2⤵
  PID:3648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5f487b701a28bbdf308a6d53d081f04e41fe9a212436880d9270b5217f24c9b2
MD5 8f4524e32697d9d7b93bf37bd3281a48
SHA1 ed4ff63101d3a5b3d5595bf32c78deb7fc7ff953
SHA512 9d010ef53e3bf14d5a3261a7c15990b31f6ee52303b3723dc9f4e6a934976ee594efcae6bdb984d907a267ef564d4dc17e845abb5a20009c692dd128f10eba1c
SSDEEP 192:zRSKknY7uhXUVohv7+FpAPRp2HL9hHsb+WNnzlni52IteDDl22raXIOVyIsnAUge:zRSKknDhXtx6FUXabwJc21Dl2ia/e
TLSH
T16542B72AF91469375CDBC219FAA57B27E7F5002161942E88E6FCCA1C15EB6CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 13bbfb8b7d0089a583f277baca39138e6b11d1811a2634df742fbaacdf8940b8
MD5 7916c106349e4445f73cff379c377345
SHA1 01685b8d09f5c2ca26e822ccb6c720613a8bd5a7
SHA512 7d6a6e90f0543b6ecc5825e32325c15ddaddd1a9f1e1157f66b967589ce7e0a0b558607464f30f2bf74ef1fd89f1101f10d236a9450055ebd14c97bc8e021493
SSDEEP 1536:bG9jOP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:2jE++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1C29312B9991E7D3563ABC7E6A0079CAD8CE3DCCE1514117C31C79F1E18AE392930B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 35ef8f82d3bf2a7056a9bdbbed90365e302fcb06d43a667044510a803ef9e200
MD5 e4d598f105655a0c24bfb9f1fbf52700
SHA1 f095ad8aa202bae40af13812e799bfe9f42ae9e1
SHA512 1a48b4cfc5fc929c4196989784a02a177f1a2fbc0b2377e318ba942834c1e3d27a7af3cee644447c4aa2b24f46ea5d1a6c7d6b79f2c452a9b64365d7456a4105
SSDEEP 1536:eGlrnP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:xP++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T18E9302B9991E7D75636AC6D6A0079CAC8CE3DCCE1514117C30C7AF1E18BE393931B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download