hxxp://url1661[.]reno[.]energy/ls/click?upn=u001[.]MaNYTtHR5nhT-2FJI8v54UPd1rNcD1Hzt3x5wDbBvhG64ICHKIytmz7AdlLUMVtaF4IAkW7ddotkbuwTox4nH3Xw00aItSaXarU4AR8130X2RLQ-2FNRIW-2F1dKTYKJdaSMkkn1Sz3LXLO2u-2F0ZQin5fG-2BQLbJ-2Ff5eVdr2DWOI2Qhk1Ts-2FNkEPPiXBw3KLGjrKpJcBnH3zDMRh-2F4w4Rwc1iA3YYqOD-2FvXsnFJieBQJT1Kyc2LWEX2Uo7N2F6g8O3ONqdWmVAt0ekcITM-2BYB-2FFpPjJIwHWbouaMyoY3ViCl047LDPeHH4AfeWephdNHB2jMgOrNT531dwakm45fa10Dn4XpneLt0J6viweG-2FmWtDY4PE9gQgNMCpyZz3g-2FAzAsFmFGE6RjhJOLDHF29q73hajZB4o56Fr7uoxFBJq06f-2BKUFQo6cj6011WjM19vLUu-2BxUhFNXUcYMow5N9NZ5ZEII467jL-2BEQXc3zdhpAg9tQDh0sUIs-2F-2BihcCG1itRQS98Ji5YRfJIaQ9L00M79ecmhouRTdgvIw314Cg2ADOF7qOn8eiPUTMBDuuJBKgjWab-2BZ64nT1o5nxMkRreI9rv0mG2lSXYri8bXnDwg-2FTsdZ9KYU2eDGQHYFsPAAw2petRKvmlBKeEK-2FM-2F5RX-2Bx6FRgsT6OprpWc28YPTA6iTP9DmHGmh0c7XkJvr8D7zLHnHla6KXs1N92JF-2FavJSK6B6oqbcBewqFail2TDYPny26pYCDWOKmg0qzFw2ji3h-2FpU9TJo5hz1MNFV8nxOX5sDO7YchcG0JP0fNvrRXElMjLGkkLJWShonmkdP-2B4Rw89nojIpjeah-2Fe50lTIpY1dhLAxIwHOV8s3tQPTEUoUbBtaOXDGYhn13jtzVPILWUr1tYIJ8EOXDzeqySauGfUoGHLid-2BkhMKBwXC3KITRcgKBQBDgFYi-2BMeWvES47oKJY6JdN6XjModuDFYOo2ApyjpYnBkCaUEUs1w2cA2SXB3Y7fHVZAa2jp9X-2FA9aGfQwEcCm3LpEZ3DZYjY5vfr4WKfJ6yFVDuhS7txQ7E1zR3g64FcjIQy0hefVHfoHX956IpUq0tFxbI5UzgeCkNEe2LRuCDg-2BklfEUFivXYwhEHi9C7CixfJNBqDau3Olx-2BAA1owHriJl9WyHAMgo2GOnABKbNg74lWUkKgsw8cjo8-2BxBvX8SiaxajPlM8R87y6H32M-2Fq0RFNKIcMmk8lVdaeUQNsyg7X1VsoEByvEQKZaMg5G7M2M-2F7rabhvwBqwXes6w7LBe2Qx-2BE1hJtwPJxWqcsPxMkh2cog-3D-3DH4Dw_Y4eP5hA9tRax7V-2FXVU3yuW4N7wpgUz7lPyQSKEYz54-2FW7Cu6ACjwDIrx3MXS9s5rCOpCrVWPY-2BMuF628YLo-2BeADgM2dEc-2BQM3OU4EuYaB2vujWJGR-2FHW9vwYvFWpHc48XBXz-2BeU76QdbZjHPRHatzlyH320woseOsS8KzdkiuvBVN-2B2DEHZUzfu7zyj-2F0ZNLYMW017I807zMwILBahRtwg-3D-3D

Analysis

user interaction
yes
max time kernel
39s
max time network
40s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/09/2026, 15:29

Sharing

Behavioral task

behavioral1

Sample

http://url1661.reno.energy/ls/click?upn=u001.MaNYTtHR5nhT-2FJI8v54UPd1rNcD1Hzt3x5wDbBvhG64ICHKIytmz7AdlLUMVtaF4IAkW7ddotkbuwTox4nH3Xw00aItSaXarU4AR8130X2RLQ-2FNRIW-2F1dKTYKJdaSMkkn1Sz3LXLO2u-2F0ZQin5fG-2BQLbJ-2Ff5eVdr2DWOI2Qhk1Ts-2FNkEPPiXBw3KLGjrKpJcBnH3zDMRh-2F4w4Rwc1iA3YYqOD-2FvXsnFJieBQJT1Kyc2LWEX2Uo7N2F6g8O3ONqdWmVAt0ekcITM-2BYB-2FFpPjJIwHWbouaMyoY3ViCl047LDPeHH4AfeWephdNHB2jMgOrNT531dwakm45fa10Dn4XpneLt0J6viweG-2FmWtDY4PE9gQgNMCpyZz3g-2FAzAsFmFGE6RjhJOLDHF29q73hajZB4o56Fr7uoxFBJq06f-2BKUFQo6cj6011WjM19vLUu-2BxUhFNXUcYMow5N9NZ5ZEII467jL-2BEQXc3zdhpAg9tQDh0sUIs-2F-2BihcCG1itRQS98Ji5YRfJIaQ9L00M79ecmhouRTdgvIw314Cg2ADOF7qOn8eiPUTMBDuuJBKgjWab-2BZ64nT1o5nxMkRreI9rv0mG2lSXYri8bXnDwg-2FTsdZ9KYU2eDGQHYFsPAAw2petRKvmlBKeEK-2FM-2F5RX-2Bx6FRgsT6OprpWc28YPTA6iTP9DmHGmh0c7XkJvr8D7zLHnHla6KXs1N92JF-2FavJSK6B6oqbcBewqFail2TDYPny26pYCDWOKmg0qzFw2ji3h-2FpU9TJo5hz1MNFV8nxOX5sDO7YchcG0JP0fNvrRXElMjLGkkLJWShonmkdP-2B4Rw89nojIpjeah-2Fe50lTIpY1dhLAxIwHOV8s3tQPTEUoUbBtaOXDGYhn13jtzVPILWUr1tYIJ8EOXDzeqySauGfUoGHLid-2BkhMKBwXC3KITRcgKBQBDgFYi-2BMeWvES47oKJY6JdN6XjModuDFYOo2ApyjpYnBkCaUEUs1w2cA2SXB3Y7fHVZAa2jp9X-2FA9aGfQwEcCm3LpEZ3DZYjY5vfr4WKfJ6yFVDuhS7txQ7E1zR3g64FcjIQy0hefVHfoHX956IpUq0tFxbI5UzgeCkNEe2LRuCDg-2BklfEUFivXYwhEHi9C7CixfJNBqDau3Olx-2BAA1owHriJl9WyHAMgo2GOnABKbNg74lWUkKgsw8cjo8-2BxBvX8SiaxajPlM8R87y6H32M-2Fq0RFNKIcMmk8lVdaeUQNsyg7X1VsoEByvEQKZaMg5G7M2M-2F7rabhvwBqwXes6w7LBe2Qx-2BE1hJtwPJxWqcsPxMkh2cog-3D-3DH4Dw_Y4eP5hA9tRax7V-2FXVU3yuW4N7wpgUz7lPyQSKEYz54-2FW7Cu6ACjwDIrx3MXS9s5rCOpCrVWPY-2BMuF628YLo-2BeADgM2dEc-2BQM3OU4EuYaB2vujWJGR-2FHW9vwYvFWpHc48XBXz-2BeU76QdbZjHPRHatzlyH320woseOsS8KzdkiuvBVN-2B2DEHZUzfu7zyj-2F0ZNLYMW017I807zMwILBahRtwg-3D-3D

Resource

win11-20260911-en

windows11-21h2-x64

11 signatures

150 seconds

discovery

Report Analysis Logs

General

Target
http://url1661.reno.energy/ls/click?upn=u001.MaNYTtHR5nhT-2FJI8v54UPd1rNcD1Hzt3x5wDbBvhG64ICHKIytmz7AdlLUMVtaF4IAkW7ddotkbuwTox4nH3Xw00aItSaXarU4AR8130X2RLQ-2FNRIW-2F1dKTYKJdaSMkkn1Sz3LXLO2u-2F0ZQin5fG-2BQLbJ-2Ff5eVdr2DWOI2Qhk1Ts-2FNkEPPiXBw3KLGjrKpJcBnH3zDMRh-2F4w4Rwc1iA3YYqOD-2FvXsnFJieBQJT1Kyc2LWEX2Uo7N2F6g8O3ONqdWmVAt0ekcITM-2BYB-2FFpPjJIwHWbouaMyoY3ViCl047LDPeHH4AfeWephdNHB2jMgOrNT531dwakm45fa10Dn4XpneLt0J6viweG-2FmWtDY4PE9gQgNMCpyZz3g-2FAzAsFmFGE6RjhJOLDHF29q73hajZB4o56Fr7uoxFBJq06f-2BKUFQo6cj6011WjM19vLUu-2BxUhFNXUcYMow5N9NZ5ZEII467jL-2BEQXc3zdhpAg9tQDh0sUIs-2F-2BihcCG1itRQS98Ji5YRfJIaQ9L00M79ecmhouRTdgvIw314Cg2ADOF7qOn8eiPUTMBDuuJBKgjWab-2BZ64nT1o5nxMkRreI9rv0mG2lSXYri8bXnDwg-2FTsdZ9KYU2eDGQHYFsPAAw2petRKvmlBKeEK-2FM-2F5RX-2Bx6FRgsT6OprpWc28YPTA6iTP9DmHGmh0c7XkJvr8D7zLHnHla6KXs1N92JF-2FavJSK6B6oqbcBewqFail2TDYPny26pYCDWOKmg0qzFw2ji3h-2FpU9TJo5hz1MNFV8nxOX5sDO7YchcG0JP0fNvrRXElMjLGkkLJWShonmkdP-2B4Rw89nojIpjeah-2Fe50lTIpY1dhLAxIwHOV8s3tQPTEUoUbBtaOXDGYhn13jtzVPILWUr1tYIJ8EOXDzeqySauGfUoGHLid-2BkhMKBwXC3KITRcgKBQBDgFYi-2BMeWvES47oKJY6JdN6XjModuDFYOo2ApyjpYnBkCaUEUs1w2cA2SXB3Y7fHVZAa2jp9X-2FA9aGfQwEcCm3LpEZ3DZYjY5vfr4WKfJ6yFVDuhS7txQ7E1zR3g64FcjIQy0hefVHfoHX956IpUq0tFxbI5UzgeCkNEe2LRuCDg-2BklfEUFivXYwhEHi9C7CixfJNBqDau3Olx-2BAA1owHriJl9WyHAMgo2GOnABKbNg74lWUkKgsw8cjo8-2BxBvX8SiaxajPlM8R87y6H32M-2Fq0RFNKIcMmk8lVdaeUQNsyg7X1VsoEByvEQKZaMg5G7M2M-2F7rabhvwBqwXes6w7LBe2Qx-2BE1hJtwPJxWqcsPxMkh2cog-3D-3DH4Dw_Y4eP5hA9tRax7V-2FXVU3yuW4N7wpgUz7lPyQSKEYz54-2FW7Cu6ACjwDIrx3MXS9s5rCOpCrVWPY-2BMuF628YLo-2BeADgM2dEc-2BQM3OU4EuYaB2vujWJGR-2FHW9vwYvFWpHc48XBXz-2BeU76QdbZjHPRHatzlyH320woseOsS8KzdkiuvBVN-2B2DEHZUzfu7zyj-2F0ZNLYMW017I807zMwILBahRtwg-3D-3D
Sample260916-sxesdsscrb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2448	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340462237190044"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2772	chrome.exe
2772	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe
Token: SeShutdownPrivilege	2772	chrome.exe
Token: SeCreatePagefilePrivilege	2772	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe
2772	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4240	2772	chrome.exe	81
PID 2772 wrote to memory of 5656	2772	chrome.exe	82
PID 2772 wrote to memory of 2448	2772	chrome.exe	83
PID 2772 wrote to memory of 5656	2772	chrome.exe	82
PID 2772 wrote to memory of 1256	2772	chrome.exe	87
PID 2772 wrote to memory of 1256	2772	chrome.exe	87
PID 2772 wrote to memory of 756	2772	chrome.exe	85
PID 2772 wrote to memory of 756	2772	chrome.exe	85
PID 2772 wrote to memory of 1092	2772	chrome.exe	86
PID 2772 wrote to memory of 1092	2772	chrome.exe	86
PID 2772 wrote to memory of 2376	2772	chrome.exe	90
PID 2772 wrote to memory of 2376	2772	chrome.exe	90
PID 2772 wrote to memory of 5052	2772	chrome.exe	91
PID 2772 wrote to memory of 5052	2772	chrome.exe	91
PID 2772 wrote to memory of 1364	2772	chrome.exe	93
PID 2772 wrote to memory of 1364	2772	chrome.exe	93
PID 2772 wrote to memory of 5844	2772	chrome.exe	94
PID 2772 wrote to memory of 5844	2772	chrome.exe	94
PID 2772 wrote to memory of 3028	2772	chrome.exe	95
PID 2772 wrote to memory of 4712	2772	chrome.exe	97
PID 2772 wrote to memory of 4712	2772	chrome.exe	97
PID 2772 wrote to memory of 2016	2772	chrome.exe	98
PID 2772 wrote to memory of 4708	2772	chrome.exe	99
PID 2772 wrote to memory of 1532	2772	chrome.exe	100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url1661.reno.energy/ls/click?upn=u001.MaNYTtHR5nhT-2FJI8v54UPd1rNcD1Hzt3x5wDbBvhG64ICHKIytmz7AdlLUMVtaF4IAkW7ddotkbuwTox4nH3Xw00aItSaXarU4AR8130X2RLQ-2FNRIW-2F1dKTYKJdaSMkkn1Sz3LXLO2u-2F0ZQin5fG-2BQLbJ-2Ff5eVdr2DWOI2Qhk1Ts-2FNkEPPiXBw3KLGjrKpJcBnH3zDMRh-2F4w4Rwc1iA3YYqOD-2FvXsnFJieBQJT1Kyc2LWEX2Uo7N2F6g8O3ONqdWmVAt0ekcITM-2BYB-2FFpPjJIwHWbouaMyoY3ViCl047LDPeHH4AfeWephdNHB2jMgOrNT531dwakm45fa10Dn4XpneLt0J6viweG-2FmWtDY4PE9gQgNMCpyZz3g-2FAzAsFmFGE6RjhJOLDHF29q73hajZB4o56Fr7uoxFBJq06f-2BKUFQo6cj6011WjM19vLUu-2BxUhFNXUcYMow5N9NZ5ZEII467jL-2BEQXc3zdhpAg9tQDh0sUIs-2F-2BihcCG1itRQS98Ji5YRfJIaQ9L00M79ecmhouRTdgvIw314Cg2ADOF7qOn8eiPUTMBDuuJBKgjWab-2BZ64nT1o5nxMkRreI9rv0mG2lSXYri8bXnDwg-2FTsdZ9KYU2eDGQHYFsPAAw2petRKvmlBKeEK-2FM-2F5RX-2Bx6FRgsT6OprpWc28YPTA6iTP9DmHGmh0c7XkJvr8D7zLHnHla6KXs1N92JF-2FavJSK6B6oqbcBewqFail2TDYPny26pYCDWOKmg0qzFw2ji3h-2FpU9TJo5hz1MNFV8nxOX5sDO7YchcG0JP0fNvrRXElMjLGkkLJWShonmkdP-2B4Rw89nojIpjeah-2Fe50lTIpY1dhLAxIwHOV8s3tQPTEUoUbBtaOXDGYhn13jtzVPILWUr1tYIJ8EOXDzeqySauGfUoGHLid-2BkhMKBwXC3KITRcgKBQBDgFYi-2BMeWvES47oKJY6JdN6XjModuDFYOo2ApyjpYnBkCaUEUs1w2cA2SXB3Y7fHVZAa2jp9X-2FA9aGfQwEcCm3LpEZ3DZYjY5vfr4WKfJ6yFVDuhS7txQ7E1zR3g64FcjIQy0hefVHfoHX956IpUq0tFxbI5UzgeCkNEe2LRuCDg-2BklfEUFivXYwhEHi9C7CixfJNBqDau3Olx-2BAA1owHriJl9WyHAMgo2GOnABKbNg74lWUkKgsw8cjo8-2BxBvX8SiaxajPlM8R87y6H32M-2Fq0RFNKIcMmk8lVdaeUQNsyg7X1VsoEByvEQKZaMg5G7M2M-2F7rabhvwBqwXes6w7LBe2Qx-2BE1hJtwPJxWqcsPxMkh2cog-3D-3DH4Dw_Y4eP5hA9tRax7V-2FXVU3yuW4N7wpgUz7lPyQSKEYz54-2FW7Cu6ACjwDIrx3MXS9s5rCOpCrVWPY-2BMuF628YLo-2BeADgM2dEc-2BQM3OU4EuYaB2vujWJGR-2FHW9vwYvFWpHc48XBXz-2BeU76QdbZjHPRHatzlyH320woseOsS8KzdkiuvBVN-2B2DEHZUzfu7zyj-2F0ZNLYMW017I807zMwILBahRtwg-3D-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb319c728,0x7ffcb319c734,0x7ffcb319c740
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,5870010600328361867,3744151823907315667,262144 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,179925588969786318,3162996522907129571,524288 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,13888284964708260271,7093824797858290960,524288 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2980,i,18255694803915139468,1245234114235444127,2097152 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2988,i,2429551685800660028,5893748198353419264,2097152 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2248 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,6492423033440596664,7491775942713110709,2097152 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4812,i,17202691169324848015,2772802679060881595,2097152 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5056,i,15937529158635456439,17759107611535807198,2097152 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5800,i,3496090527457957045,17600706173977591984,2097152 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,12862341110347906410,13098456232970806162,524288 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5136,i,4805371332174427121,14912021584809071508,2097152 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,2250987937585348333,13092045572937542158,524288 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,15355015674798313142,4561604342245605921,524288 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,1627722751085106323,5641103452850668588,524288 --field-trial-handle=1980,i,12528812299595411501,5548895035920040958,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:1532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 34ef5470518b12e9f1d7f66cce6087ae6f81746beac3b251c11a4c1818d29588
MD5 4d4a102de7ae47986276f8944598468e
SHA1 ab913b0c7cb3796dec59ac579804e2f8b2d9cf34
SHA512 22750d56e323d2e0fdf463a15b2e8d7d9beaaf92c2b5cc8e472514ae5e643243221e53da65fd028fe00a515f172b0c31e6f82012c8cf1e12a6741eda2d87cf8f
TLSH
T131E02B69CC21ED3708F9171950600B46E750079B2A91C94B3A3DC10D8FB173B428687C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2725d5a1f5645f750618b40a3dd5b19218580f2f7de4d74c3163be707f40d3b6
MD5 c70978081a7fd918601f1a7d27bf6c6c
SHA1 8122477f9bc7be2c84893761992279d653ca94c9
SHA512 a726769297f8b2cacb64cb4b2d490a1661771b785af2113c397a9b3aa8f71b540a6b738ae80ba5fad94e9e3043a3c0711b296225163908d4f36995c04bd57dc7
SSDEEP 192:NRvnH+fKwv7qNvAPRp2DK9fHzXb+WNnlqaQX2REem+VyIsnAUge:NRvnwKsm6XpdR8V2O2e
TLSH
T17C32942EBE24753B5CEAD229FA657B97D3F6102120952E80E6FC8D7C21E75CC2213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 44b215f4a212151498d8ffe314ebb6c4b3d6afd17a5e9ccf8a99403950ac5f77
MD5 4140f55c6b9b4418341730c25534d3bc
SHA1 9cc23bedca8353fe60a4deee9eeba9be1308ecf1
SHA512 a581e1387d87256bb87d88e8c44d128e074d7a8024e282fc38659cd64d67695028fffbf85b707e6b2f7ce8237d9948f3e45d172f621576f1e8602e2fa713d004
SSDEEP 192:NRvb8SOkIFH+fK5v7qNvAPRp2v0K9fHzXb+WNnlqaPUesEem+VyIsnAUge:NRvbSwKZm6XQdR8le12e
TLSH
T1BD52A62EB928757B5DE6D229FA757F67D3F6006220902D84DAFC896C20E79DC3213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 570370b72ba0ada930209c9bc771014eecca1954004f266db03ad4763626ca39
MD5 cf07285652f03067c979d0e2864db0f2
SHA1 475015f1be2bc3e0deccb6f1c50140907c2a88fe
SHA512 54de3a7c208fb772755ec8197e7dfd280a7055d0e32431bd2d5fb352244b2fb8957ce774c223c8898b626803eb117178af7683f30dc0a92573782053531df26e
SSDEEP 192:eSt4K6gu7KxkXqK4I40pUZNCgVLHrKHfFKslExKEXzKD/fK+ErUkKN9CzNFKx6AT:Dtjnu7KxkXqKf/pUZNCgVLH2HfgslFEq
TLSH
T1E532EA27A48DAA3F4FD8D509DC166F4F6CB5429672780D2496FF9C0803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 743848968ec1a709fa2ffcd1a8b9878a78ab585469e652328a8098392f3d51b7
MD5 1119f225b83b3450fb1426fb9da842f5
SHA1 466fb3cceba5d145d3a04ca7b798aff101274a6c
SHA512 84ae57eba44a553f1b162eacd1c03d7d46853cc4ff5a25768c7fe883b32f8a271ba90b1c456757d069abd36a8e746a684ee58e76fd9d327d837320fc24af1a5d
SSDEEP 3072:nLghgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:nLgxmX/B5UgKf2ne1utLV
TLSH
T1DDD302BF9DDDDFE36361B02669A91B6EC9F67FC46060EA4040F41189009F1FD8399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 501853c51c7cfd36218eb94024d38e29030abc6bbd050cfa2e62cd1ba7bec005
MD5 8691b21040394546b4e0fa4882894323
SHA1 d99afea040870f6fd0101dca727893a3e6aaa328
SHA512 afcc01e3be6c65ff60a49ebbf0864288cbdb3c4f3f49b4e5c8d89a4b1a7d77e56b41f222c2b5353d3b7ccf88ac5aa3bfd9c8564b7ed09ccd837022622016d933
SSDEEP 3072:nLDShgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:nLDSxmX/B5UgKf2ne1utLV
TLSH
T11FD312BF9CDDEFE363A1B02669691B6BC9F57FC85160EA4081F41185009F1FD8399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 bb5f2a56dea042e3b211d6b5517be55879ffe29cc0353283d636d11e873e902b
MD5 b0b414355ae79be91a187f2ef77f581a
SHA1 0d8ab4625d5730d497ca8f3ea36a7e835243d6e4
SHA512 d773132fcd70ba7320cd53eec4d3bb1a67888c8cbbc53f2e95c44db0a627b040d4f5fa160aee597b1ffef60f3090fe736c194b495353a8d19b331131ff698e6b
SSDEEP 3072:nLWShgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:nLWSxmX/B5UgKf2ne1utLV
TLSH
T1FDD312BF9CDDDFE363A2B02669691B6BC9F57FC85160DA4081F41189009F1FD8399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download