hxxps://tactum[.]online

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tactum.online
Sample260820-p2cbaacn5x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
892	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317037585372757"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
1996	chrome.exe
1996	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 5244	5256	chrome.exe	87
PID 5256 wrote to memory of 5156	5256	chrome.exe	88
PID 5256 wrote to memory of 5156	5256	chrome.exe	88
PID 5256 wrote to memory of 892	5256	chrome.exe	89
PID 5256 wrote to memory of 1656	5256	chrome.exe	90
PID 5256 wrote to memory of 1656	5256	chrome.exe	90
PID 5256 wrote to memory of 5160	5256	chrome.exe	91
PID 5256 wrote to memory of 5160	5256	chrome.exe	91
PID 5256 wrote to memory of 1620	5256	chrome.exe	92
PID 5256 wrote to memory of 1620	5256	chrome.exe	92
PID 5256 wrote to memory of 4428	5256	chrome.exe	93
PID 5256 wrote to memory of 4428	5256	chrome.exe	93
PID 5256 wrote to memory of 824	5256	chrome.exe	95
PID 5256 wrote to memory of 5936	5256	chrome.exe	98
PID 5256 wrote to memory of 5936	5256	chrome.exe	98
PID 5256 wrote to memory of 5968	5256	chrome.exe	99
PID 5256 wrote to memory of 5968	5256	chrome.exe	99
PID 5256 wrote to memory of 4896	5256	chrome.exe	102
PID 5256 wrote to memory of 3052	5256	chrome.exe	103
PID 5256 wrote to memory of 4856	5256	chrome.exe	104
PID 5256 wrote to memory of 3912	5256	chrome.exe	105
PID 5256 wrote to memory of 3912	5256	chrome.exe	105
PID 5256 wrote to memory of 2672	5256	chrome.exe	106
PID 5256 wrote to memory of 2672	5256	chrome.exe	106
PID 5256 wrote to memory of 4056	5256	chrome.exe	111
PID 5256 wrote to memory of 4056	5256	chrome.exe	111
PID 5256 wrote to memory of 5316	5256	chrome.exe	117
PID 5256 wrote to memory of 5316	5256	chrome.exe	117
PID 5256 wrote to memory of 1996	5256	chrome.exe	118
PID 5256 wrote to memory of 2416	5256	chrome.exe	119
PID 5256 wrote to memory of 2416	5256	chrome.exe	119
PID 5256 wrote to memory of 5368	5256	chrome.exe	120
PID 5256 wrote to memory of 5368	5256	chrome.exe	120
PID 5256 wrote to memory of 4276	5256	chrome.exe	122
PID 5256 wrote to memory of 4276	5256	chrome.exe	122

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tactum.online
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeb52cc728,0x7ffeb52cc734,0x7ffeb52cc740
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,14541355071074523414,17260534964155407030,262144 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,11587503848713129145,6428530668596574513,524288 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1584 /prefetch:3
  2⤵
  - System Time Discovery
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,9575050419113912950,11972066402508715988,524288 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,16170227837123377637,1555301574599931325,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,10255092181815144310,16567140893480657291,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4388,i,6727231559645617737,8737164062409465247,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4400 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,3178848004586227632,10744669894547482300,524288 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5908,i,15882843650275357602,4948433116954140842,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4576,i,6497601355550541756,14092890766489204869,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,4339881379865206288,784238539959724986,524288 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,4043070262636470598,8962627733377703205,524288 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,8413713370132785681,15223522161031455963,524288 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5892,i,842088961295754226,12203246469959849444,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3204,i,8119507241634841136,4883853193220808216,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5680,i,14567866464088081993,7653006680058063084,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6016,i,15872466229351299864,12382015977575092414,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3228,i,9276632523467226137,1118777401769420383,262144 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5884,i,2956891933972211625,11543200897023665473,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6008,i,15349350407999934178,12047972599744398306,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3256,i,7284552873488050273,3082794754315852289,2097152 --field-trial-handle=1972,i,804455450705868908,7657128734857300483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5d30084c1d2d88a2b6d82635f277f0f4310020bac25208d0c97d49b1476f5de6
MD5 3ddf49c3c624e9188c22cad946c29ef1
SHA1 01ed24e52c30bc825f77bd1e9d00e7644495f298
SHA512 d91cf46d294227be7c7344963f558b7a9ad368f61b799e5317802fef3ffc815f30c32b5d15ea742de0f4e052684a3a7826cf8eb0413a437d0b1bb4352e25621a
TLSH
T196E02BA9C972DC370CFD1B7DA0910746FA5523473640854F3E3C94184F7563A424685C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 52525bc3eb4b0166d54ba9f96e8e22b92657e06698e060bbf579e7aacd226b86
MD5 8953fab06388e8ffec7b0e86ef6c6816
SHA1 3e5d63cf76ce0c7ac64d45304c5de72bb94e5caa
SHA512 74c914fcaab6f321ccc8732aa1ecd8bcf92de41ee847329818db907335e308022657caae2bc669839709b44c1f3bc30bc832be3f1f039b028f8fa9398e21838b
TLSH
T11A418CF793F4957E861192E4EA15AF1FCE790524031C3CA688E46E1B43F2872E10079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e8edbd8aac8df53d994c2ab5383a855a48b73990e0f0ee36cd0f0d3cfd224533
MD5 01536dee5a64babbf6246b87509e6722
SHA1 91f8a9b1d2f4eb6db47509aa8fac39b8ff68bb80
SHA512 a4f75c991c619dd71ba4eb7b2b33bde29471e29f2996688ce0e46ae36f4a1b4dd77df4d21bb4aac7ae9dc1a2b280248dcb5a96c58132d48285763b16904f635c
SSDEEP 192:5RC998MMFm8v71hpAPRp2jo92Hsb+WNnNwPlj2fKkwHatVyIsnAUgE:5RC9hoBhUX/QwCPN2yna7E
TLSH
T1A742D66FA914687BACCBD22AFA523753E7F5102121E41E84EBFCC92C15D75CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e9a35efe4ca5a1aa5c5c6e27a09b1a22b39503539804764e338361b1e3b096d3
MD5 238455677df0388267e056c6e2cf0495
SHA1 81c5958933532d62d464659b447fecee9e3e8031
SHA512 7a08c21ef782d940d0531550193257b3191529a00783e334bd8e48d9802e71ee3626bd7033f9e41cac367f83a66abcb7fd487163645d7d3d968e4040550fff46
SSDEEP 192:5RC998MMFmSv71hpJPRpsj/92Hsb+WNnNwVTGw2p9j2fKkwHajVyIsnAUgE:5RC9h+Bh/XCQwC7272ynaFE
TLSH
T1A052E76FA914697BACDBD22AF9517B53E3F5102121E01E84EBFCCA2C15E75CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 87f476e2938a3b4d38b825e56bcf338341adae2f70c34845d7f9fe5f5065c222
MD5 a901571fa68564d50d83708d2419ec43
SHA1 3331381736c9c8489f69d602ab63a9980e08284a
SHA512 dec8995beca79b553b7ed5347cb89e8ab10a4f6bc8c383da1a1d78ea8c89dd96ab072608b93cc0166910d75a2d3001b6a42106578636d43e5d6be2a4f51ca83a
SSDEEP 192:5RC998MMF7Gv71hpJPRpsjGl92Hsb+WNnNwVTGw2p9j2fKkwHajVyIsnAUgE:5RC9wyBh/X7QwC7272ynaFE
TLSH
T19252D76FA914697BACDBD22AF9517B53E3F5102121E01E84EBFCCA2C15D75CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d3b923d38c1d7bcfa2af31437b07860b315bbb2941053b148acffe9921920324
MD5 1c029b250d86eddf91418bc573a408fb
SHA1 739200fe125349c11a0ff8d03a2ed67839165357
SHA512 04196b3e0c48da88b9e16366798724e05d855e20f229324534aaa8db949369ed58ca046cc7dee68262f61e7d98d7a707a9ca4779d01b5f8f7c8ccfba21e89dfc
SSDEEP 192:5RC998MMFmhv71hpAPRp2g92Hsb+WNnNwPmj2fKkwHaGVyIsnAUge:5RC9hxBhUXDQwCPg2ynaee
TLSH
T16E42D56FA924687B6CCBD22AFE613753D7F9102121E52E84EBFC892C15D75CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5b5158248ad9a10147af7ef0fb11cb619a638d0b1254e1d6d00195545ef12c88
MD5 b318e2543ef9cd5582e8c64bcb3c0bc4
SHA1 e63606ff394d0355fdfc80b28cde895042343773
SHA512 d37b4397dd2d99f5d81b6ce45d86e10af367c44d79f4cbbbccfedf26d5f760a7c2e5c21dd57bd1f1a5be6482042921e447580ea29afe24e6b984fc02ea189406
TLSH
T10FB0120184019311C05206F015D2148876546F119A0E1B0143F07A32C8356B58115150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585a31.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585a31.TMP
Size 96B
SHA256 0dd724a034b8540475fdc00fbd7f859c83359a52090d83be2f473152a28aadb3
MD5 586671a92e249dd041041ceb294aa369
SHA1 ebc4bff69eb1fadf70deb57b7e8c8e4ce59a0112
SHA512 55bc94a5f3513997080eb5fb4acb931f7ce087e57221ad5bdf7b763aa62b06798efd55b0920ed75a03aa078293607f65bfac771ae413dc3bfadcaabb319cbb81
TLSH
T1E4B02208C302220AC00303B02A83E0E830F0EF30CE03322282F00B22EC30F300030330
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d29227f8855b7b1c1f23a52ed7b1ebc16fbc524bf4475a6861267edbddf8d73a
MD5 7ae6debfe8fa517fbee7058d8467e5c0
SHA1 ec6ab679af3b79108df5068cde45c73ab6c32b82
SHA512 d1f3a27bb960298bf7ba9e269ab1a2c67b507030454408ac69699bacfc879be3e1d650db1ec10abcd5dd81feeb50b23d21ad02b7cff2edc1053f6ce13d4d797d
SSDEEP 3072:oGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Dm7Rkm1tYpBeh2BAo3
TLSH
T10BC312275D71E9375D79BB4EB08E0B1F1EF24AA6C930DE92C8D85A0437EA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 153KB
SHA256 c2e7d72fc2d578edc83c23599e89093bf0349b21130abc7c0d863454e01cfab8
MD5 d2c641158cc526f2c7fa5c0a3cb1c971
SHA1 33ec12ff34ce24be6e1c8e826d594de93a1e86b6
SHA512 dfbf2c176dc7c196116a9e776401504b5f95cc4d3f371ac41a02823e5cdd3d1653261482ee23b456e72e299601ea688e9992b7afde3118b626ed941bc716de5e
SSDEEP 3072:DxJlwVV8X+5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:DxJJm7Rkm1tYpBeh2BAo3
TLSH
T113F312276D65ED775DAC7B5F704E062E0AF04AB6CD309B868CC497042BEBBCC1646A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 abdee79e97d148f69168d50b31f7eb7a44431d6773246d622355feec39c4ec16
MD5 fffbb0e892ef665e138e933ba46eff4e
SHA1 6be328efec06cc0eaac9e230456730db17fc7ce6
SHA512 c4734971b9d49e55daf0867b4ab92a16d21b4c8abef7187f442685e140476e884c4d7d8cae48bf22a01f59e5e0f9cc54920e2dd4e8aedee1bfa1f50e1b392f1c
SSDEEP 3072:UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Xm7Rkm1tYpBeh2BAo3
TLSH
T1B8C3122B5DB5E8375DB9B75EB08E0B1F1EF249A6C920DE92C8D45B0423EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 dcacb68271161919a72ef21a4b5a25fc03b62c81cb686d0cfd5c3d1087424078
MD5 96ff85d5f2a5b6dd29657752ff044629
SHA1 8ef81545839cbfa81db23c586aac2cc5b4943e3d
SHA512 e881c91b01a5398e0011e122c24655db0d1b4f964f9adf732b803dead97cc63560528f73a3b1de71e47a5843e6844d560a565ae060136cdc1350be9e44b9d0c7
SSDEEP 3072:1Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:cm7Rkm1tYpBeh2BAo3
TLSH
T186C3122B5DB5E8375DB9B75EB08E0B1F1EF149A6C920DE92C8D45B0423EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download