hxxp://purehealthanalytics[.]com

Analysis

user interaction
yes
max time kernel
300s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://purehealthanalytics.com
Sample260710-tk2bascw7p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4124	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281732802518779"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
3976	chrome.exe
3976	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 3956	5012	chrome.exe	86
PID 5012 wrote to memory of 3944	5012	chrome.exe	87
PID 5012 wrote to memory of 3944	5012	chrome.exe	87
PID 5012 wrote to memory of 4124	5012	chrome.exe	88
PID 5012 wrote to memory of 3464	5012	chrome.exe	89
PID 5012 wrote to memory of 3464	5012	chrome.exe	89
PID 5012 wrote to memory of 2996	5012	chrome.exe	91
PID 5012 wrote to memory of 2064	5012	chrome.exe	92
PID 5012 wrote to memory of 2996	5012	chrome.exe	91
PID 5012 wrote to memory of 2064	5012	chrome.exe	92
PID 5012 wrote to memory of 3980	5012	chrome.exe	93
PID 5012 wrote to memory of 3980	5012	chrome.exe	93
PID 5012 wrote to memory of 2924	5012	chrome.exe	94
PID 5012 wrote to memory of 5028	5012	chrome.exe	97
PID 5012 wrote to memory of 5028	5012	chrome.exe	97
PID 5012 wrote to memory of 3224	5012	chrome.exe	98
PID 5012 wrote to memory of 3224	5012	chrome.exe	98
PID 5012 wrote to memory of 4896	5012	chrome.exe	99
PID 5012 wrote to memory of 4896	5012	chrome.exe	99
PID 5012 wrote to memory of 4164	5012	chrome.exe	101
PID 5012 wrote to memory of 2292	5012	chrome.exe	102
PID 5012 wrote to memory of 1048	5012	chrome.exe	103
PID 5012 wrote to memory of 1000	5012	chrome.exe	104
PID 5012 wrote to memory of 1000	5012	chrome.exe	104
PID 5012 wrote to memory of 824	5012	chrome.exe	111
PID 5012 wrote to memory of 824	5012	chrome.exe	111
PID 5012 wrote to memory of 5052	5012	chrome.exe	113
PID 5012 wrote to memory of 5052	5012	chrome.exe	113
PID 5012 wrote to memory of 1104	5012	chrome.exe	114
PID 5012 wrote to memory of 1104	5012	chrome.exe	114
PID 5012 wrote to memory of 1220	5012	chrome.exe	115
PID 5012 wrote to memory of 1220	5012	chrome.exe	115
PID 5012 wrote to memory of 3976	5012	chrome.exe	116
PID 5012 wrote to memory of 4472	5012	chrome.exe	117
PID 5012 wrote to memory of 4472	5012	chrome.exe	117
PID 5012 wrote to memory of 3700	5012	chrome.exe	118
PID 5012 wrote to memory of 3700	5012	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://purehealthanalytics.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x80,0x104,0x7ffa415dc728,0x7ffa415dc734,0x7ffa415dc740
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,11532386236459030248,1897088165380453794,262144 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,5899528157860525333,17333599350602692174,524288 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,12642637926077510573,7077835046362058984,524288 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3032,i,11565495456893861230,17516486598571400801,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,4417444597622757574,13899445304627932892,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,305153762376507148,3081576562849895729,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,12246532504585235342,15339557616263172529,524288 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5508,i,17282897728538279997,4998091952208474363,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5692,i,9372649511893556184,1207397579718182122,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5564,i,9712005206692220729,13811264673111903512,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,9926775855359936260,14398691156633298923,524288 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,14916729050968382226,16254588825107434113,524288 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,4051524868302470662,802427866273255940,524288 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4252,i,4991256105754627484,8691747814199925316,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3420,i,7782748005191299611,16503605959898872611,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4268,i,9743517424019282602,3475206896655799343,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5612,i,15878768496589455368,890724891800924979,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4380,i,15108822213287266043,10172212505611814233,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4420,i,467112364995620277,9422654020951041467,262144 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5584,i,3747286718646200521,8700044666425670752,2097152 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,13282691487391769418,915919477159596855,524288 --field-trial-handle=1968,i,17532216508197758609,7544632491031070330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:3700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b9e5fb70e1c30b7ec0d99a549c3ac4a2bd9bd5e73a9dfa2150950336dffaaa87
MD5 9f52f8ec9d4b777cbf2d75ea2e341257
SHA1 f1191dfe9fc4bc49d511759c7f02a92f63a5cc16
SHA512 33151aff679a66686c9ab8008ffcdc30907f6859e13becd9d8cd5f1e51afddf310bcc898de67334c8daf3272cce2b4ec343cb5f1e8803bc02dfff557504cbd68
TLSH
T127E02B65C966EC2728F90729A0101783E755135B2B41D94F7B3DC10CCFB1636498DD5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 369289ac883249df7b7c840df558776a88e088b29f0945c1af0f070cf2d04f26
MD5 2399b3ec80f53e78c7d09e78ae7bd8b1
SHA1 080d282982420b53a0b08fb8cf58edfafd0daa7e
SHA512 e68966dc1a3920ea8e7c75e42a361bad17319c6bc8db90069df5194715377775a257ee15708d76243dba55bc2899d3ebcd5f4ae3e3c2772d459cc5423e795f64
TLSH
T11F419BF793B4897E8A1196E4EB256E1FCE6A0524031C3CA688D47E1B43F2872D10178F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eb10df137241a7878063c5db80a4ceca2542889accef9566c957017ef32b24ee
MD5 526940fb7cc413c4b41fb68df268a3f5
SHA1 e6f64a3c8146a0447c79a33dcb89ba674c569889
SHA512 51c78393a9a87648a1fd124189e99a8e6b97d3708d16de9660720f1603d9cd38f5ffa50dda06d1076cfb6fcfc2d8054e9211ebdae37950781b539f9d8906b8ba
TLSH
T19B51CFF783F4897D9A1196F4EB256E1FCE690924432C3CA688D47E1B53F2872D10068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2c200ef83f442e955db9ced8e0cb57d06aebf62d1929a13fa6aa922e4ea6e4c4
MD5 2d3faee362cc5f8f5a179401c490e50d
SHA1 febfef2cfa1a5ee83717374e8d9d3e820a9a55c8
SHA512 870f876220d6dfdb9096cf1d353233c0bfd9af4d1a8c7922b95ed38fe114d4fb6a9c75528001a4f2732f034f6232925b9b3fcc348b6ad1205c4ef221616d25ab
TLSH
T13051B0F783F4897D8A1196F4EB256E1FCE690924432C3CA6C4D4BE1B93F2872D24164E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4c88149d48ef084cfc5cc5c096d29d0df88143f99f4304ca4fc546656d2396ab
MD5 a4c1efcb8ff98842abfd90d5acb4c899
SHA1 e0372ef12637b5c1d7e321ec9cbfe430f0c53e77
SHA512 ef124d698ed211c551495f48c08d38debc1a6fbe321d111bfebb7495fee80fa9fe63fd2acd8b8635f094ffa51918392b2b6f2af573dd393525cb24ae382593ec
SSDEEP 192:IRnYgXEpOZM4Y6OiSATJv70pAPRp2d5r9+H57dqb+WNnby8P1ytf4bgVyIsnAUgE:IRnYgXE68x9ATJgUX28552bRP1KmkE
TLSH
T13742842AAA10297BACDBD225FD627B53D7F2202125955E84E7FCCA1C15E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d1abf12aa5d320226f9c0003e4a1af63cb61b8af4331a8b8c63663c482698d0c
MD5 a887e0488c92d27ea35a31950410746c
SHA1 7e59e8291257c12d72023d97388718149a350a75
SHA512 d1590c4f64176cce7400b62253caab655393a6ceeb889f46de17662cf5b4b1d2bbebcfba1fb754a261e30f3684e5d7d5b381e516e3694052967da32031e42e81
SSDEEP 192:IRnYgXEfOZM4Y6OiSATJv70pMUPRpXvd5I9+H57sb+WNnby8Pgytf4tgVyIsnAU3:IRnYgXEQ8x9ATJgiGXXI85EbRPgKKkE
TLSH
T17B52A62EAA102D7BACDBC229FD617B53D7F2202125955E84E7FCCA1C15E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b1ab54474691d3e65c623c0926c531447b90c6659ad5eb5a7e89a27e5043055b
MD5 3f409a75c20bee2045211cf757738952
SHA1 049816e70bf6800189804209e0d929c9ebdc4e58
SHA512 8e01deb15addfc38ef36275d526442db32d32adfaa4482d375e45c0f8651b6556f3b6a1fe5c0f34f819eb3b4b64776d869a3627239164333670fcb8a902a6d66
SSDEEP 192:IRnYgXEpOZM4Y6OiSABJv70pAPRp2d5r9+H57fgb+WNnby8PRytf4NgVyIsnAUge:IRnYgXE68x9ABJgUX285YbRPRKgke
TLSH
T1ED42942EAA10297BACDFC225FD627B53D7F2102125955E84E7FCCA1C05E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e9a01c76c56f4858e92d2527c39d0a4f9bca26b8d9b5da2d590e59cb1c155425
MD5 ffdbe713f48ecbce2730204c0ea86d79
SHA1 244b622e9b5fe9e7ff4e3f0efc562ea842a6f0f6
SHA512 e3b17416b37981eb25ead8dffa5571bff7f4af22c4dcf539cc082133ba0bfc6a41b49a4dd892a4817ce7023e8d8e7c41436fcfe755c799ea67ecf3b584ff09d6
SSDEEP 192:IRnYgXEpOZM4Y6OiSAalJv70pAPRp2dj9+H570b+WNnby8PRytf4NgVyIsnAUge:IRnYgXE68x9AalJgUX685sbRPRKgke
TLSH
T15042942EAA10697BACDFC229FD627B53D7F6202125D51E84E7FC8A1C15D76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 280937370f1ebd8f9b8c3aef94e93f84296f4a0645cf26ee6c45fb0b25be7d07
MD5 47da22757cc836251062ce4ceac967bc
SHA1 4df05d41c1a050999960622e26bb1442fbc83d29
SHA512 caa706413da702cbda8fd13486d1a1b22d2c81f2ff01b61f50d5a64e94c4ecda674ce1dc40735d63d9a67035a6b56fd1eab3ff3343ae22e73272ac0992f2e334
TLSH
T15DB01240C0017901C00612F4164B5C8C72549F119B0E670183E4A923D82565084191D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5850bb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5850bb.TMP
Size 96B
SHA256 68460b97783988ccf8559f61d9465ec3cdb97d25b1a7f71134610eb9c6e52519
MD5 0a6c96b081a0a22a2416bce2800aa28d
SHA1 05e273985168c58efd9cd3dd59bccc6122aca998
SHA512 160293d3526311ebb121a708f91023c87d3ff367885de17170c74e7d13fbc298fb513cb63648a1d1ab697b095c37c4c6b25aaf6ba122e38e63699eeb1384542e
TLSH
T114B02200C0023303C00B03B0288880EC3028CF28CB03030282F00B3AEC2AA200A3C220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 21359a9d3d818e0acffbd32bf6c28bcf81fb258c87625f5cb91276f0b5470694
MD5 8121eadead2f0a2e86efb32a02f68d11
SHA1 281c017c04cb582bcc2be211b07a8b1237937196
SHA512 8977624c011feb8c49522f725044437f470698dbae22c21f02924e222d251c406b90a28c38ee79fb4688c77970098155cd96e2e839b968b65b5eca58f1567d64
SSDEEP 1536:BedK9k2uA8yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEK:bGqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1B2C30237ABC21E339DD2DB64B5130FD653F644AA9034D305EEAD3BAB6883551A44249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bd960d2a1a4efa1b042d0e25a6d0e5eb83c6ec963019b1dcc447461242f06584
MD5 480114bb4a536922a2fbf65dfda1e1fd
SHA1 8eb61ef1835d0c5317a12f47b2e198577b3247db
SHA512 9503b1ba837b293e37580a00c43191bb8dc69ef517f1aec20d42be121a9106615df37cdab25a27dee00bd948a0dd7f22cc5942df8dedc980cd4589067cfe1400
SSDEEP 1536:BqdK9k2uA8yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEK:jGqfd7NtZL8cHQRZEQ6Sps3
TLSH
T17DC30237ABC21E339ED3DB60B5130FD793F644AA9034D305EEAD7BAB6883551A44249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4535d6dc28fdd721ea7d67fd9c8c2e11351e3bbae74d7c591041ef50bc75c67a
MD5 9a942e046ad359562c1aa78ef2b4daec
SHA1 78150d80e07cd988f65a5b99c1c3e99d9ca34597
SHA512 04b851ecfdb874368f115d1f12649647d4187bfee11c8d4d247729b17d6bf3a6e13f7a70053cfc53a07be8d16cbbf6751a2378a8b301eb51f46ae6d030cb329d
SSDEEP 1536:bb3uVLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bI3:Oqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1EFC30237ABC21F339D93CF64B9130FDA67B644A99034D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 432b7a96e6b8eb3763d62afce116177f36e291978278a0af66470a0e4bfea8e6
MD5 77cff90b5477e578c5a85b8e713a71a2
SHA1 b20a8877bdb58e67b9de1fda3ab8266298fa1bb2
SHA512 7cd84d1797221bd6f0076513f4911212752abd62f019c55b50b320af045eef3a8103aaa021be4de5d10870b78d6deae87678945a54500680ade38644106f9e3a
SSDEEP 1536:BqdK9k2bhQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEK:rEqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1CAC30237ABC21E339E93CB64B5130FD7A7B644AA9034D301ABAD37EB6C83595644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1fc14c3-fc56-4dc7-b7d8-ec33410c5fde.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e1fc14c3-fc56-4dc7-b7d8-ec33410c5fde.tmp
Size 116KB
SHA256 df3eeb21131ac94627083598dbef8ff9ad406b0a233c65ab61fa379905a14af2
MD5 83a46c6033e9d3b37db6bdb9bdb5ab63
SHA1 6341b83a5f3c36fa1d75913a65197d1b51054eed
SHA512 30d252fd856855db55d40e8851407a567b73eb73ddb8909f21c90e54ae7bf16fe7b0d13867ed317f7ea6da1dfc2cd814f67ed91ba44f09a5b6d942fa69263285
SSDEEP 1536:BTdK9k2bhQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEK:MEqfd7NtZL8cHQRZEQ6Sps3
TLSH
T18EC30237ABC21E339E93CB64B5130FD7A7B644AA9034D301EBAD37EB6C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download