hxxps://economist[.]yatrack2[.]com/2OJ7liGFrqdJraa2qcEsX_Ut_H9JbnfdsZONKiapW19-QXPB_nwF5eG_V1BJFf-IzQbnx-R3BjxWMspqA4KVj9IetsisrMuxXgoUF7tj4RYasph0btisicfgfLV_ViR8R7DN4bZ796zfm4TtI76in5msphf2QUccVlYExw0W5C1nXLTvPU9j7hZqz4ROpPR8LWLm3rYFziXbh1kuRAdYl_d0Pfli_QIEkDQEbahae_qEdWGOsrUePjWhWJeG15X9eu8uhRZn_zJOf4QxBSkijbpLdounP-CCKMJtDsRqC992Y5YwWkkQkAmRcrx4NdpgK0QlEJaDAlQOTYMF0BZvkiBtWi_Rpj5C7gdx0h7JRUBsqk5o3XwNdIkmQgOb9DFqFkRl-Ee4ppM8wb154KHNDQWH9rFJhGKUt4Lliyaz0C03Lp4adTdd-pig9MVfryY4E18uW46PFYj22OId9G6WFJtN0mdw4j8ST2cSTFmiEx3IcZrhFWUMGip1STkEv7k0luBQvmWbV0uNUHq6nFBG0nEQ9k12YHc21lW614OyYpWvh_9lpRUaJu4e2H9BPU80HZ-1LDmwg-7jMHwyvE0fZdG6C5XN9gtrNbe0Re3wuYMt01MuSRR_cd6r7ir0VxMYMVRKsV6oT7giTLNcxD15I

Analysis

user interaction
yes
max time kernel
59s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://economist.yatrack2.com/2OJ7liGFrqdJraa2qcEsX_Ut_H9JbnfdsZONKiapW19-QXPB_nwF5eG_V1BJFf-IzQbnx-R3BjxWMspqA4KVj9IetsisrMuxXgoUF7tj4RYasph0btisicfgfLV_ViR8R7DN4bZ796zfm4TtI76in5msphf2QUccVlYExw0W5C1nXLTvPU9j7hZqz4ROpPR8LWLm3rYFziXbh1kuRAdYl_d0Pfli_QIEkDQEbahae_qEdWGOsrUePjWhWJeG15X9eu8uhRZn_zJOf4QxBSkijbpLdounP-CCKMJtDsRqC992Y5YwWkkQkAmRcrx4NdpgK0QlEJaDAlQOTYMF0BZvkiBtWi_Rpj5C7gdx0h7JRUBsqk5o3XwNdIkmQgOb9DFqFkRl-Ee4ppM8wb154KHNDQWH9rFJhGKUt4Lliyaz0C03Lp4adTdd-pig9MVfryY4E18uW46PFYj22OId9G6WFJtN0mdw4j8ST2cSTFmiEx3IcZrhFWUMGip1STkEv7k0luBQvmWbV0uNUHq6nFBG0nEQ9k12YHc21lW614OyYpWvh_9lpRUaJu4e2H9BPU80HZ-1LDmwg-7jMHwyvE0fZdG6C5XN9gtrNbe0Re3wuYMt01MuSRR_cd6r7ir0VxMYMVRKsV6oT7giTLNcxD15I
Sample260730-th8bts1hpg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299011173728889"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4728	chrome.exe
4728	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe
Token: SeShutdownPrivilege	4728	chrome.exe
Token: SeCreatePagefilePrivilege	4728	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe
4728	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 396	4728	chrome.exe	86
PID 4728 wrote to memory of 3800	4728	chrome.exe	87
PID 4728 wrote to memory of 3800	4728	chrome.exe	87
PID 4728 wrote to memory of 4732	4728	chrome.exe	88
PID 4728 wrote to memory of 1948	4728	chrome.exe	89
PID 4728 wrote to memory of 1948	4728	chrome.exe	89
PID 4728 wrote to memory of 5048	4728	chrome.exe	91
PID 4728 wrote to memory of 5048	4728	chrome.exe	91
PID 4728 wrote to memory of 3780	4728	chrome.exe	92
PID 4728 wrote to memory of 3780	4728	chrome.exe	92
PID 4728 wrote to memory of 1320	4728	chrome.exe	93
PID 4728 wrote to memory of 1320	4728	chrome.exe	93
PID 4728 wrote to memory of 1932	4728	chrome.exe	94
PID 4728 wrote to memory of 1932	4728	chrome.exe	94
PID 4728 wrote to memory of 1760	4728	chrome.exe	96
PID 4728 wrote to memory of 1760	4728	chrome.exe	96
PID 4728 wrote to memory of 4064	4728	chrome.exe	97
PID 4728 wrote to memory of 4064	4728	chrome.exe	97
PID 4728 wrote to memory of 1684	4728	chrome.exe	109
PID 4728 wrote to memory of 748	4728	chrome.exe	110
PID 4728 wrote to memory of 3816	4728	chrome.exe	111
PID 4728 wrote to memory of 4716	4728	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://economist.yatrack2.com/2OJ7liGFrqdJraa2qcEsX_Ut_H9JbnfdsZONKiapW19-QXPB_nwF5eG_V1BJFf-IzQbnx-R3BjxWMspqA4KVj9IetsisrMuxXgoUF7tj4RYasph0btisicfgfLV_ViR8R7DN4bZ796zfm4TtI76in5msphf2QUccVlYExw0W5C1nXLTvPU9j7hZqz4ROpPR8LWLm3rYFziXbh1kuRAdYl_d0Pfli_QIEkDQEbahae_qEdWGOsrUePjWhWJeG15X9eu8uhRZn_zJOf4QxBSkijbpLdounP-CCKMJtDsRqC992Y5YwWkkQkAmRcrx4NdpgK0QlEJaDAlQOTYMF0BZvkiBtWi_Rpj5C7gdx0h7JRUBsqk5o3XwNdIkmQgOb9DFqFkRl-Ee4ppM8wb154KHNDQWH9rFJhGKUt4Lliyaz0C03Lp4adTdd-pig9MVfryY4E18uW46PFYj22OId9G6WFJtN0mdw4j8ST2cSTFmiEx3IcZrhFWUMGip1STkEv7k0luBQvmWbV0uNUHq6nFBG0nEQ9k12YHc21lW614OyYpWvh_9lpRUaJu4e2H9BPU80HZ-1LDmwg-7jMHwyvE0fZdG6C5XN9gtrNbe0Re3wuYMt01MuSRR_cd6r7ir0VxMYMVRKsV6oT7giTLNcxD15I
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1b80c728,0x7ffc1b80c734,0x7ffc1b80c740
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,7880642678365350404,13428525359211738953,262144 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,17463499702194810494,13641644231303415003,524288 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,16078849352732016099,13684400763637481157,524288 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,4384175608238682759,10438551991749397771,2097152 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,8786398630109420909,9081232467126789272,2097152 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,6866954827722879003,17475989548817236481,2097152 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3916,i,7566876625432986468,205145089155431693,2097152 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3928,i,9079329081565233842,4588712323569147833,524288 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5124,i,14087073269105843362,334818107595619891,2097152 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,2880025988208002176,15925341862294487623,524288 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,13795471511445778464,15726299560182656911,524288 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,11789960374071911838,12526992310337771681,524288 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,11331784882459742421,18432818967926680736,524288 --field-trial-handle=2000,i,10893715603438415569,15082560278011736359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2436d3e69a7b4a741863a7de6ffb1b3d1718be4a2194f9d968d22b761704c0b7
MD5 e2f2e84cd58aa435593638437d7ca31d
SHA1 ffaff4b13fe9921b6aa005373096055ba1471ee9
SHA512 28ea61e04753459e088e4435e054fe57c56dde2266df39c0924ed0b478b32ab29bbda840f63f7932fe0241e17326a29544741b768658be86ec20989a1c6e43b1
TLSH
T11DE02BDAC821EC370CFD5B1D54901B45DA5113672760845F3A3C820C8FB06B70685C9C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 1024KB
SHA256 313a2084c16fcaa042cc0a34e969b1327907f3d8498d11356fefda3171b91d21
MD5 9f0422550cda332f46b1a3fb324e7b26
SHA1 c61ce30197592768a451eb5b0815b28f8757b1d3
SHA512 aa46c659b251d012afc2ff5ee67e78ef799145c58d093125d463bcd2b5d6f4a007f5350cf2a78516a14b60fc18039ed1cd548cc8a2fa8c77ca85f913f7b62369
SSDEEP 12288:gvNgXV4t6colX1RYsqHZrtveWrzhaLUyOIcd5Tdi6IvDd8WKbhgjcTlaqdWw8jQP:gVgF1RWrtveEzETONdlQCbyjZqqFGFd
TLSH
T1CF253391A8D86FFF8C7BC12E3FF2194563C40DE5972A8180064E891DD6B6CE0762637E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f1ae5d1638f06ba3bad0ef22f6dd31c8899e3a841430db653acc883520347e6b
MD5 6f4a32fd023b6d0aa1715a8aee85bc22
SHA1 91d3954229eab8c0693625f779afb37bf37da3ec
SHA512 37ef34d6fae659699f1917b943d1cfe599f78ebcea5e7233c36067546d2617e6ef6ec02d7a0cee53458695281a94df55e8ce88bc63b58b87d499ee29ddd558cb
SSDEEP 192:IRCrOPsx8yhvv7ApAPRp2MZ9qHsb+WNnVcE/60eI26kDbeexVyIsnAUge:IRCrOETnkUX7kwVZ/MI2TDbXe
TLSH
T12342A52EEE506A7B9CDBD229FE613B63E7F1102571942E80E6FC892C15D75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0b818bbbdd951c53a76d5ba276572a0dc6fe3fadd0baf06a75be981ad10de070
MD5 db5c983c70df6bf9ca5a0a057e8c40d8
SHA1 b4392aa688d23420d993f05554d418a1f3a30e55
SHA512 286ab7704649128956a9a6ebc8fbc22e16fbe4a5e5293ee16ebcb467b6d2081b357a59b027c460f7535764f620cfd64532537c897b4d48125b913482ed238f76
SSDEEP 192:IRCrOPsx8yhDv7ApAPRp2MZ9qHsb+WNnVcE/6KpkftkDbeeuVyIsnAUgE:IRCrOET7kUX7kwVZ/1kfSDbmE
TLSH
T14E42A62EEE506A7BACDBD229FE613B63E7F1102571942E80E6FC892C15E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 08dfe4deefd32e8d7dbf4a80759be49264c28c00cae0b54f9287683246cbae82
MD5 7f36a8f05df5d72c7300816efb7497de
SHA1 ec96481f26b17d2f758951fd952218ffe80478b6
SHA512 17c34a85a9f77ef830271815d8c20c59d8b4fb2b1cbae89099309879e8c32918095b1f8b8d3e687c0fc37bf7f620ac39c9a8e56a9a33166d10ea3cf10b1082a7
TLSH
T110B01280C4416141C06246B01646948DB1145F149A0B1705E3E4AE22C8259718115050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5892a6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5892a6.TMP
Size 96B
SHA256 8c1fa0ddbf319eb4c2a2069e166170b2fe25a5708512a14bc4a119aaf481482e
MD5 7e87687acabbac2ef6685916e472c238
SHA1 f906d14bb9d45cf8075be61cddd24db483da4d88
SHA512 1f8c3d8e89dcb25d0e8caa04c10d4178c457affa3fe240b95cbd1c5eafcbbbc2ed74fe9f84144074b6890200dd1109681c2c2172ef2e4d21819c5151a1cfcfde
TLSH
T1BDB002A5C102A212C04203B03696E9DD7363DF65CA03225AE3F11AA6DC2967146251A4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 656303da1a0a8fd8865899d13dbd39bc884c6c602da4e776c5a7bfd9e406a1fa
MD5 25fea6c054c5886a75d4aa66beacb9a7
SHA1 88196fd0cd2535f6b9f637ec69594ac0e79288dd
SHA512 725d37b731283e2f154afe8e46ceacdef6596f07c80233cc98cd89d71c6068505d55246da0273c09ed2973eac0f905f9c899edf1f0ade5cb291f833664cdb67d
SSDEEP 3072:bIGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Pm7Rkm1tYpBeh2BAog
TLSH
T12BC3123B5DB4A8375DB5B71EB08E1A1F1EF249A7C924DE92C8C85B0423E97CD0A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0ce88c79c13ce3138d6ae3854aa1cd4baccae095f29dc6a2a97efba24fd4294a
MD5 e04e14a050a3efd33ed594769526d651
SHA1 bdb122edcc9cbfa745e4c8e8a28e97a1820895c3
SHA512 33c7ac1ca15a8d5920f91b40943105f25ded2587bfb87b69107febabf0c5cbb90f19c14835561f76ddf2d8a9ad2f6add5c211e0fe55914cba0049476d755b254
SSDEEP 3072:ApGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Lm7Rkm1tYpBeh2BAog
TLSH
T1ADC3023B5D75E93B5CB5A74EB08E0F1E2EF249A6C920DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6f4130d4e8879bc1c61d0163485b92fdb186606d7dae22ce19dd4e3d09cb77f9
MD5 8c351441ab9eccbccf4528b4f7bfe757
SHA1 1f2d79a72c64afe3207fc5deefc788fd8da3ecb8
SHA512 c0101026347fed54f8f8bd334ae41947bcbc67a58e0eb50b1362ccbe4433eeed65ae2ba07d9c42583871fe33a65377040437c247a27d3800478adada37fcd8fb
SSDEEP 3072:QIGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:um7Rkm1tYpBeh2BAog
TLSH
T1E9C3023B5DB4A8375DB5B71EB08E1A1F1EF249A7C924DE92C8C85B0423E97CD0A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download