hxxps://news[.]chiefexecutive[.]net/acton/ct/39684/s-1ad0-2608[:]0/Bct/q-0292/l-0249[:]994c4/ct0_2/1/lu?sid=TV2%3A3vK6vMiiS

Analysis

user interaction
yes
max time kernel
78s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://news.chiefexecutive.net/acton/ct/39684/s-1ad0-2608:0/Bct/q-0292/l-0249:994c4/ct0_2/1/lu?sid=TV2%3A3vK6vMiiS
Sample260807-rf4vhsfk6t

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	41	https://chiefexecutive.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a276dc30ea9432d5	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5652	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305853603471822"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe
Token: SeShutdownPrivilege	4844	chrome.exe
Token: SeCreatePagefilePrivilege	4844	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe
4844	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 5504	4844	chrome.exe	86
PID 4844 wrote to memory of 3192	4844	chrome.exe	87
PID 4844 wrote to memory of 3192	4844	chrome.exe	87
PID 4844 wrote to memory of 5652	4844	chrome.exe	88
PID 4844 wrote to memory of 1892	4844	chrome.exe	89
PID 4844 wrote to memory of 1892	4844	chrome.exe	89
PID 4844 wrote to memory of 2436	4844	chrome.exe	90
PID 4844 wrote to memory of 3036	4844	chrome.exe	91
PID 4844 wrote to memory of 2436	4844	chrome.exe	90
PID 4844 wrote to memory of 3036	4844	chrome.exe	91
PID 4844 wrote to memory of 1144	4844	chrome.exe	93
PID 4844 wrote to memory of 1144	4844	chrome.exe	93
PID 4844 wrote to memory of 5772	4844	chrome.exe	94
PID 4844 wrote to memory of 3400	4844	chrome.exe	104
PID 4844 wrote to memory of 3400	4844	chrome.exe	104
PID 4844 wrote to memory of 3428	4844	chrome.exe	105
PID 4844 wrote to memory of 3428	4844	chrome.exe	105
PID 4844 wrote to memory of 4084	4844	chrome.exe	106
PID 4844 wrote to memory of 4084	4844	chrome.exe	106
PID 4844 wrote to memory of 3308	4844	chrome.exe	107
PID 4844 wrote to memory of 3308	4844	chrome.exe	107
PID 4844 wrote to memory of 4776	4844	chrome.exe	109
PID 4844 wrote to memory of 4380	4844	chrome.exe	110
PID 4844 wrote to memory of 4728	4844	chrome.exe	111
PID 4844 wrote to memory of 4676	4844	chrome.exe	112
PID 4844 wrote to memory of 4676	4844	chrome.exe	112
PID 4844 wrote to memory of 4156	4844	chrome.exe	114
PID 4844 wrote to memory of 4156	4844	chrome.exe	114
PID 4844 wrote to memory of 416	4844	chrome.exe	115
PID 4844 wrote to memory of 416	4844	chrome.exe	115
PID 4844 wrote to memory of 5840	4844	chrome.exe	116
PID 4844 wrote to memory of 5840	4844	chrome.exe	116
PID 4844 wrote to memory of 768	4844	chrome.exe	117
PID 4844 wrote to memory of 768	4844	chrome.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://news.chiefexecutive.net/acton/ct/39684/s-1ad0-2608:0/Bct/q-0292/l-0249:994c4/ct0_2/1/lu?sid=TV2%3A3vK6vMiiS
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffeb52cc728,0x7ffeb52cc734,0x7ffeb52cc740
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,13368983912461174053,16990193859269902949,262144 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,14058807082182145061,2633106495924647649,524288 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,14733433004694074868,7239036020761146121,524288 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,6934129669986462445,13523013756085096050,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,14820705717801744718,17482363154543625413,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,15729540755450311396,6305963812130210984,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,4960469256195034844,17328267336101920515,524288 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5700,i,7655596131402254062,2004901742726907174,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5408,i,8706409607276943596,6645900769343660837,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5708,i,5288370396990006986,2876823805537384758,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3248,i,10313619871387267609,4812660997610768715,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,14765711083692569882,2940608518881959141,524288 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,9439486129491013928,1720445650664028305,524288 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3252,i,6993970559141162561,17053400577699383819,524288 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6528,i,15440582086946229441,3938235087509479705,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3252,i,1006404189818101802,13003940630065480717,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6408,i,222271531779118383,17416734285326622986,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5732,i,5061569731611781750,960198802138161764,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6264,i,4617023837160736849,11216529874508786784,2097152 --field-trial-handle=1996,i,6897075660695336285,4045577193611599166,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8b3f99754160dd4289edd67e82f98e545c257e68498838de58553b06c79d427c
MD5 fe4ea1db5a46c78781e1168415da0988
SHA1 f4f1da7e1b1557a8f44d5d56d51c878c4ca243ab
SHA512 e532b6b094756e0c14de18a97f1f2ee536d143d4b23b4cd66755abe66b9bd281a51a8b7cdcdd177547d1cb4e61c1edcdba4c0203cf50cd7f29875d53d97d9e92
TLSH
T16AE022BEC962EC370CFD1B1CA0500746EA6563873B40848F7A3C88288FB423F428A85C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e44877772eeedb289746159bfb9832e282e3a49ee52d56d0a401e67a2dfcf1cf
MD5 61649b0afc33ab5891fa251ee7372b27
SHA1 9ce2a968213e229f50c384374589e4c32b661733
SHA512 3045f36498ef9d45ae68fe121ffba53fafe0c64d59cb9ae6f42953257051842d8ab56cab0ebbdd33fe01434d9025f7799a55a9855f7d769fffc4233aa55aa4de
TLSH
T1864164F127C2443DEF08A7BD4A6A7C392860CD6749C77B57C5AC9C509B376C90382615
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_chiefexecutive.net_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 ac2fb9136b7b4f50893112b727779442f596ebe369f29e8efeb8cb2fe823e512
MD5 22cf3f9e5dcd060988c8aaeab7d8f0fd
SHA1 7b55d442237c4d8ba958beb1529bb87878c527df
SHA512 a9da1de455a5c37075d4e2568daa94dfc2ef5003c8bdc1ac49f76409468e647d949b6247e5001dd72bf845e23dafd66177f452fc0be72e7ac1785e9beec4b8c4
SSDEEP 384:D8m7egrkz+BeDeN1rAhydB2aaIEdsGtJW4HA93FyQu975i3KZAtjBcSV6HhpzSP+:L5xzLh4F
TLSH
T1C4628CB393F486BEDA2152F0AA242E27CE2D1958137C3C9AC5E8DE5BD3F2571E10054E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e2a6db51f0e0622294daf767ab4cdd9d6ebf339dbcb3ee5a5583fac5b873af17
MD5 79eb1b3a19de06d3e8326a8c1b76989f
SHA1 7c263e5b9848f7af0a8a35796f7e10fa23c60c88
SHA512 e316e1b88a33f64dda79d843410749de1d73d3ad386d0d6b617796d5e2ec27603ccfd7e7ae06a30b0ed9f940ab677846adc0e02ab2e4dd6a810dcfa09cd0e9fc
SSDEEP 192:5RMkRI8B2i0TGBv71hpAPRp2g92Hsb+WNnjGP4mea2qRLaFVyIsnAUge:5RMkRJB2mRBhUXDQwaPf2waze
TLSH
T10442D56EA924747BACDBD21AFE267753D7F5102121E02EC0E6FC992C14DB6CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 75591aca2881fa3bb0e9e913f19bfd2990c65328d60af907064f166e67f81f46
MD5 65aae4db992321a1c01f99d6b27e9315
SHA1 0e1ab4e3bc3c44491a90b3f8fcaf76ffca05a438
SHA512 463f57d6b2e82e65a141b0a811870082d0ed33c9ef8965738c5cbdf258d908be14fe1113573a9dd98ee0c4d6afaf015e7caa8653a8888e63c319afb37760a39e
SSDEEP 192:5RMkRI8B2i0TGVv71hpAPRp2+ms92Hsb+WNnjGPUmea2qRLaNVyIsnAUge:5RMkRJB2mlBhUXHQwaPr2wabe
TLSH
T13F42D56EB914757BACDBD21AFA227753D7F5102121E02EC0E6FC992C15D76CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e2d44dab3ebb4d18f579a5b5ec5ee547be68082d4caa08cea7e5fafde6fceeed
MD5 e14a01ff80d9a9f864d92ea738bec631
SHA1 9271774acc07e2e60f4cfac29cb5da196770123d
SHA512 5df5b5f0879e4297330fd0b53fe275238a24bf56dcb3457ebee24f18b16022a1a55b0332d98fb1e2a80a06dbcd8ea6410ae5460b37fc13a548676632d04b0f09
TLSH
T172B0125084819101C05207F81152148C72589F14960B270643E0ED26D82A5508119150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5859f2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5859f2.TMP
Size 96B
SHA256 d4a4f01f011fdfc8f66f15b8167c71c700d163e43ad387c09542c887460d6480
MD5 61069111142fc1efa8f082268467c6e6
SHA1 19e905bb2e06ba44481e6f363f5f61439a012ab3
SHA512 d33e75f5175a63bfe9f566baacccd965ead300c3a6c4dc3b57b06ed690fe848f5a5b3747eb3b478e00b9a83ef9e658ec281d097c738d1d4e6a853afaa378bc6e
TLSH
T1DFB02288C2032203E08303B02882CEE8B030CF20C2032202C3E00E22CC202200220220
MD5 SHA1 SHA512 TLSH

Submit Download

d148bc1d-8445-4b7f-9119-a79d970aa0f5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d148bc1d-8445-4b7f-9119-a79d970aa0f5.tmp
Size 13KB
SHA256 e5a5ddd9c59848a206db1cd3ecaf527f36779ac806677ff47861da22bc57663c
MD5 54e4c5eb57e788f19c6c920d8c04acbd
SHA1 b063d38f85ae4de990145217efaa4e8ecaaa3d81
SHA512 1480f97c7d44ca5678983c31326468763fd7ae5b876f97f571937f200895925b2394c8dcdd86428d79639a3fa2b0bb2e9ce2c520714a8e0aa6c8d05871b83476
SSDEEP 192:5RMkRI8B2i0TGcv71hpZqPRpqh+me92Hsb+WNnjGKiR2vmea2qRLa7VyIsnAUgE:5RMkRJB2mIBhwX1Qwal2W2wa9E
TLSH
T1C852D56EB910697BADDBD61AF9227B53D7F1102121E02EC4E7FC892C14E76CD222300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 12da2f3a68d18334ee8a5abb331bda0061137fcca69c5425a4bbe1f7a6950623
MD5 9c3aa9af9656dd2bd63676675a78e437
SHA1 e7055f6beba247f9162b94e2e92f23ba7ede7680
SHA512 8cd05dfc427df5c9410c01ae124a72da7626d3a71eb50d75a4a05ba69054ba990802fa7a8c9896a89433499167944797a5d59a21d7efbaa11b7e0ee1a898ae85
SSDEEP 3072:aGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:9m7Rkm1tYpBeh2BAo3
TLSH
T1C6C312275E71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D86B0437E97CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 29328dcbd880cdb9dd05d4099ad73ad3df9056773644b5edda6575366002f2c3
MD5 55356b4a9bddabd5dc9ba06be74ec1bf
SHA1 53a84ea1557c313a675a22a698a26298981485b3
SHA512 9950205cc1a99e7d04aae654277612b5aec1b9cb35606598716da237ac539fd08c5e31db9143c75b84dcba90e5f97182c4ca0c24098d17f279c5305ac0892d8d
SSDEEP 3072:EGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:nm7Rkm1tYpBeh2BAo3
TLSH
T121C3122B5DB5E9375DB9BB1EB04E0B1F1DF14AA6C920DE92C8D45B0423EE7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7c6566b88862ce4d0569947153f03133309ccca3d5278404491c37957cf50627
MD5 11724fe420e8a740bb5a8762f5e8ac79
SHA1 092cc246d4c4dd13e9d19a20d898585152af98a9
SHA512 475b26a39127b9edaa110a818ade45d625ab6a88cac56b8483cd4506e6da641c465b6c1a6a7af84e019a0493a797a23b797a6484f15f41f73deca348ad8a0080
SSDEEP 3072:RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Am7Rkm1tYpBeh2BAo3
TLSH
T172C3122B5DB5E9365DB9BB1EB04E0B1F1DF14AA6C920DE92C8D45B0423EE7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download