Overview
overview
8Static
static
1Balance Cl...on.zip
windows10-2004-x64
3Balance Cl...on.zip
windows11-ltsc_2024-x64
8Balance Cl...28.png
windows10-2004-x64
1Balance Cl...28.png
windows11-ltsc_2024-x64
8Balance Cl...16.jpg
windows10-2004-x64
1Balance Cl...16.jpg
windows11-ltsc_2024-x64
8Balance Cl...48.jpg
windows10-2004-x64
1Balance Cl...48.jpg
windows11-ltsc_2024-x64
8Balance Cl...t.json
windows10-2004-x64
3Balance Cl...t.json
windows11-ltsc_2024-x64
3Balance Cl...p.html
windows10-2004-x64
3Balance Cl...p.html
windows11-ltsc_2024-x64
8Balance Cl...pup.js
windows10-2004-x64
3Balance Cl...pup.js
windows11-ltsc_2024-x64
8Analysis
- geolocation tags
eueuropelondonukunited-kingdom - max time kernel
900s - max time network
894s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 23:03
Static task
static1
Behavioral task
behavioral1
Sample
Balance Client Extension.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
900 seconds
Behavioral task
behavioral2
Sample
Balance Client Extension.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral3
Sample
Balance Client Extension/icon128.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
Balance Client Extension/icon128.png
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral5
Sample
Balance Client Extension/icon16.jpg
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
Balance Client Extension/icon16.jpg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral7
Sample
Balance Client Extension/icon48.jpg
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral8
Sample
Balance Client Extension/icon48.jpg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral9
Sample
Balance Client Extension/manifest.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral10
Sample
Balance Client Extension/manifest.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral11
Sample
Balance Client Extension/popup.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
900 seconds
Behavioral task
behavioral12
Sample
Balance Client Extension/popup.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
900 seconds
Behavioral task
behavioral13
Sample
Balance Client Extension/popup.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral14
Sample
Balance Client Extension/popup.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
General
- Target Balance Client Extension/popup.html
- Size 2KB
- Sample260728-211npsycph
- SHA256 7fa8d62fcc852ce86d86bef957c56745c2aa257c199e4e47e4dff069766fa7b4
- MD5 80dd7e9b075f37fbae64d86910734bb9
- SHA1 eb89ce26a953100e0205e9cb90aa348382078f88
- SHA512 dac7f13819181b55e699fa7dfc18680fd96543efb0699a5d80a01cce03c5b0dab022fad8faf771a0c39c5b3fb535fe05acbd001dd5a193fe794d4b4b205d3cdd
- TLSH T149512E19DA84040B70776338FBB38251F7175563C2068F697EAC32B18FB49485CAAECE
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6108 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297534658347621" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 5028 chrome.exe 5028 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe Token: SeShutdownPrivilege 4616 chrome.exe Token: SeCreatePagefilePrivilege 4616 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe 4616 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4616 wrote to memory of 4612 4616 chrome.exe 86 PID 4616 wrote to memory of 1172 4616 chrome.exe 87 PID 4616 wrote to memory of 1172 4616 chrome.exe 87 PID 4616 wrote to memory of 6108 4616 chrome.exe 88 PID 4616 wrote to memory of 4472 4616 chrome.exe 89 PID 4616 wrote to memory of 4472 4616 chrome.exe 89 PID 4616 wrote to memory of 4812 4616 chrome.exe 91 PID 4616 wrote to memory of 1076 4616 chrome.exe 90 PID 4616 wrote to memory of 4812 4616 chrome.exe 91 PID 4616 wrote to memory of 1076 4616 chrome.exe 90 PID 4616 wrote to memory of 5684 4616 chrome.exe 92 PID 4616 wrote to memory of 5684 4616 chrome.exe 92 PID 4616 wrote to memory of 2440 4616 chrome.exe 98 PID 4616 wrote to memory of 1820 4616 chrome.exe 106 PID 4616 wrote to memory of 3488 4616 chrome.exe 107 PID 4616 wrote to memory of 632 4616 chrome.exe 108 PID 4616 wrote to memory of 5028 4616 chrome.exe 112 PID 4616 wrote to memory of 3152 4616 chrome.exe 113 PID 4616 wrote to memory of 3152 4616 chrome.exe 113
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Balance Client Extension\popup.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaade3c728,0x7ffaade3c734,0x7ffaade3c7402⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,6209744187766186132,1512694538205009910,262144 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:22⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,9847727331058745114,16370495400031824488,524288 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:32⤵
- System Time Discovery
PID:6108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,710124588611139746,14661622360314527088,524288 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:82⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,10997471837334063816,11214015092126193931,2097152 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,1300975555881431660,8956398839694906951,2097152 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,3282708249590260477,10562385727770767042,2097152 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4020 /prefetch:22⤵PID:5684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,7705403747798463687,6504686003135491595,524288 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:2440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,10480815378855589333,13482245990263006083,524288 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:82⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,11314401699375827218,16534711465194686064,524288 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:82⤵PID:3488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,4600339181750756292,11432688369636593277,524288 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:82⤵PID:632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=732,i,16853084915823906117,3609041843917162015,262144 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4276,i,4232458554040889530,12192354517092116276,524288 --field-trial-handle=2012,i,13080804207431550600,12692103649718345954,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4340 /prefetch:82⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5544
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 510665c6e1f2f1cf39354e29406976d568c4a6c8697a8b5fefc90a70227adf65
- MD5 d7cbc6256532da9c23683a0241f13927
- SHA1 9a7b8f3ed823d00368bfe73f4898fa87f2aaf794
- SHA512 646cdb092f2f18f97df72c5fa00f5aca0f30d9f8da84965284f97890249571534e0330bd9d6b606cc06d57049de433fd20028f1545ecda11647ccdad5290bccb
- TLSH T124E0EDAECA62DC6708F90B1AA4640746EA5527073A80848A3E3C8A088FB462F428685C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 2d7cbce05154b6ff8e11d8c20724923fcefe51d2134ea0c8f691b1559c7b6b1a
- MD5 3cb07f18c3ae368289361cf35a3a06b7
- SHA1 089ec72332dd4ec99846f14b859b8174d2d538e8
- SHA512 d609180f4ad9002198c1aab16ff99eb59f776c99697c47c07411892cc21091e4d03d0b55651bffc10ef170b879d8661afc0e8601a97fef2d531bb9d73b1e37fc
- TLSH T15E41ADF793F4957D8A1196F4EB157E1FCE690524032C3CA688D4AE2B93E2972D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 9b2c413cb010c9356fdd2dc6b19cdd8355fb169de66d410f05ee7734a4792353
- MD5 c83be9e2d1839f9c058fd56020510b9b
- SHA1 d682a412b982c7e4b9f66f664b628bbd3a63815e
- SHA512 980c702cb6177979eeaf64552f933de468dd394885bfb0e3b8d7ad960e6a7e278123565ed27071c4c1b4f8268d159d21c8d808981275d3e615bb6de797fcf4de
- TLSH T1E8419BF793F4957E8A1192F4EA156E1FCE6D0624131C3CA689D4AE2B43F2972D10478F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 ff9da9d7be2446a7b19ae9c3516aab7a993d273f287ea3a3e8d08cc6dd7815be
- MD5 e6add17717d0bb4d8514067700f0c868
- SHA1 48e1018d815c4e140b2fe72cae305987554fef2b
- SHA512 8c368deb3aab6a4085af55d4d542e6e2aa00044736144e8683c86184d7bac6e3c8d55cfb0186e45ceeb91b55858c644482e1817e7be9e9cc401a4020237970cf
- TLSH T19041ADF793B4957E8A1192F4EB156F1FCE690624031C3CA688D4AE2B53F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 5b2d594e1376b990e6c4e69ec221d98f4615d16db09d58d085c158fd2c9b92e2
- MD5 169b3aeb8a18a3797436e42564688008
- SHA1 b2df1c7f85503682a716ae31ae60249959dc9484
- SHA512 e61fb3d180f39b77a50ed2142aaaf1d6d50c70b5b6978e08956d28e4f0abece8aea29ce1cf46d6a544f52c89f35d2711a8e9a9a96fb1ff27065e08b275c00262
- TLSH T13C41BDF7D3B4857D8A0196F4EB156E1FCE690624032C3CA688D4AE2B93E2972D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 28267f6a789a07661725b028bfb17c17c6aeb932b141332cb9f515e8f7ae7338
- MD5 ae1eaf524f3d483a19ed0cddfd109f6c
- SHA1 cf9b9302fc5719155560f77308b0e40406e72554
- SHA512 30ede0b4c2d9cd885d6b9e474d4f5d30e144f87a7455712f68045e82235b6a73b1d20decf02f108366684e70f051989c07fdb6a5d1312d220fbd0449c2b7fe2c
- TLSH T187F050D79769B453117A45EB1D00BC0915B5683505416CE4CF6BC1BCE1804F30B12453
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 fd66f9db8ad72481ddb5eb6dcf4eb864a4848971cd3c24d4f35c5a941671bffc
- MD5 d526d9a3e34d919a7f39c1219a6f9662
- SHA1 363261b34f0948039cc58f1accf730ef89cefadd
- SHA512 d992d2b31ad7b22ebfd371e3d8ab2cae98336b864dcdffe2627e056bbdac7efd3260edb373ffba49e36a592942f6bd84e65e5bec176bbf08f214974bb6786247
- SSDEEP 192:5RIB5Riysv71hpaPRpkO+92Hsb+WNnJd4PeW4cHVyIsnAUgE:5RIBF4BhGXYQwb4PV1E
- TLSH T17452E66FB910A9BB6CD7D229FD517B13D7F4102161A42E80E7FC8A1C15E76CD222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 fc824e8818ea5502ce294605018491ecad29f4ad4fd8f7f26c3c29b3cc1fd782
- MD5 2417b4076ac0d6c15b5bffb05f80979b
- SHA1 36541271e6e20f63aef3024c6b54bff1698f72c4
- SHA512 7f9d45d570ae6e73f9299093743bcec82c899fccc5f34aae8d728eb603612d3067217e0833b6dd6086241cc744299c3a78169f88b5cebd8e95eaa482e78471dd
- SSDEEP 192:5RIBlRiysv71hpAPRp2O+92Hsb+WNnJd4P0W4cMVyIsnAUge:5RIBx4BhUXmQwb4PrEe
- TLSH T13242D66FBA10A9BB6CDBD22AFD617B03D7F4002561E42E80E6FC891C15D76CD222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
- MD5 97aacfb3977979cfbf9d8a6c4d36d689
- SHA1 28c462804fa985bea43aac67e658ae60025ec226
- SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
- SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
- TLSH T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 a5e7457efb3eb6fb1542a18b232f95703aa3df5c31205f86e201ba56d8fb5c4c
- MD5 896fca8fd4e655492f8500ba19e37a68
- SHA1 1c71f230bdb6c31371e70fa8ced9155c6ab023d2
- SHA512 7e200e33467de1362afb6787f052ff2207d804cea3889bda2b36ce0b19c43d979649735297200514ac85e3c797ae38fcdaf2cf30392aa4195ec7304c2159fea7
- TLSH T1CBB0124080017101C04202B4217228887114DF10960E374183E869E2C82F56184142D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b292.TMP
- Size 96B
- SHA256 4656c6b91543df9c30cc864441e86cddf1f30d22ebec48d0dde6364c32fb02c1
- MD5 233ce1f2b0fc8ebae15ec742cc034e31
- SHA1 a125b5724c9b113602997478bbd2d6dcd2686171
- SHA512 371a9854a1643a2705893895bfa4ba6b6a243aa44cd2247be88e0801795a7c4a5eff65b1a8651016a88d2da7187907d70da4f4991dfb11fbedbdd050daecc2b9
- TLSH T1C5B00255C1136652C04203B025A595E87168EF26C603D22297F01AB6DC296734925564
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 629805010fe5083c40ddb67af4d32bfcbf10aa97584f53ab88e837eaf124c988
- MD5 95e7f1c58ca4919334719739641f6b96
- SHA1 fb9ba9882cf4c30fcf771130094f712b6b333b91
- SHA512 162ebead165ace61e215aea0c24b37ce4e76d42b3ed85a93a810d5edeb727979a0b04e5e97055a91e91d9f96f2202bbcf25c164c30036ec33336399c8a75dc7e
- SSDEEP 3072:MGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:/m7Rkm1tYpBeh2BAo3
- TLSH T1F3C3123B5D75A8375DB9BB0EB08E0B1F1EF14AA6C920DE52C8D85B0437EA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 eb9bc00d457cee8693c10955bf673088e51126a3d32c02f6dd8207746da76669
- MD5 cc970be5005ea24bf8fd3b95e27b6669
- SHA1 32dfb3264250f0867c42746c5d3139e67b42d2ea
- SHA512 cd68d1c399a524ac0d1bf5bc32377c38ad686fdcdcc736927503c0237e81667f5c8c16f393b70814a30007cac9ed85e8405a0366405233d06be7c5a79e2e5c7d
- SSDEEP 3072:KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Nm7Rkm1tYpBeh2BAo3
- TLSH T18BC312275E75E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85B0437EA7CC0A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 700257bddb91891be2bdc94c174149b49c70b358772ff10d268af2eeaaaacf74
- MD5 671936e41c33c1e2f7d3bcd8b3b6e2b2
- SHA1 bf501fcd2483634cfa947203f1af649c00301a1e
- SHA512 7be71538f9267754f6bd1ca8aae397ed23f127a68eef519fb2cd7e6142d9f2092a6f405455808acb871d208110d26182fd4aff6299c96197fa051033c77f6dec
- SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Fm7Rkm1tYpBeh2BAo3
- TLSH T119C3122B5DB5E8775DB9BB1EB08E0B1F1DF14AA6C920DE52C8D45B0433EA7CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 473118fa98417d1690a7fdbbffff23b76ccd503d8d08f3d164d5dff065492b63
- MD5 b2ec7abdec839fe43d62a2ebf970d8f3
- SHA1 bff2227f2caf0a450d03c4e0a8f3d9cfdc3b2b6f
- SHA512 c0e87a7d275f65a349603a5c52ba0652158fd44e95ca23d5e6cf336b9ac607ca7d9d3609233b0cce82561534f7a552965c8157cc1fb52c4841cd39eb879a9047
- SSDEEP 3072:sGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:fm7Rkm1tYpBeh2BAo3
- TLSH T175C3023B5D75A8375DB9BB0EB08E0B1F1EF14AA6C920DE52C8D85B0437EA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 e60b43cd49372ceb476fd24de3883c20b7aebb5e17412068d0380ae92f518095
- MD5 3f8ea79ccacb8cb6832aa43210c782f4
- SHA1 64b786e6cfc2f50503a7bb69e1b012f8724142a8
- SHA512 1bd9e879ad0670284524658a6a3e9c493e96b07f0bf2b133ebe3ed4b1a3318e7f4f74ae452dc2454c5c437d6f474d02015f4b548e6957bcd50880c624254e9cb
- SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:em7Rkm1tYpBeh2BAo3
- TLSH T1ABC3122B5DB5E8375DB9BB1EB08E0B1F1DF14AA6C920DE52C8D45B0433EA7CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH