hxxps://www[.]cntrip[.]com[.]br/

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/05/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.cntrip.com.br/
Sample260519-wpf72ah17x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237130031411221"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2648	chrome.exe
2648	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4952	2060	chrome.exe	88
PID 2060 wrote to memory of 1448	2060	chrome.exe	89
PID 2060 wrote to memory of 4652	2060	chrome.exe	90
PID 2060 wrote to memory of 1448	2060	chrome.exe	89
PID 2060 wrote to memory of 4136	2060	chrome.exe	92
PID 2060 wrote to memory of 4136	2060	chrome.exe	92
PID 2060 wrote to memory of 1700	2060	chrome.exe	93
PID 2060 wrote to memory of 1048	2060	chrome.exe	94
PID 2060 wrote to memory of 1700	2060	chrome.exe	93
PID 2060 wrote to memory of 1048	2060	chrome.exe	94
PID 2060 wrote to memory of 1672	2060	chrome.exe	95
PID 2060 wrote to memory of 1672	2060	chrome.exe	95
PID 2060 wrote to memory of 2012	2060	chrome.exe	96
PID 2060 wrote to memory of 2012	2060	chrome.exe	96
PID 2060 wrote to memory of 4996	2060	chrome.exe	99
PID 2060 wrote to memory of 4996	2060	chrome.exe	99
PID 2060 wrote to memory of 3132	2060	chrome.exe	100
PID 2060 wrote to memory of 3132	2060	chrome.exe	100
PID 2060 wrote to memory of 4528	2060	chrome.exe	102
PID 2060 wrote to memory of 5024	2060	chrome.exe	108
PID 2060 wrote to memory of 1128	2060	chrome.exe	109
PID 2060 wrote to memory of 3396	2060	chrome.exe	110
PID 2060 wrote to memory of 2648	2060	chrome.exe	114
PID 2060 wrote to memory of 2780	2060	chrome.exe	115
PID 2060 wrote to memory of 2780	2060	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.cntrip.com.br/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaeb4bc728,0x7ffaeb4bc734,0x7ffaeb4bc740
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,14938247811313199254,11302932374311690782,262144 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,12308089806909334241,18303577273571915979,524288 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,1115609584325531408,16735433945750243091,524288 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,13385216474131567575,3564566918267462700,2097152 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,318987932127317787,384802427146734351,2097152 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,17925079113730292862,12081266367610331327,2097152 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,13419129807930033815,5267452047428860151,2097152 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4560,i,441815834920724954,9453789453131052964,2097152 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3252,i,16823670784313731845,14681065174861984789,2097152 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,4562619939104090197,1234894398755871058,524288 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,4337918174101672280,14815215675410083419,524288 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,9628442240967952131,16250729923529352891,524288 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,13945561442139113569,2695067249591306642,524288 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4292,i,3427044011910366265,16093068306680640092,262144 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3408,i,4701465224995767159,14771829833281172520,2097152 --field-trial-handle=2088,i,9972820908122330480,5813602587819974995,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0e882fad61990a9e0ea36360b4c7cc5ac3f115f5db34f1aa20085008ccdeb696
MD5 ecd03170cd7e8a1775f47897e475eb2f
SHA1 d8114293bcdcd4140ba39eb9409208c029eb6e44
SHA512 c4ee7f3b54cfbf063c7142f239ab4cd0f33e2344d5e24188dce1d27ee247d0aaf9bc7586b5a7561f3c4581d59f26ca806095ad1055e766f44c4d89a3aa663a85
TLSH
T1ABE02BAED8619C270CF91B2864500746E74103177F90C84F3A3DC2088FB5A7E8267D2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 b37f81b6e34da1f22a4e161d7630fb2cb89d0b1080ca22563c7fa9249cbbe518
MD5 264dc9d2ee9020d1134816db29f8ea87
SHA1 9dd8f0241e8d2e5f7ec4443aaf26c559cbfe27c5
SHA512 0adbf945860c7dc6a45322262c81daa4836123c31bb15d215573150ceb2b510f24f4f7017885463aed8592709e3a17e7d14c75d5294a965150bf1cdd15a94a17
TLSH
T131B0128926F02603DF0072F20ECC08091390367A125D0B13C0F0047EA027BF6D301886
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 cf7270638411bbd0449efd755d4866d3a5fd8d03fad73ddc5c27300596f60ad1
MD5 d2c330e0859891e704c27794c0b5665d
SHA1 1b3e549a679de75feb1c6cc06103dd924de5f7de
SHA512 122d3ab0d15f5d1d7559f1b0004da94c60d78d34695fa27041353bab255429a3ab6ef340af65a4f0fd077ef397e2181c1dc34210d223e7525bec36aed03ae799
TLSH
T146C08C012AA01003DF4602B20B9D0406139012AD41740B1E8290206E59269B3E8068C1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8eb98abb38cd3a38d25a034a0c1743efc91cb1a4a841c4adcda0c7e8e7ee7af8
MD5 bd8f73f8a72125d9f8fb4c7ac05b5580
SHA1 840c40831be051ade2acffc156fa41a026828422
SHA512 5dfcfde776961b5adf0742791b1f637a8d559bdf0e5f33c0a9c37564710b0e5bf21429b60a37db536e8117181806f70fe8fe4f52b244aad3dcb6ea0f7c3d3279
SSDEEP 48:YALlgysPhb2fXZhSwsHRsHXLswfoKs5fskosRKsLgmzsc4sCIusw43msXPsR3a:DO9opKE9GhBB7JO43RYK
TLSH
T14991BEF7C3E8C66D891156F4A7146E2FCE690924531C3C6AC9D9EF0F93E2872D24069E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c3d108b2cc2852cd90035430dffe12ea8dd631e6cab0cac9e0dc3438e69c8cd4
MD5 99ff2a5a26389b449de0d2bfb2607af6
SHA1 89958572836bf5df8d2ccc7c733060ff3f4b1a2e
SHA512 8c6e0c7d77687766f6f35dfae4340e669dfa9c8928c8e39ed2e351faafdcdab670f79d1432c5a0d65542ad416ef664255aa8069d213c8b3125a728b145026708
SSDEEP 192:4R/bquEcI2Iv7cpAPRp2qOZq9BHsb+WNn0RCwX2+Qe5G+VyIsnAUge:4R/bvUwUXlfrwK52QG2e
TLSH
T10F42C71EAA6465BB5CDBC219F9657B53E3F5102235D02E80EAFC8A3C14EB6CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c2bed9f8cb5435078de6032967aa09f06abd7136a66f1a79cb220855f7c7ebbc
MD5 1b8ff3979afe36c164a266cbd4846c06
SHA1 8ab18fd845fad89a7b1c48feec09b4a437c8c234
SHA512 353c90b6a220a9f126d7d165d0f3086acb33d411166fa61730ab08f365fd27e62d9e965a148439d41bcd57843b09c3b31e575648789ba4794ee9b824d13dadb4
TLSH
T19CB01280C0825503C05302B4119214C87524AF20960E170583F0E926C8262718214450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c937.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c937.TMP
Size 96B
SHA256 3cd71873c326e62bd204f12564162a7eda4118d4c6ef96e5ccb91dc0221e404a
MD5 ada9a3f049ffb3a1f34599de80bca21d
SHA1 7f04ba8738ff31b1bad40cffb134118bb63c200a
SHA512 02b8dcb24d3d552576a370a3b8a910bd13c261fbf27f07a8ea75314821cd8bdbb553776d19ffff672dc94d399d8698be58427a72e73437412bd15719943a3463
TLSH
T1F6B02282C0322223C00303B020A8A0C83030FF2AC3AB220B83F08A2ACC3023200380A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ad73287ece6835c6fe85acd3fdcc381094a9fe04af10d4ae72ffd04570ca8882
MD5 bcbcc555a3b1c28b327aaa0da9e2c7a1
SHA1 a0fbb1e9838f069ea841964cdb7508be0a2fd0cf
SHA512 a46b68f1aa90ac602ef950e3be16de3327641b3021370e6c0b07038326f9152db855ce70dba49b2f0c65be6e81239640cfc146234b4c0dbce26cccb8f0b6ac80
SSDEEP 3072:ScFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:HFmUi21rSm8uUVNSlzY/
TLSH
T1BBC313007AE3E8F2EE5930447BEE2A145D6C0D818291C6415673AE419DEF3C75FAAF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8f95697d7125e756ed91917feeadf768631f8c18905764d07fcd595939ab9538
MD5 a2fa0559fea019dbcdca8c4bfb125ba9
SHA1 75d3d6b0bd36e2253e1786dc0892b75734742667
SHA512 3d5342ce2988c2ddd378c3e03c506790b22dd57bf45dc7c261876bd17257e9fc9ba1ccb0df28aab6a81f1c5140ad6e09743f5c82e54d982a0a14b27fdd28e907
SSDEEP 3072:SVFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:WFmUi21rSm8uUVNSlzY/
TLSH
T1A1C313007AE7F8B2EE99304476EE3A158E680D818291C54147739E419DDF3CA1FABF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9fc031c62c99654536018cae4b351205a30e52800dc3497f6457a4be3e9ab14d
MD5 8a365022ca851857b6a41d21500581c0
SHA1 820fa41422c8afdf05a1f8ed6a61edb92f69477a
SHA512 a74ace8d07b1f806f46b04744025904afb5dbe18779e4f48d5227a8c51ebec1e99c49dcc0711efb9f06b39f3b453a549af38eea20e0fccb8bb186a31685391af
SSDEEP 3072:SSFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:/FmUi21rSm8uUVNSlzY/
TLSH
T1EDC313107AE7F8B2EE59304476EE3A158E680D818291C54157739E419DDF3C61FABF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 117a21fb15b31ae66191e0200db577680acfa8076f8032fa6ed85db94eb3557f
MD5 94d3f1bd6810659d97c900b8fbf2a551
SHA1 3fa312b64b679880990b9275f62f2969838ae16f
SHA512 6c4ad875930e677f757a51a0182dfd56c64a453be0219dea3e7c3928619442c0b68966fe96982556f86c1286aedd419538d9a44bd511c3e6a25caeb3e30fe8b0
SSDEEP 3072:SN0FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:e0FmUi21rSm8uUVNSlzY/
TLSH
T1EEC31210B9A3B8B3EE9930447BDF2A144DAC0D418291C60196739E415DEF3C66FABF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download