hxxps://lcgxcqgewa[.]yavroxinta[.]com/?emx=a2F0aHkubGVibGV1QHJmbXcuY29t

Analysis

user interaction
yes
max time kernel
900s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/11/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://lcgxcqgewa.yavroxinta.com/?emx=a2F0aHkubGVibGV1QHJmbXcuY29t
Sample261111-wt9edaay8t

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	8	[email protected]	860	chrome.exe	1
Email address	8	[email protected]	860	chrome.exe	7

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
55	api.ipify.org
56	api.ipify.org

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
8	860	chrome.exe
8	860	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
860	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
2476	chrome.exe
2476	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3080	3416	chrome.exe	86
PID 3416 wrote to memory of 2144	3416	chrome.exe	87
PID 3416 wrote to memory of 2144	3416	chrome.exe	87
PID 3416 wrote to memory of 860	3416	chrome.exe	88
PID 3416 wrote to memory of 5060	3416	chrome.exe	89
PID 3416 wrote to memory of 5060	3416	chrome.exe	89
PID 3416 wrote to memory of 3216	3416	chrome.exe	90
PID 3416 wrote to memory of 3084	3416	chrome.exe	91
PID 3416 wrote to memory of 3216	3416	chrome.exe	90
PID 3416 wrote to memory of 3084	3416	chrome.exe	91
PID 3416 wrote to memory of 680	3416	chrome.exe	95
PID 3416 wrote to memory of 680	3416	chrome.exe	95
PID 3416 wrote to memory of 4520	3416	chrome.exe	96
PID 3416 wrote to memory of 4520	3416	chrome.exe	96
PID 3416 wrote to memory of 3564	3416	chrome.exe	99
PID 3416 wrote to memory of 4636	3416	chrome.exe	105
PID 3416 wrote to memory of 5020	3416	chrome.exe	106
PID 3416 wrote to memory of 1772	3416	chrome.exe	107
PID 3416 wrote to memory of 2476	3416	chrome.exe	109
PID 3416 wrote to memory of 4444	3416	chrome.exe	110
PID 3416 wrote to memory of 4444	3416	chrome.exe	110

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lcgxcqgewa.yavroxinta.com/?emx=a2F0aHkubGVibGV1QHJmbXcuY29t
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff91e56c728,0x7ff91e56c734,0x7ff91e56c740
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,8559630120784711271,2180561550113689010,262144 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,16496460226528991296,11427358431941399385,524288 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,7343300475640567326,7650535487684864254,524288 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,1986295386307723349,7883571271715584492,2097152 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,16804100644684586443,266111969220962597,2097152 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,3241897561889339908,1279637825553379552,2097152 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3212,i,18212284643155061180,6698157621565181075,2097152 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,11825320526203454788,8409745600012249842,524288 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4544,i,13050441244002621324,14625897858023084149,524288 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3908,i,10492122440821301856,12863847167889183435,524288 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4592,i,3209426834605521832,10870462376504113154,524288 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4532,i,6133061609484661440,3717862037443068057,262144 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,2410706653642549214,9915837644661629021,524288 --field-trial-handle=1916,i,3148014919307208691,10147941827233145145,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4080 /prefetch:8
  2⤵
  PID:4444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

00de72bd-268a-479e-8d3e-e1de63c2b8ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\00de72bd-268a-479e-8d3e-e1de63c2b8ca.tmp
Size 130KB
SHA256 bd26db4ca12eac3e099e1942445745b03cdfc610c5a4f6350e11fe26595efb28
MD5 fda636e906cbb2b2aa6b56deb9cbd63c
SHA1 451e10e93c68a2524b26317b5548fa870cc2fd63
SHA512 bd590f0369021f1f33d1399e770f5488fd2b5ca34a49509f378c4b50b70d3d297a27545f56e2b1c9347ce61ec08ffc4086cee7c080665d6f166858836c5f0a2e
SSDEEP 3072:dJH+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dJH+hFD+7t56OD9ZfSApprr
TLSH
T1C9D31232AA91D8BBC9BC6541B157A304DE7668ED41DE3A09444A5F8EE09FC4C06B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3758b1b0-8590-44ee-8edf-34769f78f594.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3758b1b0-8590-44ee-8edf-34769f78f594.tmp
Size 131KB
SHA256 6f6113cee610feab55d48a50c6fe4ee13a87448e9b8113a3359adcf047bc334b
MD5 6ebf279fcb12ae9f3e9f7cbe0f0755ad
SHA1 e8fc505257f39fc5f7dda8185b75a6c00ed2ed98
SHA512 4f24db22deb7f0b07c667108e71f27a7e210f46e716eaabb764f1cb4c5904d46b662c6c1fd3238b1d2226e1882c1e46c5385f2eae778444dbc593169c4814679
SSDEEP 3072:rfE+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:rfE+hFD+7t56OD9ZfSApprr
TLSH
T17ED31232AA95D87BC9FD6541B257A304CE76A8ED41DE3A09444A5F8ED09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

381ceb74-8aff-49f4-9e9e-4f72ed57f810.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\381ceb74-8aff-49f4-9e9e-4f72ed57f810.tmp
Size 11KB
SHA256 f29ccd56a50d282782f929e3299388cb7d0d62b93208fafadc853c7db9f9a52f
MD5 efa208ea57a7e8f4ad7dbed21d8fe7f1
SHA1 8a148bc090cac69b3f931f414134e08ea803ed9a
SHA512 bb0aa8c709749969bcaa2bda82a7343f27cf2fac263572e91acb2fb6a38b703e7c730d5259bcb495d45ddbd54e16e1a81ab3d64ded7f545ff75c76fc1c116d53
SSDEEP 192:XRzxDRNyv71vAPRp2da9IHsb+WNnssAA02Xcjuq9VyIsnAUge:XRzxFNe56XN2wL42Kfe
TLSH
T1E142A62DAD10797B5CDBD22AFA21B757EBF6102661942E84D6FC883C14DB9CC3227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

535abf03-b18e-46e4-ab95-c88b87408a1c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\535abf03-b18e-46e4-ab95-c88b87408a1c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 192B
SHA256 3091280f23379e4e8f15d29cbb9c1ddd0b9e31143bad5a9dadee36d8ea70a79e
MD5 67d75daf4e99cff5659a0f4859c82eb9
SHA1 32326d0f7a13e175321054e91dd8fc3977f59ad9
SHA512 dfda1e00a0ee53a3f5bfdcd71d865eef4ed9a4eeabfe52e007888136a0cf5f86e22b61ebeacc17c9ece9d6b636560465b3c52bf0e74b5956ab0a73d9f259c511
TLSH
T1E3C08CE188EC2AC0E743467B78F2088C5000C4E4BA11C3638380A050ECB27F08693800
MD5 SHA1 SHA512 TLSH

Submit Download

02715bf4-ff44-409c-9510-84498fb798df.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\02715bf4-ff44-409c-9510-84498fb798df.tmp
Size 4KB
SHA256 b993d4a54d521429eacb8cf7e3a057c77de3a92b1d3a6aa74658c660018e7831
MD5 bbb2b68d90330fdfe746757ec13926d0
SHA1 94530636be395dcc8cc7d10dd1be6e2cb8009a4b
SHA512 a8c955272e84bbc5d597e3f2779ea663153385b6a7dcca81aba743b80473360128bc33a49a87f9257fc669489bd3fb344d8c60baec3ce5aa986de02d6c31a464
SSDEEP 48:YALlLNrL2S7LNhLNph+aXYfo7EdKsK1NLGL3LuQsrcfLUbsrcfLUpLPCscL6dLtU:Dtj/3saIaEdMN6znQBQp7iAit0TK
TLSH
T1CD918AB793F4CB6DD51056F4AB046E2BCEAE0528036C79A7C9D0EE4B63E24B2D14174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c5e3c45-1420-425f-ba39-ccc6821b98a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7c5e3c45-1420-425f-ba39-ccc6821b98a7.tmp
Size 1KB
SHA256 a020af4feb575f3c8c9492ebdf2ac096de9e97b458716c2f3aedf26eb347d165
MD5 bc2103d598297805e13950c5ad074cb6
SHA1 8c101efa67867e4d0a0f37715b86b5c68095fc64
SHA512 d1df8af5d1dd53a6c8b233718eb8c8e5550da868d7ea35b625f56c5d1c71ede955ead8be676c271a1c6da07b4f07b9002531e1b16de55e72bcda48674182d6fd
TLSH
T17B1178A7E6BEB47B507A08AB2D40BC055A75A870468265E4DE7B923CB0C24E71B57053
MD5 SHA1 SHA512 TLSH

Submit Download

b6a80042-0e98-4021-8c14-68ea76f63cd8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b6a80042-0e98-4021-8c14-68ea76f63cd8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

eea0067b-cbd7-4758-9a56-be758544ab0e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\eea0067b-cbd7-4758-9a56-be758544ab0e.tmp
Size 4KB
SHA256 5c4f6529d6f4fbe969adfae132a3066c4849c70648b01b9c1d48e401bd26d142
MD5 956b3dd7b4c1031dedee79df9e85918b
SHA1 eeb9ea48be2f7bb7d9484a743324c20f2b81a98c
SHA512 49ce226f134722982449f5eeda3654923a58a7e8936cdcf0133e306230f101d2ac57cc514f576439ebaf44c4f5e0d702d4eecc5849ca22de4363bfe62071d8ba
SSDEEP 48:YALlLNnL2SXLN9LNchRaXYfo7EdKsK14sr9LlsJRLbsrkL3LuQsrcfLUbsrcfLUh:DB/jSraIaEdMxoxznQBQp7iAiMvj
TLSH
T180A19CB7D3F4CB6DD81156F4AB102E2ACE6E0528032C3967C9D5EE4B63F25B2D24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

bbb56ea1-642a-4017-b5ad-61bc2707dd2d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bbb56ea1-642a-4017-b5ad-61bc2707dd2d.tmp
Size 414B
SHA256 b8033035818ae79532f16efe9f4d22de17b9e44f8a1e9422a240fc1bf35cf8e9
MD5 1096d32a76deeb7630c7b455be261edb
SHA1 664b40eea41c766c4f23edbf2f19e3fa127809ce
SHA512 0d51aac2f90a4bc149be155d4bb689b93c741cf1d90378809948f9ce9304e7a2351cf8d6c27cc380ef1decb398f027a958f64e4d228d6cbde9a1f84759d990b7
TLSH
T14EE022A9CC35EC2B28FC4B2C10518746FAA0135736808A4F3B3C8109CFFA27A86C681C
MD5 SHA1 SHA512 TLSH

Submit Download

d0c46b58-2ac4-4325-a60a-6e1ec5a2c245.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d0c46b58-2ac4-4325-a60a-6e1ec5a2c245.tmp
Size 12KB
SHA256 9bf0b14f1f4fd4e116ac5495666bbdb8365dfd04efd7d81795cf236c356f834d
MD5 1cfffaab5c3956548dac70c53514a117
SHA1 2b01716fab17193df8ab1d0628d7e2ae3c78c908
SHA512 f9c94856ef5dc01e7deda914026a767f38a88fd2fd2bf2e664bf32069a35b3b4377af9b4cd84e737ef0000a80399ccdfd65597f0ea400872b662602d72a731c8
SSDEEP 192:XRzxDRNyv71vWPRpgdX9IHsb+WNnssAAcYfcjuqPVyIsnAUgE:XRzxFNe5gXS2wLUYitE
TLSH
T11F42A62AAD107A7B5CDBD229F921BB57EBF9102621942E84D6FC893C15EB9CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f74b714f-f1fb-4bf0-846b-51a3011a5d7e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f74b714f-f1fb-4bf0-846b-51a3011a5d7e.tmp
Size 11KB
SHA256 69de6dc15114076d475e4d2dcbd4f54f468751981803dff78752531ab5ac90ad
MD5 c653853b21659f0f1a17088bce964c32
SHA1 c9af26cd4f271345652cef22d3ee94263e07c6fb
SHA512 17294d3e2da7c128a1afbab2436f67089293d2f455551945ced92cf318cec61acb969153487bfbefa7e45c0fc427f6d759842991c793ab38adf722dd3735d291
SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9pVS27SS0+:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLm
TLSH
T13D32D827A44DAA3F4FD8D50DCC12AF4BADF502527368092497FB9D14039A7CA214E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab998211-d4b4-459d-8fb2-1ebd757a8e59.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ab998211-d4b4-459d-8fb2-1ebd757a8e59.tmp
Size 131KB
SHA256 41dad089b287e6220508fdb8ca86de5d3563fb8319b29f2da7eb12217c417c14
MD5 44d7a2131ff903a1dfdf801bcb375296
SHA1 8de57f6762add406b36bd973980701fc7328ec36
SHA512 b3ce6373ca3dd95571fe94cabe6752d145c5d21e6d344e63978d36106e6c005ea01428a8c2888a1145720796f18348f7996d1a7ddaea00f2d0a4d9fd8c820481
SSDEEP 3072:60R+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:60R+hFD+7t56OD9ZfSApprr
TLSH
T119D30232AA95D877C9FC6541F247A304CE7668ED95DE2A09444A5F8EE09F84C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abca4ccc-a4ca-4ca7-aa1b-5b39256e2d53.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\abca4ccc-a4ca-4ca7-aa1b-5b39256e2d53.tmp
Size 131KB
SHA256 953609a95c104bc44ff81df1ec73e8cc6f246ed8f8a36994b3c8e7799a9d60ce
MD5 b8023b3d305f07d39bb41d24ac52abb4
SHA1 d24332d78f4d9bf217ed8311b3ac2ec26a2ec1f8
SHA512 f5ff06bf5d920fb9a1cfea1316cc6b9476de291f161971ecb2c83fdbf6adbacd1854f2c800b29c6f7f23a55c04a7daaeae47ed154d827899304b328e2b7d47c5
SSDEEP 3072:6fE+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:6fE+hFD+7t56OD9ZfSApprr
TLSH
T1E3D31232AA95D87BC9FD6541B257A304CE76A8ED41DE3A09444A5F8ED09FC4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b77858ea-128c-4a3a-9ff1-9232a947ff7a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b77858ea-128c-4a3a-9ff1-9232a947ff7a.tmp
Size 131KB
SHA256 36b65862358caf5156a9830261ccb74ea737c891b884e5784f36ccba86d353ea
MD5 3571ef7b368c81199aed399752db73f9
SHA1 716e1cc6ec7537edaff0a53ced4f72fd45f1b58e
SHA512 18b3cc34079a0794fa58ba762cf0f66c63d7bdbbe907cf27a5ad164116c5a0c0bf903ef1b4018dfc590f887ccf4d572b069169b417c39b708d6b31ff5cc02fca
SSDEEP 3072:m0R+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:m0R+hFD+7t56OD9ZfSApprr
TLSH
T13DD31232AA95D877C9FC6541F247A304CE7668ED95DE2A0D444A5F8EE09F84C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download