xworm | hxxps://gofile[.]io/d/V1X0qp

Analysis

max time kernel
121s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 15:09

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://gofile.io/d/V1X0qp

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

Mutex

avDNEinrJ0P6RQUY

Attributes

install_file
USB.exe

aes.plain

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1148-399-0x000000001B2E0000-0x000000001B2EC000-memory.dmp	disable_win_def

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cf0-100.dat	family_xworm
behavioral1/memory/1148-281-0x0000000000690000-0x000000000069E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1148	XClient.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 553028.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 160572.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
688	msedge.exe
688	msedge.exe
3744	msedge.exe
3744	msedge.exe
3360	identity_helper.exe
3360	identity_helper.exe
5600	msedge.exe
5600	msedge.exe
1148	XClient.exe
1148	XClient.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1148	XClient.exe
Token: SeShutdownPrivilege	1148	XClient.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1148	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4952	3744	msedge.exe	83
PID 3744 wrote to memory of 4952	3744	msedge.exe	83
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 1884	3744	msedge.exe	84
PID 3744 wrote to memory of 688	3744	msedge.exe	85
PID 3744 wrote to memory of 688	3744	msedge.exe	85
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86
PID 3744 wrote to memory of 4572	3744	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/V1X0qp
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe485646f8,0x7ffe48564708,0x7ffe48564718
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,966932683562926145,16021996660201272817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultbb806c78hb936h4539ha3f1h9851d2f2670a
1⤵
PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe485646f8,0x7ffe48564708,0x7ffe48564718
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2752612520908130753,13602080896355207944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2752612520908130753,13602080896355207944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:6136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8a08679bh8f1eh45d1h9218ha658fe81b6ea
1⤵
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ffe485646f8,0x7ffe48564708,0x7ffe48564718
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,17248855261254692579,5942390244975922155,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,17248855261254692579,5942390244975922155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  PID:5800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3892

C:\Users\Admin\Downloads\XClient.exe
"C:\Users\Admin\Downloads\XClient.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5d936b1d43351f7842948c340cc534ca

SHA1
7d22b26039f6ed476c04aebbf771b770ef28091f

SHA256
a5748fb829b32d3ffab390823066f319ee677a0776d760a7376df4cbb2775ed7

SHA512
2bd75042ccffc65407c3f85af3fdccdd160137068dcdec81d4c33d9b0d78b110294900393e1a5265e1f1364b4c58875277ea1cb0d2477f98bc9568351ae8f77c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ffc39812e2fcd5adcd109fff6e72c856

SHA1
927e636b225729179e43d8d731e3e4552a4f6405

SHA256
0f33fce94f0ebc3522f3d32883771a853a9041a4a59632a70033f12ec352d754

SHA512
da84d9e272245762fd8eb693b83b1beca59d513477e99f798c34f3ce7aeba263ad97834f8c315eb9fcade7d21c1925c13083d411f7fac7bf18594b860c57d6fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
ce1bb51f1a70ed21744f5b6a78bf3221

SHA1
07e4355f36abcd74afa87f2970003d6ab910b353

SHA256
82cc3dab3978a9079971bebd9432f40cf497face7dcf35f1a2ac14c29c6dc3a2

SHA512
adab8d9151f5f86e34df02ed579a9a95943b46c1519033dad4258ea5b2b05d6adacf7ed57b551c5712232bde3e10c315104673021112857dea116e8a40012c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
af70db1887381980b2e8b6cabbededc2

SHA1
b5259f04715316d365c733e90c8768a8f7aa68e6

SHA256
fbb070db6f3a8745c65d094352de10556b5fb45173b6aa56e5de9d016187b265

SHA512
67a439819258cc6e2bcdc3e9a75a3f270d411362094afd768301481c3e31c32e5200afd2ef06932eae855112ef08137d52e580ab3958f6ae71c2d1bca2889503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba0ffdad92f1fdee786c80757ed5bb79

SHA1
b31d8f8d6e49186df8ef6bc1a5a85151ccd25e7d

SHA256
ea95f6e72c14bf1795287e7289efbe25878272f44ad89b5ce49d6f33920e45ce

SHA512
d30815d96084d2fc1e4f08c567bac8b9bea43730c67197acb5495bbd18d0d8de72f55f8e4fb8be9f3e11752589984847bec2e4fede49318481f298554aa08ec4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
faaf140a5f07815f86935a395e83d84f

SHA1
0e53620dc64ea91304a6db7b8842d19b5318ac5c

SHA256
f3e49388fdd45f9d57e6e720469956a240363dd060143565d54a936dac5d5610

SHA512
0a02669642ce7a47fae80a1bcb039640f883367a6aa1b6733bfbf00f9bd7c14a47663a613767dc1f84f49a7ce0c78ae3a79cec8b3eb52d29f24509e9412e3200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
235427e632cb37d98c89adff5122cc1e

SHA1
ce01d47897f5d595d6229e627fde27c13adb100a

SHA256
9901cb75f16a5235db9ac6e651dba5de2e30d3cf32f374d196d5305cb1dc49d3

SHA512
870b2deccf7a957e9dd9350535cdf26ef13a40c2d5dd172a405f9487590e44c09a092712bbdc95b4688d7964b8f39eab0f95b26c39ed1faa159c43cf30b973f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3eb8f2f03644d20e7fa5ae8b9ec6bcce

SHA1
6520fa17efd2e5aa06176fab580d35f9dbb24a03

SHA256
308d62b55529380f296e78023652067c1bcbbd6d6167c75167404a84bbdd16ca

SHA512
f5b24d9dee5af5e6a9805f62216e0c49cc7b94ce710f59f2d9eb4650d1bde12d1b357c983d80923f6b7c3212ec38c036da63ca0a4ea0d683717358b289d21e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0ea4683c0c97560438a330501785fe2

SHA1
8ffc8f43a94e8a484552a7246500fc2e8f247834

SHA256
c61088d8951148869a902084af05f04f569647697b22a72e5c4be1ee5204806a

SHA512
cf414d4042de0d0015cabb995eb8561fd9128d45b85f95fc27a0e7812d9f58756fc8da164b5865829de7b15612224592d61ba14d581fd9593f4e990fd7c43d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0c25adcec088bb5ca59ebfff7626d97f

SHA1
f2dac7ec3523554d6c389339736bfceb3d501a7b

SHA256
f43d635d3dc06ad5682c1d2fe00a22f8b24baf7976f5596c153282882368430a

SHA512
728d4220e5a7359a2fc37416f782a7aca15a4c73c8ce55bb7a72cb215f63aa1c5ab680e0f918221e294d6613cfbcab06dbea6d959ff06a4ae9b4e4b1cc025600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
567e6e4082847e6fe8a9015841a02ca3

SHA1
b4204955c6cf4df2383d7a38bce84c6cec88d34c

SHA256
a26cf9cf889f7c3fc069ba54a6697215210a1612d8a3900e470b0e24cc9b7949

SHA512
9f7b11c924b504a023e55c1c170173dc8878e677a3d0eda74d7a953cd691d6c4996a7c04941ee1db13cb9469b46d6ba881d3c42f671f77687e0ad419db0823bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
829db593bc7962ad298653bcdeeb1c3b

SHA1
0e6b1d780d53bebedbbcad81aba73f6143cf4dce

SHA256
f8d91e65aaa791d2d4d5fabe03072849d9674d51acbf0cdf4718b286a132c315

SHA512
f602ddeb7585f98d657c08d7d4282342522fc956f9489f1815ccc32fd3ca391bd85b1e030ab6f6baa1165dda5b083630d719279e9fb96c5798a2e3eb0d6cf683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9b2d522e675c01936addab63325f066

SHA1
c85a2542e91e141352c054e1b00dbb338e16a9e0

SHA256
6cf49ff9a1e95560b96d4a02d17438db49aebdeb0926632afe32acc1e98e552d

SHA512
eb495e6d7b5b97195bd5c25320c0934a755098bd4daf369a39d992cdd9faada02916bdb4aaafa755cf25925704b3e65098246fff86972e30ff0e04a895fcb995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4f3a61d28c8675481ea589858e415f55

SHA1
94d1ec7807f1f9f0950bee4bfadb24b9da70676b

SHA256
8a87acef05cc71f404988b967dffb0a81c82f259da560e0d32c268fbbeb47fc7

SHA512
e4028f69e29c86b213762fb53fe5ebfad01b9032d49c482401449a28cb3e8f3afbb84fd98b7f744d9f3b705436f6493376f5ad36e937f2b93717615ffe97f5fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2388858b5caff36ef325421d953931a9

SHA1
7a70ee61e79d119655ef254d9347baabbca586c4

SHA256
6c549b30b54bc1d9ff0d1b52a3103f41d8dd9eeaddbe6fccec72eca776830214

SHA512
aba37c2e5092474adca332642c7827abab39f4a197abb4fbf7ce6c27ee17c647888f7d0aa39b6049859792202db875cbf174ae8ccaffd1f62070ec3041a8980d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
713b8d2f4e7af7088c255fd0e656e62d

SHA1
ad92d17a93dd0ba9d1008e5c2fca4c232f875eb8

SHA256
727752f8845cd9c3e3d9349bc02115a570ba39fb76a0dcc66acc3cabaa017039

SHA512
c8c6dedbce4520a01235df45e422baaa3df104346774757b9e311ff41528e3cfacb9b5c8f2d4e264bd040bb82e188d1dde256c9584dc81f036930156fea9c0f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
328577e422d1e4b6c7ddf0199c91df83

SHA1
9d4e5f2b819a38d4b131309ce987c44f0c70741b

SHA256
eebe1030c8ce4cf9abb3c846711cfda47b2f1083488af44714d2ed94fd311310

SHA512
3c9daccecba495c50d1fc18c86b48d03b4fad98aae401255640859b702871c762690dadb6acbd5c9ec1f6272edd347df4831af3720cf388ae2ca5607b1fb8f4b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 553028.crdownload

Filesize
33KB

MD5
47b197f16face93814adfec054a2a9bd

SHA1
a4f5a8c9333d038719372ffc375ef091ab834a8e

SHA256
1457255025579c965caeae70fb78e8b65fa1791cac8524c35dfec8124c3093f1

SHA512
34d143afb614a64d623b0a9a7f7d26f49b192c59e5b0ded379cb0f4d9a731cef3cc5cc2399d27d5118c2392ffab7b81fa420748005afdaf1c6b2a67721a322c8

Download Submit
memory/1148-281-0x0000000000690000-0x000000000069E000-memory.dmp

Filesize
56KB

Download
memory/1148-399-0x000000001B2E0000-0x000000001B2EC000-memory.dmp

Filesize
48KB

Download