xworm | a2900d39b6a2e97fb155f3f23c1a5bb3938e550e4ff229c2605fd3b87774df99

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2024 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

33KB
MD5

ccb420658817310b56be54bf6fe01d90
SHA1

561424d7ab148308f127be791ca5a7d3d469d225
SHA256

a2900d39b6a2e97fb155f3f23c1a5bb3938e550e4ff229c2605fd3b87774df99
SHA512

d07beef0079130aefc2c3451aba975cbf9382d91b3fc3eb6355df963153d20c16e78659fde968b3d6317c2eef8b54b1b4595e57b272aeec98e9696a9ba724662
SSDEEP

384:81sbhtLNSexatCJAk7LyjLrKdp6wsj4QfBRMpkFTBLTaOZwEJd2v99Ikuis4lVFY:lHLjAknyjPu89fBRFe9jBOjh3bD

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

https://pastebin.com/raw/DxYQ14Jj:123

Mutex

7dqqxIFVNg8bnRTQ

Attributes

install_file
USB.exe
pastebin_url
https://pastebin.com/raw/DxYQ14Jj
telegram
https://api.telegram.org/bot6094198209:AAGtbuJi6hBqVBpkxn3UzVsVOtCJjMn1cjE

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4156-1-0x0000000000E20000-0x0000000000E2E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
19	pastebin.com
20	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133762144190794237"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045960512-3948844814-3059691613-1000\{CD792F1C-6F26-4133-8437-1FB050EF20CB}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	chrome.exe
2368	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	XClient.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: 33	6132	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6132	AUDIODG.EXE
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe
Token: SeCreatePagefilePrivilege	2368	chrome.exe
Token: SeShutdownPrivilege	2368	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe
2368	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4832	2368	chrome.exe	110
PID 2368 wrote to memory of 4832	2368	chrome.exe	110
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 1968	2368	chrome.exe	111
PID 2368 wrote to memory of 3452	2368	chrome.exe	112
PID 2368 wrote to memory of 3452	2368	chrome.exe	112
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113
PID 2368 wrote to memory of 4252	2368	chrome.exe	113

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb9ac7cc40,0x7ffb9ac7cc4c,0x7ffb9ac7cc58
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2168,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4580,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4816,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5052,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5140,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5144,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5168,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5280,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5220 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5540,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3176,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4912,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3704,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5820,i,765697018617836206,2443858670542435385,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:5376

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:392

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x520
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
662ecccb7b9639e3e7e20d5ef3a1cb47

SHA1
3a89f85a3b2f29dd665ffc70afc41eed8a32f873

SHA256
a3d53650a74bacbcdcc23eab8018a1542b4acff6a8f0e714dcc86e2a375792bd

SHA512
f286da2044efc04a6b3fbcc1660c00affc0f692e7a6e1a2cf19ea53b07cecb2844cb0c6e410123b911716a1971b029e7e95525cb21ab50715f274b59d524f4b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
233KB

MD5
e21e1c5d267c7141fd3709f6e68e4f7c

SHA1
63dc49f8a0bc7eda46588972558b118898a11b98

SHA256
5c073779daba3739f20b07242784b76320dd3c5488d6066fc507dc8af2debb18

SHA512
0835289b4f527d9603cc1c1fc549bd87df3e276f3374aecdb16dcaeb39461dbd09e18526e9ae5c5885258589b45ab6c570c018b910d3e2481d981657eedbc449

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
32KB

MD5
b2229d4466ee263a188530ba16cd7af1

SHA1
9059266f5a47c5ddc2a792131b9b60908dba12db

SHA256
17b766b8e77333366da8c1331052ce026b1555b24c7f8404333420e97fd6224d

SHA512
1038d1c865f0aaca95381491f54eb83e4e61ccda9534de9e9de4081df3761ed6257d88f72a1054d2f2f4c2d570e3e2f14a73925b2867679749fe47d8762feb2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
32KB

MD5
eed96deb881ae2b11127253153331f4b

SHA1
f5a350024e2f3e2755b452f2a218ecebe10b05cc

SHA256
cede6026733388e8934c9e149b36a7cc97428e8ad137a05860d8704dabacadaf

SHA512
934b89cf82d36733bfafda721498971117a8b21cba7774f05d88b4f74fd336d6c7213dabe1a0ab31f5572985cac9b63354ad4158772281533ed3d56aa31d0a27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
2819fd71b3a3ba5a9dba577cd459a029

SHA1
03873e4554547e5ec0e1f5fb6469da65dea29e12

SHA256
47fac0675cc2e5b1a9253581800019c85191c13469ed71dcf3961117c6bf7b7d

SHA512
625f370834aff16a868c018e8f371793c9268157de79612d0b93d7edf5c2cd87f733896a17c47fe5138bc152e43cbb7da09240a3685a866ca81afedac88f30b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
2b9825ba82c3a30d4b1d97ad08895e8e

SHA1
4cbddc7288023a77177ba8bd904bd33ef1449f3d

SHA256
b2f9282b7c93f7289e355dfb45576f1512df4eedd1972d3eeac555af2f14a07b

SHA512
2490b757af85caba54cfb4ee881d445a7fe4e951a6324d88e1cc38acbdcc8603013eba2b95a76efacbb7496c49f6769a8d5b6102a377cd8642e0817d186914e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
57420a1e530d4d2fb73860607a0b4d61

SHA1
b81677e39065d72e372f234a7152592926a4b9f1

SHA256
4a9504d7d7664f8ff9ec8ff6b103e74bd60614e0b51372c95845921e6d613f13

SHA512
e006ed563e66e185ec56d0f274daa7da836c90386be06efce4ec5cb67996edda28292cc19396144d6f6de366ebb48571b9607d67b4fe0873d982ed41d4f16982

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
cf0c008109b2e54dd66cb64e4539f6f6

SHA1
4474f53b4c946be4cee4ee7c40d0a1d7e6339c01

SHA256
6ce93c5ea3fb54df4f1cdcdf734e37b8df019579962f1e3e2f664995617d8dcb

SHA512
6542c2b1b1442a391ebcad1521de670606e8c00b65325887daee5f5d52a6ae32de9a0c3289828e0b92a51aa93bd1bd917317756114dbafdc9900b42f72418aaf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1af6e5f5d24b093d50f69331e8f0a13e

SHA1
36eb2595971cf5383bc7f737f11c199b7c8f6f0e

SHA256
5f37a5e453c0ef6b36928f3b01ff831c8dc999a3e5f3120cbb098c38545a4df3

SHA512
777f99413d157e694913963df63b086a16b79af9b6eb7e263a9737fe82dd5e2614ffa631a98167b118238abe5a0b2fa2b94f95eafe01f275d5065661c79ddd48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bcedb4528a7df55767bcd07e085dfdf2

SHA1
c313c6bdcbddb203fd14dffff72c42d94044efe3

SHA256
2a485a58c633a3f36b06cdcac26ab41b90811e4e9358b1a5e74b5f4e90bc9dca

SHA512
71d2f295d59ff40ae4d69c827a071af53d1ebea8f091e2cccc4644543c7d60d94a1f3f77e4d004dc1a80c1180889526e0ea7ae656a94b81d6ca996d0cb242a78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1579c626fc4070a58519c500facff9b5

SHA1
51a83d72c950ae73131d18adfaaf187eb9cae4f0

SHA256
caebdf2b9709b349ebb2346deb66d0846a459a5a099688aecdb1f66a40746310

SHA512
b7363d687049a6ea068c63c764a0ef977a74491beedaa971214c50cb4ebdd21ef11c45c6ea1530826e265e8411ec17fd3b0327ff348a651bbc05736bcc49a8ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
bee8a5f1f71a723ae0c95e32f22f9c59

SHA1
241129b379875ece428a721d12be171ce242e05d

SHA256
40d8449de9842f8670ff8e8a1ea69bb485379889d8a46ba1ef726e12da9426c4

SHA512
e26ce3aadb6c2d44ab475aaca3e5dc393b0420f74ad8846cc4bd92ccde9d89315e3f2e598905a94b7ade23eeaa6d07bab75778014617c9131b71719695f32b2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\139a10fd-0e38-47ff-9172-a477f4bd5de0\index-dir\the-real-index

Filesize
2KB

MD5
dc3d80223007fa6d9108e5218cb42c4d

SHA1
26d41f54b597a119d8cd43058cd8d6f89f49204a

SHA256
07bd62dd17aee104781b9b0fb5362c7dfea00c3ed568d91e55eab3464f257ec7

SHA512
08923e14d4f05a0a789118d08c88010ddeb5ffbed419f778bdd4e5ff94957de86858e14f325f1ca4d886165d3b5b9e9755413da7fcb73a3a3eeff80fa5c5f685

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\139a10fd-0e38-47ff-9172-a477f4bd5de0\index-dir\the-real-index~RFe58e049.TMP

Filesize
48B

MD5
d1c4cbf9d2db616f0c2b2be9cd43840d

SHA1
baffd9535506f09337e480f7ed5ecefc7a600837

SHA256
085f1a230c3cf2f28b1a6a5b7841e1252f67aee7bbef349873d0a349f9d96390

SHA512
f47d845e999412854f7d767addf45ef6830e4f9fc5cef0e36cc3f6cbba9277fa6dff79547902fe8f3e142e7ae792ac192ecc5cd274cefc61d646824a1bf2f003

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\aa0b7b7d-f67e-437d-b045-23d64a9808a9\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\aa0b7b7d-f67e-437d-b045-23d64a9808a9\index-dir\the-real-index

Filesize
624B

MD5
685edca6c4d8f501ad987388778addae

SHA1
1d86861c14ba1b08f6792bc72554796a39f3a616

SHA256
de0bd80ec07fe3a8625ae5daff0c4f3414fe4a58a59b4d95ef6106dd7b8242d4

SHA512
41cb9d9eb106d4d66615d75660fb25e7fdd3e5cb74decb481d140f8e12eb50f86266ade3ba44476efd00c57d1321d551ab30c29fa883997fd851d83c561a9c6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\aa0b7b7d-f67e-437d-b045-23d64a9808a9\index-dir\the-real-index~RFe593a21.TMP

Filesize
48B

MD5
c4e4fa586e0c26f3662d8129b2b7dfff

SHA1
8c66214bf02ac45705ecc9af20a09eef1b436a37

SHA256
c5837f1b8b6b9c2008bd9d921eee789440aff93a563ad58416d4b5a403c7b06f

SHA512
4f450152e8755a1003c78d6e92cd9e6cdb704d5ba96f47219c883bef906ee199230b4248cf7d5edbbd88014d6e77f086f34d724f12b97dd824b7d71b225221f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
178B

MD5
d493e2dcbfa2154a6175be70c5c5e859

SHA1
613db092edd86d111693d2105af6e913afb31e0e

SHA256
d8c1cd868fcc57c40e9fbe0887c9a2318c20fc76cca89d363771c98bbb219c54

SHA512
038537467f2b7f9fd5ac4d0395b5847259d2f144824c2303911c70447def7fdd54eec4d37421654c0e43f12dade11b66f8dc247bc54de45992a82fb3b8d06b54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
114B

MD5
82e663338280af9fbc3d9c3a4f5513d8

SHA1
b1afe93a528983ba7500cfcdfc97ff6e39d383c7

SHA256
2c928466d2cafa892f9e809cf0eb9b6d09a1cedd9fdf61cfb6989eab209cb9cc

SHA512
959ce0bb256458e227e877c013d9a2a8a736bce58b3d63dae6e997cf415bd0b5144d5c7e9de88bf9588df4f262415ed25d0c50c68a541164181d54823bc28c7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
187B

MD5
e4839d79f13e0ae8782e5f4e4df7829f

SHA1
8c1ccac5998a0d42334ff3b64c754aa09cbbada8

SHA256
56b91944715db3850f4037974466b086b5d2208ab45580b0ac59430d86ae214e

SHA512
e49829d8ad46114b1316cc7c93d5e07f4ca96a8ffa6d50685b2f71b05128533cba82e088c7dcd4b51454f0a26cf80a68d1ee2e5aeefe2842a6feab09281e1b6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
176B

MD5
72efb0522bb52198991176391754ee61

SHA1
6030e9bbe85836c52437f883bef289857219602d

SHA256
e57d938102ac474def0144ed4b97993ea6f68ae40769f389ba87302d063ceab0

SHA512
7e028042ca5ecd9c7ca070458e0da8b417c170d4ba232fb6a777bc64631e17d132a7cdf7edfbc8da6075d043a2f2c18d39d1ba2ba88fbedf558e0754f34190bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
112B

MD5
8d9bc1d574c531fca2c7528f4a94ff90

SHA1
d99c21fe8c7e4101f7f57b2a8e3d8038574a7e24

SHA256
fdbcd07f4748fcad5254737099635a505721ceb5145f53b04c97c32c3d0f4de3

SHA512
4eb0447df6eca381cdefa828b45314361e85bccdfce7d03d63b73df9cd782f0d7ddc5fe6201a828b355bf1d59a072efcc8210c69900bb490443ccf550ddc26be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58ab3f.TMP

Filesize
119B

MD5
db9471f69ff5dfaedae6eabb922abc57

SHA1
3b2b98ee6ae62d2aa84e99554785170193e18065

SHA256
f267d7a2b976a709a6830f6ee2df74f6858a0f22d64fb6adc5ad9cf900ff7b0d

SHA512
ca724a8f61944f0fbbdbd5a18af1d77b0b4bc7c9cfa9edef5654d02a8a5ba2c98807afde5e6f77a1e4acfcf88f51381a8137b381957700f84a75441e06adef53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
9640219c04cbccda3cb502474b5fdc83

SHA1
15ca24af19956a72af8b4e468f95990e6ebb5848

SHA256
c9d2abd2b109e0461ebb22a2c94ad6e112436709dd02d9ded8582268a1a76cdd

SHA512
453b462a33cdbb8686e6a7a7a700adce0b8741a5faec830952e252fc2875b8733cb1f1b96650c97502124385e3296c6a49e150fbeb98ea3143d4b3b983779c17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
760f48968db02d26c9aae13a62a20b88

SHA1
1c95ff2cb281c78d64c54b82ec72dd57126c768f

SHA256
bb10bf43b6a755899a5870fb685c8a9b8ee0a05cb3f9524b2c08b34696708acd

SHA512
21182f645038f417e3390c93d5adecf6a9c2f6c4d123c2a2dd2f912efda054e58281c4a1cb94841a012953bb9ea0693a52d63f38df964fbb27d82792cca7fcda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
83d99d8089e8de0f883be7ebdc2d0535

SHA1
fdfdffbe6bb715c34acb6c19fb832561dd3868a4

SHA256
b3989bd57e4ba6b6c8012f8b7a2dca2c0e48ae6305c3dbdcea35df1aa8973c7e

SHA512
8a24ef7f67f2006029cbb1de3e8daa265c2abdbbd165c09184dcdefda221be752132d949ee66b2b48e1f59ba00f4285ef8aa49c26fb4e9b43c613c43a468dcfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2368_438521128\2859f0d0-d4fe-48ae-b79b-e3f0984f9da3.tmp

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2368_438521128\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
memory/4156-5-0x0000000003210000-0x000000000321C000-memory.dmp

Filesize
48KB

Download
memory/4156-4-0x00007FFBA0A00000-0x00007FFBA14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4156-0-0x00007FFBA0A03000-0x00007FFBA0A05000-memory.dmp

Filesize
8KB

Download
memory/4156-3-0x00007FFBA0A03000-0x00007FFBA0A05000-memory.dmp

Filesize
8KB

Download
memory/4156-2-0x00007FFBA0A00000-0x00007FFBA14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4156-1-0x0000000000E20000-0x0000000000E2E000-memory.dmp

Filesize
56KB

Download