xworm | 520b7d4a21ea1e619b0d3be1e2d7e7242ea6f1be3b7546de6e2e1db088e055c1

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A565.exe
Size 67KB
Sample260601-e2scdsct3v
SHA256 520b7d4a21ea1e619b0d3be1e2d7e7242ea6f1be3b7546de6e2e1db088e055c1
MD5 354b11ca3fabc986c4bbadff0f82c332
SHA1 19e220b76bb756ffed2c16f2a89a0279ec8439be
SHA512 49ffbe4f327d7db9c31e9e3d6c1f1768b4d139a4d3395b425d9f375311ef3db1058788d38adb99f919b7d14f83982bcb477f710f4b184c61036da6f4c87a48ab
SSDEEP 1536:kjkWtq4CHrFlYKCRFsoApVT9bMQ0xY5OwU6Viq/tOtm0/h:kjkWtq4CLFKKKtA7T9bMbytOtm8h
TLSH
T1DE637D1C7BE50525E9FE9FB508B37152CB3AB6036913D75F28E9018A1213ECCCA516FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

7326.info:2686

Attributes

install_file
USB.exe
localhost
127.0.0.1

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4308-0-0x0000000000B80000-0x0000000000B98000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1992	powershell.exe
1000	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	A565.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3832	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247616246687971"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4308	A565.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1992	powershell.exe
1992	powershell.exe
1000	powershell.exe
1000	powershell.exe
4308	A565.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
5888	chrome.exe
5888	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	A565.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	4308	A565.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4308	A565.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 1992	4308	A565.exe	89
PID 4308 wrote to memory of 1000	4308	A565.exe	92
PID 3048 wrote to memory of 3200	3048	chrome.exe	108
PID 3048 wrote to memory of 3832	3048	chrome.exe	109
PID 3048 wrote to memory of 1460	3048	chrome.exe	110
PID 3048 wrote to memory of 1460	3048	chrome.exe	110
PID 3048 wrote to memory of 2392	3048	chrome.exe	111
PID 3048 wrote to memory of 2392	3048	chrome.exe	111
PID 3048 wrote to memory of 3640	3048	chrome.exe	112
PID 3048 wrote to memory of 4568	3048	chrome.exe	113
PID 3048 wrote to memory of 3640	3048	chrome.exe	112
PID 3048 wrote to memory of 4568	3048	chrome.exe	113
PID 3048 wrote to memory of 1556	3048	chrome.exe	115
PID 3048 wrote to memory of 1556	3048	chrome.exe	115
PID 3048 wrote to memory of 5020	3048	chrome.exe	116
PID 3048 wrote to memory of 5020	3048	chrome.exe	116
PID 3048 wrote to memory of 3376	3048	chrome.exe	117
PID 3048 wrote to memory of 8	3048	chrome.exe	118
PID 3048 wrote to memory of 8	3048	chrome.exe	118
PID 3048 wrote to memory of 3856	3048	chrome.exe	120
PID 3048 wrote to memory of 3856	3048	chrome.exe	120
PID 3048 wrote to memory of 2124	3048	chrome.exe	121
PID 3048 wrote to memory of 2124	3048	chrome.exe	121
PID 3048 wrote to memory of 2212	3048	chrome.exe	122
PID 3048 wrote to memory of 2212	3048	chrome.exe	122
PID 3048 wrote to memory of 3040	3048	chrome.exe	123
PID 3048 wrote to memory of 3040	3048	chrome.exe	123
PID 3048 wrote to memory of 5992	3048	chrome.exe	127
PID 3048 wrote to memory of 6000	3048	chrome.exe	128
PID 3048 wrote to memory of 6008	3048	chrome.exe	129
PID 3048 wrote to memory of 5888	3048	chrome.exe	138

C:\Users\Admin\AppData\Local\Temp\A565.exe
"C:\Users\Admin\AppData\Local\Temp\A565.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\A565.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'A565.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff959aac728,0x7ff959aac734,0x7ff959aac740
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1940,i,8123752575446329337,8899614843020159957,524288 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,14714175349652088447,2003400907367012491,262144 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,3704517976625272586,14841135448243174367,524288 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,11626301867076179639,2451311231677661456,2097152 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,1923376959203374059,2080537608936637151,2097152 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4524,i,13806069456650092408,17372385794973341382,2097152 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,1347923719562302442,12387808221964497249,524288 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,11525706978105757089,10919358415766915020,524288 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,814096681816075956,15007775438038650752,524288 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,15874239664007175193,8117427478039036773,524288 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,16091342120837104985,17856321231290888426,524288 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5888,i,16359586111635067779,671405225380516898,2097152 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5900,i,2719788007247273396,12709889557242981333,2097152 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,11313710926746638986,14635204285288718857,524288 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,549039032041872157,4919236216450727322,524288 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,1378275770534716567,13774322803627814790,524288 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5660,i,8806240632022649145,2752435589598761466,262144 --field-trial-handle=1988,i,5581427428008664689,17425964451078979453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b16231f96642e268a9b5e55e3ff12fc3eec989bcc2b091cabc203199b6d8d4e0
MD5 bbcbbb951263db3d13d5790cac8cd465
SHA1 e93cfd5e34f3ce15cb4e6951bdec7e02f569e177
SHA512 b136d6b548fecfb6f6d0e75fb706fa3e4000b7d5a8179f0abf5e76f5e0cf87b7a4a1fd254fc8be3f338d494d8f56701e1def87b30dd678fdc1e8f2a0d7229ff7
TLSH
T162F0F9BAC821EC2718FE1B1870954746F754136B2781494B7A3D560C8FB5B3B464581C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 324af9962a2dbeceb6bb5876c2a908437ba53b0f705cc93b65662f307996accd
MD5 418cebf01f03d24913f58f74f791b25d
SHA1 852b157a4c1aba4f6d43e393a0f462efa83a9e51
SHA512 32f471df7b7b066084bacb1cd2f31239edab10dd63ebca7ec0bd093eb5ebb1b18625f07fc2c3edced1e70487b7288b0e09ff7db8eb1790089c92eadd976165d1
TLSH
T1295169B7C3D8C67D841156F4AA21AE1FDD290A18531D3C66C9D9AF4B53E28B2D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bee1da97da12d7622ba3050a7cd4a236f97fc69f32e71dac7096994c5f260361
MD5 d380d7589ea61771cb365c8b64149ce8
SHA1 7f825e1afb57879c2e31487c76a3955bf91312c5
SHA512 ef08b6d3767cbe418068ada6cf1790ac8cc489eb289bc836e24fadcdfece85d280d7970210af64b84e1047b3c1e1875048854582399da6be419b20bc3b79775a
SSDEEP 192:CRyyHzuv72vAPRp299THsb+WNnE0dSl2S4nkwSVyIsnAUge:CRyyTKC6XuFw3dG2nye
TLSH
T17532C62EEE24253B5CDBD22AF9657757E7F9103135942E44EAFC8A2C14DB5CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 af45ce013f40b83ac2163af100321a27a0273bf01068b021010f32c369705ffe
MD5 40b15eebe6514151efdeae9af530d55d
SHA1 08ed4dabe3e90b6660687a9827b84d192e0d9220
SHA512 4acfe8780d4d7444b1b852c1b089e84bb727ae1abdd6696111387950a6157616e19c68c12c97b87dc7e2fc5a82c05217006a649fc6be984792c3280699d03422
SSDEEP 192:CRyyHz5v72vAPRp299THsb+WNnE0dIPl2S4nkwUVyIsnAUgE:CRyyTZC6XuFw3dw2nwE
TLSH
T1D332C62EEA24253B5CDBD22AF9257757E7F9103135D42E44E6FC8A2C14EB5CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 386baeab924dde8b82d494c9baa68412c4959b63ef1f80910c860f652dbaabb3
MD5 aa24cb34fd6996062b5d10fb1a19ba49
SHA1 df85fcc145ddf2567e50d4c14abc71ef329c0233
SHA512 9f6ad6045146003cb1c2e331ae3fcab85c79e8be3a9f6d325df4d810542ec23e2cecc9153e5f1bf90136533da31f18d184bd9a25ea863e76d63f42eb4b9ba4c6
SSDEEP 192:CRyyHz5v72v+PRps99THsb+WNnE0dxsl2S4nkwqVyIsnAUgE:CRyyTZCYXsFw3dG2nKE
TLSH
T1B542D81FE924253B5DDBD22AF9657757E7F9103135A02E44E6FC8A2C14EB5CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 c269a2a0be615359e437c9c62bc18384eccf186aeaa51ccf24ac73dd9fa15ac2
MD5 6263dc9f04d7aeeb8c56f5f40a3d1b37
SHA1 2750aeb51f0571faa38513938431d623cf49f710
SHA512 2961b7e5e69a75ce348a94e83e8a0746eb7751c8965f59f897cf6ee3d24911163de66efea7ec23c338a49c5699232c9d9c70257b43a6b1da1b18b2f9c3ba2814
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3xZHGwIB3WhmyKoU9:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOHy
TLSH
T12052E867688D963F0FD8D68CDC167F4FADB5019666640C2893FA9C0803AA7CB115A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 9444af8dd6f7f12e38ce9b70e1e106ac15dd6c0b183158ddb605305f446dbbfa
MD5 49f0fa9b592d17f5ae64b9ff4dc2f17c
SHA1 3081ce28a6536eb07c98d96090e1f55fa76d590f
SHA512 e15f6360be3e6ee33867e4ac6df8ab72894a13d1caf5db90ad401a802dc898c09a84445e1afcf040eecd797ae01b0881107be02d8ceb83ffb842aecb840bb002
TLSH
T1C4B01201500000A6D70883F0609D0170737109183543130BE4BF0414C9AB7DCB232218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eeff.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe58eeff.TMP
Size 72B
SHA256 997e998a448973fe74a006803edf9477a1f70a0f86d666e471644b0f649b29df
MD5 205ce142d5c802d964f742b60d841007
SHA1 0858e8907707cb1db73dff78c42db82cb0e1bbc7
SHA512 840f55a8e4428460d6edd22a75e1749cdd22256ae3351316b42126bf6544e42e49b771fadd8adb71f539c88fc29973b8136647209e9589b87fd17afcdf43ab30
TLSH
T173A0022183481411CD014370B2E5428132F3883839D70A5B88B31466CD5D3C85653666
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 67e52adcf1445178af23986499fd1fbe15a5e430c4448102299409e1b8bef21e
MD5 af6ba58d4eea343165765ae0f9afba7a
SHA1 482d7f3453ca85d3a71da97691bc754e80810196
SHA512 294358226292547fb606cb6c0c86032d3ae159afd1431992922dcfedbed6844e3ca93013520c85deac580cb69ec1499b2afb9a66b743c72687429c856325c1a1
SSDEEP 6144:laVFm4vCuuwbzIUqSs1qKkm7Rkm1tYpBeh2BAoR:82zwbzIUfIH9oBGcAoR
TLSH
T16B34233BEEEEADB555B82569614E054B2EA0C3834A206E46C8C65F057BFB7C84F4DC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c6aca0ad336aa444731168af5855e5dc5adddc779dc770eac610f5d8f0f07e1f
MD5 33adb07ae6af34b1d086cd3fc455718a
SHA1 4d9b4c7ef06e855d4fe68de7159ba9a9a825aaa9
SHA512 99aa19c18aa84b939e7ec9796d5a2aa480692f8eb30f5bc21a2381c5d3848484f572000629dbe6e44f783c586f85c81e3e135af6cafd8607f99ef095da07de94
SSDEEP 3072:EGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:nm7Rkm1tYpBeh2BAom
TLSH
T164C3123B5E74A97759B9B74EB08E0B1F1EF14AA2C930DA42C8D85A0437FA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 3bbc0e51d5514483faba40b6d8f74abd85648b2eab6ee4bfeb8dd85769cfd6ce
MD5 545be5b2340b343c1a4417a34de94044
SHA1 a347d31c3496de05158043e48d264149e3543436
SHA512 fb2ffbe23c20678628ef36bce09dba77483a905bc45b6b7779679a0419c690ef6b8cb792d0a89a6c348524bb00b872b00db011949e6acbd67da18f9447f4e980
SSDEEP 6144:A9VFm4vCuuwbzIUqSs1qKkm7Rkm1tYpBeh2BAoR:y2zwbzIUfIH9oBGcAoR
TLSH
T1DB34133BEEAF9CB655B42559614E050A2DF0D3938A20AE49C8C65F057BFA6C88F4DC24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 e0bfdc6c49647ae7caa3590cb13203d3b40da5fae388fc5d24d02bffae0a8616
MD5 2e5b54b7c4ed99c5479f1e665314088f
SHA1 900e498d576de2865bb7da87b7c923ff1db805a3
SHA512 084cc81426a2f8238becd6fffa41d8c440a39eb16257653e464c470efd6b6ea28011353f19157b044625a540e5ed0e536d68a8d3193fb45a6a7df809046aa234
SSDEEP 6144:6aVFm4vCuuwbzIUqSs1qKkm7Rkm1tYpBeh2BAoR:j2zwbzIUfIH9oBGcAoR
TLSH
T1EE34233BEEEEADB555B82569614E054B2EA0C3834A206E46C8C65F057BFB7C84F4DC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 16c05848744983bd75fe403c1aa3aded96c6baf10b77fe95d9f4b52d8422daac
MD5 51fc9f46ed7a5fbec980d47049731eac
SHA1 1811612998c800bb4563742c4760b2ab3a5e2677
SHA512 e55ea8fe57f30d236b3ba8cd327e53dac090bb71ef7899b536a4acccd997a6aa232d9b80e0995a536975aeb13cfe29eda27b630393683e3825660224d96b8a15
TLSH
T112112223F78C8920CC96563A509DAC5172B586CB81AEDF9F7FC0D210A1BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ykjwmmnl.nlc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ykjwmmnl.nlc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2bf8b677-76d5-454c-8549-171f9aac6436.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3048_561668940\2bf8b677-76d5-454c-8549-171f9aac6436.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3048_561668940\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1000-23-0x00000264C1D20000-0x00000264C1D68000-memory.dmp

Download

memory/1992-1-0x00000255BDEB0000-0x00000255BDEC0000-memory.dmp

Download

memory/1992-3-0x00000255A58B0000-0x00000255A58D2000-memory.dmp

Download

memory/1992-2-0x00000255BDEB0000-0x00000255BDEC0000-memory.dmp

Download

memory/4308-0-0x0000000000B80000-0x0000000000B98000-memory.dmp

Download

memory/4308-25-0x0000000002D30000-0x0000000002D40000-memory.dmp

Download

memory/4308-24-0x0000000002D30000-0x0000000002D40000-memory.dmp

Download