xworm | 520b7d4a21ea1e619b0d3be1e2d7e7242ea6f1be3b7546de6e2e1db088e055c1

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/06/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A565.exe
Size 67KB
Sample260601-e2scdsct3v
SHA256 520b7d4a21ea1e619b0d3be1e2d7e7242ea6f1be3b7546de6e2e1db088e055c1
MD5 354b11ca3fabc986c4bbadff0f82c332
SHA1 19e220b76bb756ffed2c16f2a89a0279ec8439be
SHA512 49ffbe4f327d7db9c31e9e3d6c1f1768b4d139a4d3395b425d9f375311ef3db1058788d38adb99f919b7d14f83982bcb477f710f4b184c61036da6f4c87a48ab
SSDEEP 1536:kjkWtq4CHrFlYKCRFsoApVT9bMQ0xY5OwU6Viq/tOtm0/h:kjkWtq4CLFKKKtA7T9bMbytOtm8h
TLSH
T1DE637D1C7BE50525E9FE9FB508B37152CB3AB6036913D75F28E9018A1213ECCCA516FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm rat trojan

Malware Config

Extracted

Family

xworm

7326.info:2686

Attributes

install_file
USB.exe
localhost
127.0.0.1

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1132-0-0x0000000000B00000-0x0000000000B18000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3924	powershell.exe
2372	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	A565.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2100	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247616299466712"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1132	A565.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3924	powershell.exe
3924	powershell.exe
2372	powershell.exe
2372	powershell.exe
1132	A565.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
3644	chrome.exe
3644	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	A565.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeIncreaseQuotaPrivilege	3924	powershell.exe
Token: SeSecurityPrivilege	3924	powershell.exe
Token: SeTakeOwnershipPrivilege	3924	powershell.exe
Token: SeLoadDriverPrivilege	3924	powershell.exe
Token: SeSystemProfilePrivilege	3924	powershell.exe
Token: SeSystemtimePrivilege	3924	powershell.exe
Token: SeProfSingleProcessPrivilege	3924	powershell.exe
Token: SeIncBasePriorityPrivilege	3924	powershell.exe
Token: SeCreatePagefilePrivilege	3924	powershell.exe
Token: SeBackupPrivilege	3924	powershell.exe
Token: SeRestorePrivilege	3924	powershell.exe
Token: SeShutdownPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeSystemEnvironmentPrivilege	3924	powershell.exe
Token: SeRemoteShutdownPrivilege	3924	powershell.exe
Token: SeUndockPrivilege	3924	powershell.exe
Token: SeManageVolumePrivilege	3924	powershell.exe
Token: 33	3924	powershell.exe
Token: 34	3924	powershell.exe
Token: 35	3924	powershell.exe
Token: 36	3924	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	powershell.exe
Token: SeSecurityPrivilege	2372	powershell.exe
Token: SeTakeOwnershipPrivilege	2372	powershell.exe
Token: SeLoadDriverPrivilege	2372	powershell.exe
Token: SeSystemProfilePrivilege	2372	powershell.exe
Token: SeSystemtimePrivilege	2372	powershell.exe
Token: SeProfSingleProcessPrivilege	2372	powershell.exe
Token: SeIncBasePriorityPrivilege	2372	powershell.exe
Token: SeCreatePagefilePrivilege	2372	powershell.exe
Token: SeBackupPrivilege	2372	powershell.exe
Token: SeRestorePrivilege	2372	powershell.exe
Token: SeShutdownPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeSystemEnvironmentPrivilege	2372	powershell.exe
Token: SeRemoteShutdownPrivilege	2372	powershell.exe
Token: SeUndockPrivilege	2372	powershell.exe
Token: SeManageVolumePrivilege	2372	powershell.exe
Token: 33	2372	powershell.exe
Token: 34	2372	powershell.exe
Token: 35	2372	powershell.exe
Token: 36	2372	powershell.exe
Token: SeDebugPrivilege	1132	A565.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe
1672	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1132	A565.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 3924	1132	A565.exe	83
PID 1132 wrote to memory of 2372	1132	A565.exe	86
PID 1672 wrote to memory of 908	1672	chrome.exe	98
PID 1672 wrote to memory of 2640	1672	chrome.exe	99
PID 1672 wrote to memory of 2640	1672	chrome.exe	99
PID 1672 wrote to memory of 2100	1672	chrome.exe	100
PID 1672 wrote to memory of 4916	1672	chrome.exe	101
PID 1672 wrote to memory of 4916	1672	chrome.exe	101
PID 1672 wrote to memory of 4480	1672	chrome.exe	103
PID 1672 wrote to memory of 4232	1672	chrome.exe	104
PID 1672 wrote to memory of 4480	1672	chrome.exe	103
PID 1672 wrote to memory of 4232	1672	chrome.exe	104
PID 1672 wrote to memory of 4180	1672	chrome.exe	105
PID 1672 wrote to memory of 4180	1672	chrome.exe	105
PID 1672 wrote to memory of 3688	1672	chrome.exe	106
PID 1672 wrote to memory of 3688	1672	chrome.exe	106
PID 1672 wrote to memory of 1880	1672	chrome.exe	107
PID 1672 wrote to memory of 1880	1672	chrome.exe	107
PID 1672 wrote to memory of 3576	1672	chrome.exe	108
PID 1672 wrote to memory of 3576	1672	chrome.exe	108
PID 1672 wrote to memory of 388	1672	chrome.exe	109
PID 1672 wrote to memory of 3440	1672	chrome.exe	112
PID 1672 wrote to memory of 1620	1672	chrome.exe	113
PID 1672 wrote to memory of 4008	1672	chrome.exe	114
PID 1672 wrote to memory of 3644	1672	chrome.exe	115

C:\Users\Admin\AppData\Local\Temp\A565.exe
"C:\Users\Admin\AppData\Local\Temp\A565.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\A565.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'A565.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ffd0765c728,0x7ffd0765c734,0x7ffd0765c740
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1820,i,1880933013215707963,8683575098910210425,262144 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1676,i,11882050551371284719,3741434211912087290,524288 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,15455033223848006501,2223194371390626000,524288 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,6201069369605098398,3744357882311484653,2097152 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,10979878043192093542,12022574030715336243,2097152 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,5540084975206351234,15053252111811809877,2097152 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4504 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4780,i,10322447744560099353,3927909721932601344,2097152 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,4710642853326343358,11795068748899178688,524288 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,5158190809568738464,9169246727412854784,524288 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,5575984953219404833,6846281005583481857,524288 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5012,i,12890917230801179431,5728847333550676125,524288 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,6477951120914297578,17987322109982076919,524288 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5036,i,7754022852717557340,8022138031122152476,524288 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4984,i,9492204564518026612,15483119015316317635,262144 --field-trial-handle=2024,i,5823263953215252746,7852063010255897319,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 31db65112eb30f6908f0310a346583b177ec7bbba06fe980a8594f34c8960e73
MD5 0e69ce17b13191cb1b3762be5a6f6562
SHA1 be61e1c0fd8cd83927f28ffdeaa11951c6a43166
SHA512 17732417eac68b1ba04a108e09f10d625da83d240a75453eb82bce331b1978f4a1657c44cc708c51671dd0c846cbb64cd16de17c2ae2926a39f4880793423fa0
TLSH
T197F0F4BAC921AC3708FD0F1920544B4BEB9413272B41894B7E3D930D8FB5A7B4686D1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f60062b9aba8a8e551e7c79bef4a3e88028836044dc3f435b05192604845d23f
MD5 da342b6579c12b68928e08cc540b1a6e
SHA1 0fd81d821e252670082bb78fdc9d8ca3623dab60
SHA512 9d128b257afb63e62f6470f84fb4a62fc765bb47ca092727886cb3a448d957c90b1d43c926329089d653c204d3dd83f1c005f01b7fd1507c96a2c8a4444a0d21
TLSH
T131617BF7C7D8866D841152F4AB25AE2FCD2D0E18531C3C66C8D4AF5B53E28B2D21038E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cdac415b0807f56600a30d08f2a04d01fa16eced383e8164a8d4d3cfe0b94b26
MD5 d2364165001935af5c320f470f162fb4
SHA1 1ad9f3ba35ffaff37ed45abe33ce790126859421
SHA512 37f8fe1a68a24e25483d03cdfc75ffe33e2510a3bf59a0444ff9110134463d1402698a1458e7f2c8534ba0d78f6fbc96f0d45cacc8fbcefc39653f3f753d5150
SSDEEP 192:xRyNFxjgwbZZAv7bpAPRp2t9Q9Hsb+WNnF70jBPkwKVyIsnAUgraJ:xRyNzPDcfUXmqwF0hqe
TLSH
T19842C62EAD14643B5CCBD269FA257B53D7F5103171942E88EAF8CA2C19EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f50d3902296fc696ba5b9df8fdf36df37b73b93d0027311d4736b1d72e7704a7
MD5 38dbdef834c9a3f31df58a1ce7115727
SHA1 7d30019ee5102d1bd7543c969a079b9bf6c605d8
SHA512 572559de72ab7180b6a4613590acbdcaccd13caf69c55b4fadd9e8bc7d1c4f52ec12d6ebad3d3d21b13bd34ed88373847af477af4182c2056fd2193e83f05cc5
SSDEEP 192:xRyNFxjgwbZZ3v7bpAPRp2t9Q9Hsb+WNnF70mBPkw0VyIsnAUgtaJ:xRyNzPDffUXmqwF0eQ8
TLSH
T12D42C52EAD14643B5CCBD229FA257793D7F9103175942E88EAFCCA2C19EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 dd2f60b87c921e0c108510918a4feab66d3dbd4c764762bb5eeb58b6c1cf829c
MD5 8e57cb8bfea0622664b34a683f258fe9
SHA1 7ade466af827577f464ccdeb75e934acd9dae0b2
SHA512 cb689c26a4fa66e4985e12ccda8317926a3b0861560065212cef74a011ca18aa9b68950bce8600ecda9aab4c7dc3d35fecf7385e3d9b44d84b7ed25efc483732
SSDEEP 384:tnjp87KxkXqKf/pUZNCgVLH2HfgsljH7pLuLcSjjeXODpk+ErU3hCHGfYT8+wA:tjp87KxkXqKf/pUZNCgVLH2HfgsBH7pl
TLSH
T1EE7219677C4C8E770F94D5CCD8267B4F9DB5024B65E9886883FA982903D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b134f7f5def75ac373c1438d5bd186845fc64391d232cbe5633d20fd8c931510
MD5 43ef883622d77bbc95c24b477e60ce62
SHA1 777a14cb9b6c59277a2cc1ed2d1c0518f63a2701
SHA512 b7bbd541c64aef60c934bb7e8febf6e404eac36d3aa9df250ac0fdd6b82151b028dbf53e9691cf1c300d829e27d1865b22dfa2f22eaa6c6f587291db1b8709cf
TLSH
T108B01280C0015201C00603F41146588C7124DF10D78E170283E0EE6388292D1801C150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e412.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e412.TMP
Size 96B
SHA256 092b41b164f6d1792f9d8a5f656b31f16d763893168bbdab252b1254938081e5
MD5 f2767aa0e62afd003677278548d937ba
SHA1 d85a3cb79aca43b2ff175724e76adba020c464ef
SHA512 dc03d5787270064b0134b78ac7b019e2c38f099712a492d652e620a6497ab4c69d2ff9cbddd9529639129c8f7434950fc589d29140e365f6cec0e7fcabe07be3
TLSH
T170B022C0C0022202C00303B02C8AC0C8B0A0CF38C203223382E00B2ACC2C2A00C20A30
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 add45cf019f2edab86d4f3c6790d0b659a89a53465ab4393dbff75fa4dc18a26
MD5 4a5c320563027ba9bd169073dbf614e1
SHA1 6a2e910e73b17222539e7b1f4ea552819fd4f779
SHA512 c13655f2396fae81869a4cf5c3c06d0540db5fd043bc4d0b59301100cc7ee56621a8305f00b237aa3f4856c6da36ec068ee0cb4c42cd6c8d5a4e1343d8c6a6c3
SSDEEP 6144:jVFm4vCuuwbzIUqSs1qKUqfRRVZFX8KZGES4r:j2zwbzIUfIUqpBFX8KZPr
TLSH
T1213413F5F98FCDAEA3B41158838B294BB544F38247222E8558CB4B1BBC577840B5BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 975066022249263d7b567e2ad4d11d320fef7e1a7ae682aa2186d8f949ec5b05
MD5 d063aaf72bb4f5ce96ae8e214ec520d3
SHA1 5006a572dd4b96bdfa6b98b14d663a2c94d43215
SHA512 d0f1c67db3b46f0e9d23286a1ae0b53a6c6d052c74eaba66586783d597e1efb87db727dcb69d0ab2788af6935fe66cbbac05e5fa934890beb9866a342e37a46b
SSDEEP 6144:PVFm4vCuuwbzIUqSs1qKUqfRRVZFX8KZGES4r:P2zwbzIUfIUqpBFX8KZPr
TLSH
T1993413B1F98FCDEEA7B41108438B2947BD44F38386257E895CCB0F0BA9576844B5BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c6a8720a2b6456051a6aa5b147b3c17153aa076f4898e450e2b4f8aa46771171
MD5 f05ce3b1756b8340ac91a6ae4d6e8ea0
SHA1 e1c476194490b0b7e1e5c83553b43a0dc1b23a82
SHA512 a89f77859b766807e813887c14bd07e63f0005a630fdc6de478555a7ef5c4889a491d3aa1abcaf88ef3d981145e1bf7e1c22cde0cb6273eac0f6836677fdb881
SSDEEP 3072:CqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:CqfRRVZFX8KZGES4F
TLSH
T18DB312F1A91AC96FF761630DC3CF2F0FF66EB141D1265A80789D452E98477802362B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 e72a9bb67d44f270fec70ba69215d997bf7c1774c21e1b1037bcb488e43411bc
MD5 a3f9b5a79afe4af1547a61a6692ce883
SHA1 0330c176b0009b6461ca4aa98d85a3341d909f80
SHA512 ee91027bbdf05c3a5a69542a5346dc4d98c4c627ce0d9c3e4e124574d63205b32c2af4a4a985f368b3d5995ce8ce82fd6a09cc8bf0116c5c2f3db4330465ecf3
SSDEEP 6144:KVFm4vCuuwbzIUqSs1qKUqfRRVZFX8KZGES4r:K2zwbzIUfIUqpBFX8KZPr
TLSH
T1953423F5F98FDDAEA3B41118838F294BB544F38247222E8558CB4B1BBC577840B5BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 079b31aa6c5078c9a97ffc9cfd2778942fbb12359b05975eb18507b6a1f18438
MD5 6db666b8eea8c87bb44fc342dbda5fcb
SHA1 2536fb957e13fd2144e482970707286ca2625816
SHA512 88fcd3e8aaefc443b3fac3ec5a55762424a9d2211b051a36daad0c6be63f7a3f6f51d4be4e89189be044c7df6bcbded7eab6d3cba07a7a1458c48604b365579e
TLSH
T12571CD323375B0D4C9567F07192C19C063BF4396EA98AF5CB65C521ED92750B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8a5e01246bb256aefa3a43441e43bbf511d84dd0c3b4e7c791c333c5b819b2e2
MD5 1728cc6b351d5bf2c37f9415a1f51405
SHA1 cd469a2b820afa841067fe47e0265fc1f28b5661
SHA512 951dab4d0b3358648fc563d698b94a17afa4ca1ffe3b238de2c1397fb089123832ac7306a549163b2014f6995d7ef0ff76f05f8b87cb40caab2ce039414ca217
TLSH
T179217327B3EDC851CC89523B109C9DA076B2D7C780DE8F9B2EC4C218A03F688CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d4ec0xh3.4sz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d4ec0xh3.4sz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1132-44-0x0000000001320000-0x0000000001330000-memory.dmp

Download

memory/1132-45-0x0000000001320000-0x0000000001330000-memory.dmp

Download

memory/1132-0-0x0000000000B00000-0x0000000000B18000-memory.dmp

Download

memory/2372-42-0x000001499E670000-0x000001499E725000-memory.dmp

Download

memory/3924-21-0x000001D5392A0000-0x000001D5392AA000-memory.dmp

Download

memory/3924-23-0x000001D5201F0000-0x000001D520200000-memory.dmp

Download

memory/3924-22-0x000001D5201F0000-0x000001D520200000-memory.dmp

Download

memory/3924-20-0x000001D539310000-0x000001D5393C5000-memory.dmp

Download

memory/3924-19-0x000001D539280000-0x000001D53929C000-memory.dmp

Download

memory/3924-18-0x00007FF4935B0000-0x00007FF4935C0000-memory.dmp

Download

memory/3924-8-0x000001D5201C0000-0x000001D5201E2000-memory.dmp

Download

memory/3924-2-0x000001D5201F0000-0x000001D520200000-memory.dmp

Download

memory/3924-1-0x000001D5201F0000-0x000001D520200000-memory.dmp

Download

memory/4520-59-0x000001ED12E50000-0x000001ED13034000-memory.dmp

Download