phemedrone | 1568c7c5a406c63d713a2822cad82b5284db8fd360463d450f1df78e31583d0b

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Everything.exe
Size 2.6MB
Sample260601-khjtsshv8j
SHA256 1568c7c5a406c63d713a2822cad82b5284db8fd360463d450f1df78e31583d0b
MD5 1cdf6dbdae7e55455803d4f2d99db88f
SHA1 5e092e22c73fcd040b0ccb23ac37f32b74eb7fe8
SHA512 dbc3bb6d534e6a7ca016640a404484ca2365b29c680171f32b57bdbd9fb32e07a52a9d2d574a5bf54ce71e0d47f4cb61658453be8c438f1698d0ab1e8da3dda2
SSDEEP 49152:eOtTYNl5fj1P/cJPDrZPM/Ns4BbnQAwsDNOUZHxOezRk1+gLTbhoLOE+uy+:eOtTYlj18JqYEnEMRk1+g/bamuy+
TLSH
T18DC52322B9908431DC5208741AE2B272E37CB9B85FE45FD7A7542F695F700E1DA38AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gtav credential_access discovery execution phemedrone sheetrat persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot7273749260:AAEANE-FnbYPy61NoMvmkj5MOd00Ynl6h_g/sendDocument

Extracted

Family

sheetrat

Version

Campaign

GTAV

ships-florist.gl.at.ply.gg:51965

Mutex

ydkmzmj(c(yjjtg7m_ya3b&!iwa*

Attributes

anti_virtual
false
certificate
u6146azqzwtn1i3lckj
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
2r29wm34ecfzx76v4d4b05ljpnhac
path_client
%Windows%\System32\xdwdDRkernel.exe
path_watch_dog
%Windows%\Scenarios\xdwdgrwMedia.exe
pump
true
rootkit
qqtjc5rmxdo
task_client
AppID\CrashReporter_NvTew
task_watch_dog
Maps\MachineCoreGoogleUpdateTor
use_install_admin
false
user_init
true

Signatures

Family: Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x001c00000002b2e8-8.dat	family_sheetrat_v1
behavioral2/memory/1112-27-0x0000000000140000-0x00000000001B8000-memory.dmp	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\xdwdDRkernel.exe"	Cheat.sfx.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5268	chrome.exe
220	chrome.exe
328	chrome.exe
4916	chrome.exe
1244	chrome.exe

Executes dropped EXE 7 IoCs

pid	Process
1112	Cheat.sfx.exe
4656	tzidRecG.exe
384	xdwdDRkernel.exe
1720	xdwdDRkernel.exe
1420	xdwdgrwMedia.exe
4028	xdwdDRkernel.exe
5368	xdwdDRkernel.exe

Loads dropped DLL 11 IoCs

pid	Process
1720	xdwdDRkernel.exe
764	Process not Found
1420	xdwdgrwMedia.exe
5024	Process not Found
5944	Process not Found
6032	chrome.exe
6036	chrome.exe
1768	chrome.exe
4028	xdwdDRkernel.exe
5368	xdwdDRkernel.exe
3736	chrome.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\xdwdDRkernel.exe	xdwdDRkernel.exe
File opened for modification	C:\Windows\System32\xdwdDRkernel.exe	xdwdDRkernel.exe
File opened for modification	C:\Windows\System32\xdwdDRkernel.exe	xdwdgrwMedia.exe
File opened for modification	C:\Windows\System32\xdwdDRkernel.exe	xdwdDRkernel.exe
File opened for modification	C:\Windows\System32\xdwdDRkernel.exe	xdwdDRkernel.exe
File created	C:\Windows\System32\xdwdDRkernel.exe	Cheat.sfx.exe
File opened for modification	C:\Windows\System32\xdwdDRkernel.exe	Cheat.sfx.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Scenarios\xdwdgrwMedia.exe	xdwdDRkernel.exe
File opened for modification	C:\Windows\Scenarios\xdwdgrwMedia.exe	xdwdgrwMedia.exe
File opened for modification	C:\Windows\Scenarios\xdwdgrwMedia.exe	Cheat.sfx.exe
File created	C:\Windows\xdwd.dll	Cheat.sfx.exe
File opened for modification	C:\Windows\Scenarios\xdwdgrwMedia.exe	xdwdDRkernel.exe
File opened for modification	C:\Windows\Scenarios\xdwdgrwMedia.exe	xdwdDRkernel.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Scenarios\xdwdgrwMedia.exe	Cheat.sfx.exe
File opened for modification	C:\Windows\xdwd.dll	Cheat.sfx.exe
File opened for modification	C:\Windows\Scenarios\xdwdgrwMedia.exe	xdwdDRkernel.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4100	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Cheat.sfx.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5556	schtasks.exe
484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4656	tzidRecG.exe
220	chrome.exe
220	chrome.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe
4656	tzidRecG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1112	Cheat.sfx.exe
Token: SeDebugPrivilege	4656	tzidRecG.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeDebugPrivilege	384	xdwdDRkernel.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeDebugPrivilege	1720	xdwdDRkernel.exe
Token: SeDebugPrivilege	1420	xdwdgrwMedia.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeIncBasePriorityPrivilege	384	xdwdDRkernel.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
220	chrome.exe
220	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 1112	5168	Everything.exe	81
PID 5168 wrote to memory of 4656	5168	Everything.exe	82
PID 4656 wrote to memory of 220	4656	tzidRecG.exe	84
PID 220 wrote to memory of 3248	220	chrome.exe	85
PID 220 wrote to memory of 4100	220	chrome.exe	86
PID 220 wrote to memory of 1576	220	chrome.exe	87
PID 220 wrote to memory of 1576	220	chrome.exe	87
PID 220 wrote to memory of 4916	220	chrome.exe	91
PID 220 wrote to memory of 4916	220	chrome.exe	91
PID 220 wrote to memory of 3528	220	chrome.exe	89
PID 220 wrote to memory of 3528	220	chrome.exe	89
PID 220 wrote to memory of 328	220	chrome.exe	90
PID 220 wrote to memory of 328	220	chrome.exe	90
PID 220 wrote to memory of 1244	220	chrome.exe	92
PID 220 wrote to memory of 1244	220	chrome.exe	92
PID 220 wrote to memory of 5204	220	chrome.exe	93
PID 220 wrote to memory of 5204	220	chrome.exe	93
PID 220 wrote to memory of 5336	220	chrome.exe	94
PID 220 wrote to memory of 5336	220	chrome.exe	94
PID 220 wrote to memory of 5268	220	chrome.exe	95
PID 220 wrote to memory of 5268	220	chrome.exe	95
PID 1112 wrote to memory of 5444	1112	Cheat.sfx.exe	97
PID 1112 wrote to memory of 5428	1112	Cheat.sfx.exe	98
PID 5428 wrote to memory of 5556	5428	cmd.exe	101
PID 1112 wrote to memory of 5512	1112	Cheat.sfx.exe	102
PID 5512 wrote to memory of 484	5512	cmd.exe	105
PID 1112 wrote to memory of 1720	1112	Cheat.sfx.exe	107
PID 220 wrote to memory of 6036	220	chrome.exe	113
PID 220 wrote to memory of 6032	220	chrome.exe	114
PID 220 wrote to memory of 1768	220	chrome.exe	115
PID 220 wrote to memory of 3736	220	chrome.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Everything.exe
"C:\Users\Admin\AppData\Local\Temp\Everything.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Users\Admin\AppData\Local\Temp\Cheat.sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\Cheat.sfx.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="f<Lqh^3PhLYnhH" dir=in action=allow program="C:\Windows\System32\xdwdDRkernel.exe" enable=yes & exit
    3⤵
    PID:5444
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5428
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5556
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5512
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:484
- - C:\Windows\System32\xdwdDRkernel.exe
    "C:\Windows\System32\xdwdDRkernel.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- C:\Users\Admin\AppData\Local\Temp\tzidRecG.exe
  "C:\Users\Admin\AppData\Local\Temp\tzidRecG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83d12c728,0x7ff83d12c734,0x7ff83d12c740
      4⤵
      PID:3248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,4004508753020189192,11178360296161744520,524288 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:11
      4⤵
      System Time Discovery
      PID:4100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,9651702743467518955,8464180345822556781,262144 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2084 /prefetch:2
      4⤵
      PID:1576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,9192622014964949001,18296513018461471020,524288 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:13
      4⤵
      PID:3528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3080,i,504174125892975441,883717873725607679,2097152 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3084 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,4858868908452002395,12530712804336486093,2097152 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,10789901829726322904,15881986465059814855,2097152 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:1244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4296,i,8077771547923379296,18289724734465447065,524288 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:14
      4⤵
      PID:5204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,6966295703325499735,5433307868342126855,524288 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:14
      4⤵
      PID:5336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4744,i,16554860088368758659,5834708547440116582,2097152 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5036 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,15836126915338322420,11785951692854101267,524288 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:6036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,12147575385558975746,5483180320532407342,524288 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:6032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,1462606074532252597,3957212655936153505,524288 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:1768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1076,i,10085916978263827868,16964579968594276090,262144 --field-trial-handle=2088,i,256787327649221691,3354588468839540602,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=968 /prefetch:10
      4⤵
      Loads dropped DLL
      PID:3736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:440

C:\Windows\System32\xdwdDRkernel.exe
C:\Windows\System32\xdwdDRkernel.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:384

C:\Windows\Scenarios\xdwdgrwMedia.exe
C:\Windows\Scenarios\xdwdgrwMedia.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\System32\xdwdDRkernel.exe
C:\Windows\System32\xdwdDRkernel.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4028

C:\Windows\System32\xdwdDRkernel.exe
C:\Windows\System32\xdwdDRkernel.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0356c924-546d-4e59-81a7-11bd2ce277cf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0356c924-546d-4e59-81a7-11bd2ce277cf.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

178cdbe7-9585-480a-a498-98ba9f6f9436.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\178cdbe7-9585-480a-a498-98ba9f6f9436.tmp
Size 3KB
SHA256 a02fc4f95149e0098e3852be4756ed7d9f18d9c64ddc58e3e387a61302e854d6
MD5 beced1290b2764e6239549cda09c522f
SHA1 ac87ba7790225f67aab1dac555154e6506cc04fb
SHA512 ec865f7f04a10a31aeb229ebe7c02d69f9ea26de1714920d3c130fef2657c92f9988ed675d8b22d9dc7e73b08103d5ca0096371132ff949c7db3693a9b0ebf56
TLSH
T16C518CF3C6E8866DC90152E5AB256E2FCD6D0E14531C3C56C8D4AF4F53E2872D24134E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 79a1e23f110fa495767ad9f4ebe3396895c3f4ce2193da7819730259067dff01
MD5 074a2a174b4440fa70e79d5ad2ec416f
SHA1 3a85f57ef4be777b858c0941d7a7ba97dd3bc21c
SHA512 b2ae1aa9f821e875082e52abc1a4606ec921cafd7e094af36bedec0505347c27904609c7296a0360c4219d674f608e979df006c925afd975aec0faa4221833c8
SSDEEP 192:LRUhZ1yAUSUoRv7sBpAPRp2Z9NHsb+WNn7L0bbmlkwVRkVyIsnAUge:LRkvPB8UXerwv0Ol7ge
TLSH
T16442C62FAA14653B5CDBD22AF9227753E7F5113131942E84EAFC8B2C15D79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5310d9db0c29e4573be9528c35c45f2016bfb2706171589e253a87709b5d3ca8
MD5 ccfbaf951ae4b4509ce26b13bcbf2fc4
SHA1 7c72301953ee574553464e898bcd73c7761cb44d
SHA512 4bfcb5922f1549c48a6b1954a8629f5168a08e5afdd86f711149c4105ca82c142192912cbe596981e9feb533345a23db46b9891871fc82593666f30a2081441b
SSDEEP 192:LRUhZ1PAUSUoRv7sBpyPRpAZ9NHsb+WNn7L0yi6bmlkwVR0VyIsnAUge:LRkvkB8CXwrwv0yitl7we
TLSH
T1F842D71FA914693B9CDBD22AF9227753E7F5213131942E44E6FC8B2C18E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9e3ce943ce04fd4d0b3870ad92da626054a3361474f851987b52aefc40052a66
MD5 04576e86a94c9690080b3740f556b7c1
SHA1 31ee9400f906b5679d28f2d1b1b968e928a86dd1
SHA512 ba843f63ce2acadb065e1fb44a3002f7a303ce856f9185a363c9a6a327ed2ca087fddc0f7107801856d20c9d27edfeab69075d115c5aacc35c2ea82237600696
TLSH
T111B0124084025192C14607F8124314CC7154DF10960A2B0143E46A22D8251908418475
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5848db.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5848db.TMP
Size 96B
SHA256 56f4d012341b6982b5e8a3dd4480e53dd0f186a0f67b5dbe48f3dd4b0a0b6557
MD5 bab2da049849bdcad0d94c97a03a20fc
SHA1 3575d60c5cd46377622034640721406ec8da3291
SHA512 d13780fe803bfe3c9787034ec5ec420935cc06cf40e19b7273aa68ee801c3607b58ad3b015921ef5ad9509d586105876f3f21bd5efd72f5d95c132c3f7caab84
TLSH
T153B00255C1066213D0C243B0B9F595F87660DF26C603272697E03A76DC267B44529DB1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0d19b53e126cf493b40d318adcd91b743c52f7f2c49c9ee4232cab5909bdf21a
MD5 cc10fa9f3ca0471396394d658ad3176d
SHA1 9549580a111a867a8a627cb16b0112146b78fb7a
SHA512 6ff9342dd8b6e384b17b3b67654de419b651f917aee28c0fcd889b582cb2139b647e74b93e54bfcc9a02f8d84132d64dac6e62af44fbcbfbd6a33cd0d351e296
SSDEEP 3072:GGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:xm7Rkm1tYpBeh2BAon
TLSH
T1CEC312376D74A83799B5BB1EB04E1B1F1EF14AA7D920DE92C8D45B0823EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 96bd0e9751b21be1cff1cecdebed127f2ab725339bb949c93511ccb4e4979886
MD5 9cd4c8b4925e12d2db7ca77ecb34bf75
SHA1 ffb25db784bb58bffb59970919b57c699bf809d8
SHA512 0d0228fc1a2a826ba6c4948480feca8e09c11202bc3ab9b8821b36aa9aa3df97b02e6923aa30dc87e62e56182930d9c288b52441bb45256e0a760b4d9f1c1ede
SSDEEP 3072:1Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:cm7Rkm1tYpBeh2BAon
TLSH
T1E9C3123B6D74A8375DB5BB0EB04E1A1F1EF14EA7D924DE91C8D45B0823EA7CC0A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 460226978372e84fb07088818ef6e3381b53acfef85d0710bb8c5f9eae2e1176
MD5 308f25bca8486a4a5efdb0b76838d6d5
SHA1 903f9dd1a8320436e152d524d3a659a0e97085f8
SHA512 305a00c0d94c7c4379c93cb50934264c1fbdfd3aaa81948948ba4370f2d8c3c4b29e91b061a504f8f457aecfef6d2b48b48ec83ebf7c8890dccdd48ecd689b9c
SSDEEP 3072:vGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:+m7Rkm1tYpBeh2BAoe
TLSH
T191C3123B5E75A8775CB5BB0EB08E0B1F1EF14EA6C920DE82C8D85B0427E97CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ac4762f5178097430aa38641ce35ebbfe1fbd318aede14870560d06b13f05835
MD5 1955fd13c2ab3b72b6c48c65e2858660
SHA1 238fb53274e65795c9840da6cd77ff7f77db06dd
SHA512 86e8c520d3df702e0d56a4b357b147f7b3f5e5020d86347a14fa83725a1d3ed8d707028a2884fc0f0d23bddbc56eee3887aca27939bd6331c5402ab6f19d09ce
SSDEEP 3072:xGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:gm7Rkm1tYpBeh2BAon
TLSH
T18EC312376E74A83759B5AB1EB04E0B1F1EF14AA7D920DE92C8D45B0823EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwdDRkernel.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdDRkernel.exe.log
Size 1KB
SHA256 8b410de677f095f88c42c69c716a9383b94ceb86ca90666188fcd4f4df7fc9fa
MD5 5dd6ecdc4507cc0f897cded9ebeb94b4
SHA1 afd42365a5a8fa71f506a3d34960f8ed459cfd86
SHA512 078e5c9b8062420ef2c3a3a816961e957b0daa7f7a2ecd92689d0399febda98a0c727d1cd9b286adce1c132b9efbd383179867cc494831d4679d9e3805d51a06
TLSH
T14011AB722371B1D489163F43295C568827FF4319B550EE0CBAA8B21ED82B41B6F322F3
MD5 SHA1 SHA512 TLSH

Submit Download

Cheat.sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\Cheat.sfx.exe
Size 464KB
SHA256 3648a5ac08fab7638df4f3ed12ccaff99b9bd53de91b543fbe4015d1705ebca1
MD5 98f3c0928f2e327605b329b47f00515f
SHA1 4f4b2453509ac19f0940f69e1087d312d5e8e61e
SHA512 d31f7de9b356fcd173338011493a87bc59e851112b58e7ab0385ed0d36179433c1b2e2c3d4d816f57984947f381951325ab92c5eb7e769c840030256c2fa915c
SSDEEP 6144:pcqLZyHgqrSyQFp54+CbIebd89sX0ChUp1hsf:G+AHPOZ6+3N6vUp1af
TLSH
T11AA43BB28BC31D73D8C2E2BB3F05019A9988A94325FD116B613DF66EC26D6585343E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzidRecG.exe

Path C:\Users\Admin\AppData\Local\Temp\tzidRecG.exe
Size 138KB
SHA256 371190a4c343a0b01eff79bcad0bc647ee7b9c69112bb21d42724bce2957162c
MD5 01be7a167e099b9977dfe8165fdca0d9
SHA1 242805c2b79b88c630a82dd10a29365eeee64291
SHA512 4999416317047ea4101ecf61fa4eced6d8fcf337db9b1c1a64c58b67aaf313ea9b8d938055d16d4a24e95a03844dd81fe676e1ab9277573eab18d6f7ec819ca8
SSDEEP 1536:bcxA4IFzn6/VvFmaUo8xUYROosEUa4qw3/OVDviadWu0NV5a5Htdbpps9dnKelYj:bcx2bouad8xaoL4qw3/ugva571SKeqf
TLSH
T189D3191479EA0519D37F9AB5EFE8F4A58A65E1220E0BF7BA194216C21F52BC0FD03077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-27-0x0000000000140000-0x00000000001B8000-memory.dmp

Download

memory/4656-26-0x000001C3E7780000-0x000001C3E77A8000-memory.dmp

Download