xworm | hxxps://drive[.]google[.]com/file/d/17HK-EZtmp9Jo3L4tgadFEfmAP_LNQyR5/view

Resubmissions

21-08-2024 15:43

240821-s6b3vszgrl 10

21-08-2024 15:40

240821-s36s3azfpp 10

21-08-2024 15:31

240821-sx7heazdlm 10

Analysis

max time kernel
141s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/17HK-EZtmp9Jo3L4tgadFEfmAP_LNQyR5/view

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

https://pastebin.com/raw/NEdmeQqG:1487

Mutex

DwhfverRJEI78ymc

Attributes

Install_directory
%AppData%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/NEdmeQqG

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0005000000016806-105.dat	family_xworm
behavioral1/memory/2716-112-0x0000000000340000-0x0000000000350000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2640	powershell.exe
332	powershell.exe
5248	powershell.exe
5412	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	DeadCodeLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	52.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	52.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	52.exe

Executes dropped EXE 3 IoCs

pid	Process
4512	DeadCodeLauncher.exe
2716	52.exe
1848	DeadCodeLauncher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	52.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 36 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
206	pastebin.com
227	pastebin.com
229	pastebin.com
81	drive.google.com
192	pastebin.com
33	drive.google.com
37	drive.google.com
128	drive.google.com
231	pastebin.com
232	pastebin.com
6	drive.google.com
34	drive.google.com
203	pastebin.com
208	pastebin.com
224	pastebin.com
228	pastebin.com
233	pastebin.com
11	drive.google.com
193	pastebin.com
211	pastebin.com
216	pastebin.com
196	pastebin.com
201	pastebin.com
209	pastebin.com
223	pastebin.com
225	pastebin.com
199	pastebin.com
230	pastebin.com
4	drive.google.com
5	drive.google.com
38	drive.google.com
204	pastebin.com
207	pastebin.com
210	pastebin.com
226	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
182	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133687286714057108"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{69D667FF-17C3-4AE0-99B7-B366B32C6F50}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
2640	powershell.exe
2640	powershell.exe
2640	powershell.exe
1848	DeadCodeLauncher.exe
1848	DeadCodeLauncher.exe
332	powershell.exe
332	powershell.exe
332	powershell.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5248	powershell.exe
5248	powershell.exe
5248	powershell.exe
5412	powershell.exe
5412	powershell.exe
5412	powershell.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
1256	msedge.exe
1256	msedge.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1848	DeadCodeLauncher.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeRestorePrivilege	3180	7zFM.exe
Token: 35	3180	7zFM.exe
Token: SeSecurityPrivilege	3180	7zFM.exe
Token: SeDebugPrivilege	2716	52.exe
Token: SeDebugPrivilege	5060	taskmgr.exe
Token: SeSystemProfilePrivilege	5060	taskmgr.exe
Token: SeCreateGlobalPrivilege	5060	taskmgr.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	332	powershell.exe
Token: SeDebugPrivilege	5248	powershell.exe
Token: SeDebugPrivilege	5412	powershell.exe
Token: 33	5060	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5060	taskmgr.exe
Token: SeDebugPrivilege	5420	taskmgr.exe
Token: SeSystemProfilePrivilege	5420	taskmgr.exe
Token: SeCreateGlobalPrivilege	5420	taskmgr.exe
Token: 33	5420	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5420	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3180	7zFM.exe
3180	7zFM.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe
5060	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 4008	1256	msedge.exe	119
PID 1256 wrote to memory of 4008	1256	msedge.exe	119
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 2908	1256	msedge.exe	120
PID 1256 wrote to memory of 4988	1256	msedge.exe	121
PID 1256 wrote to memory of 4988	1256	msedge.exe	121
PID 1256 wrote to memory of 4500	1256	msedge.exe	122
PID 1256 wrote to memory of 4500	1256	msedge.exe	122
PID 1256 wrote to memory of 4500	1256	msedge.exe	122
PID 1256 wrote to memory of 4500	1256	msedge.exe	122
PID 1256 wrote to memory of 4500	1256	msedge.exe	122
PID 1256 wrote to memory of 4500	1256	msedge.exe	122
PID 1256 wrote to memory of 4500	1256	msedge.exe	122
PID 1256 wrote to memory of 4500	1256	msedge.exe	122
PID 1256 wrote to memory of 4500	1256	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/17HK-EZtmp9Jo3L4tgadFEfmAP_LNQyR5/view
1⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=1988,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
1⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=2136,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
1⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5408,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
1⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5420,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
1⤵
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --field-trial-handle=5856,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:2
1⤵
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6088,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
1⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6232,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
1⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6544,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
1⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6596,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
1⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6732,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
1⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6580,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
1⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=7344,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:8
1⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7324,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:8
1⤵
PID:3640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4008

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\123123 пароль.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe62fad198,0x7ffe62fad1a4,0x7ffe62fad1b0
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2408,i,1665368317000831590,5133993195205160506,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1784,i,1665368317000831590,5133993195205160506,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2216,i,1665368317000831590,5133993195205160506,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4548,i,1665368317000831590,5133993195205160506,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4548,i,1665368317000831590,5133993195205160506,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=560,i,1665368317000831590,5133993195205160506,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4564,i,1665368317000831590,5133993195205160506,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4908,i,1665368317000831590,5133993195205160506,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:840

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:4116

C:\Users\Admin\Desktop\DeadCodeLauncher.exe
"C:\Users\Admin\Desktop\DeadCodeLauncher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4512
- C:\Users\Admin\AppData\Local\Temp\52.exe
  "C:\Users\Admin\AppData\Local\Temp\52.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\52.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '52.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1848

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5060

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
6cfdf0fc63642229958775c4ca0ac44e

SHA1
5a2c7d24c7f8caae4bdb1802b1334465fd4a5f3c

SHA256
b9beb543ccd92a87b6224adb2b231f18595479847d55ce433b0b82cd274a97c0

SHA512
77a95499faade0d7d2e57d0c05827b555da30b873e8b8b634a8cc5c8e40eccd03dcc64f4b3ea184a208be266da937598b241d1d85b2a8c6424ef7524a1ef568e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
84b13f677f02299a359dffa40331c7ac

SHA1
2dd7d2d329fbbfd47becc40d43b3c86373cc6f29

SHA256
76bbbc50b346afed8cc1b1a20bf5335398ed5db81b8341ae8c6749a6b8baafd7

SHA512
c431dab94e7b04c604370b7b5bf78696f5aa232b8edf2ed48809774a8e7bac1dd76f3803707c574eb85ae3368728dcba5f5203b86576300f76b696a0e5f5b755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
135480b4cb225c79221546137c429c60

SHA1
ac8184a8133b6dc98f5e6927c691c24c66cbe2f4

SHA256
57b6072e4d8df419cd54a96985d36accd4ae9f40cb4a61fbc76593202115190a

SHA512
90df2bc7da69311c2112a366785a2d929d7399d2441e20566d2e4c64bb5962ad98210e7c021e6c5023f7062d49aadaa8ae7d2bb85ae530eff3bf68d92117fbcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
63KB

MD5
492c3cf8d2267b0897433b53bf0c0b7b

SHA1
9ffa82cb5524dda3ccbf3ef7a8c545ed951b1e24

SHA256
7ae44d6228b58c6d7d11e8c34faf73ceea32f87d4dd5aeec354ba90ad4790842

SHA512
be1bafe8c94bc960927b33170ed978ccdfc69360c15a21b0ff2624bad8f5911d90686ca3964345dce21667d35ae5a7cb6faf7b0e477d755d174c4fdee3343643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
63KB

MD5
63aded063f1418fea568435af3c21850

SHA1
d9ea88fb40b6ad70e85ad9b755db622684503e0f

SHA256
8c3ca28dc8ea261b35f7f548531c7df9789a7b950b5346ddaf9a48b0922b3ad4

SHA512
f3cd442704b36f2e614ac395b70342691c53ac71c4f7d4dc2e8d44e9e2e0ac38fe81dfed021386b9347b20db91e120c29b5b35fe080e145d5efa91c0251e75ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e25058a5d8ac6b42d8c7c9883c598303

SHA1
bd9e6194a36a959772fc020f905244900ffc3d57

SHA256
9f6fe2203df58ba90b512b436fd74f5eeb4f39f4f9f54a41e882fc54e5f35d51

SHA512
0146f2d1298acf189005217784e952d6e99bf7c8bf24ae9e9af1a2ca3d881dca39f19f3ecd06c7d0ad919bc929edaf6e97e0ab2d7f71733b9422527c594ea0c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c1b0a9f26c3e1786191e94e419f1fbf9

SHA1
7f3492f4ec2d93e164f43fe2606b53edcffd8926

SHA256
796649641966f606d7217bb94c5c0a6194eef518815dacc86feacdd78d3c1113

SHA512
fa0290d77372c26a2f14cb9b0002c222bc757ce7ad02516b884c59a1108f42eb4c76884f9edb6c7149f7c3fac917eda99b72a3b1d72b7e118a1d5a73cadd15a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\52.exe

Filesize
41KB

MD5
ea9a810f7368f48111f29b0ce79d875b

SHA1
c0ae2b564115a0487e2ea39046777a9013c52b98

SHA256
4e21ba88e33d63d676c0e447670d20ee4121d7153f2e13f1664fd863115a6bdc

SHA512
1e59ff6ec3f35f9329336ba3711e13d6fef22761803c2f217f48f25132083ba37c99f38b0418d6220c8bac2edd0dc988068bbd28882c17e9b60affe5a543cbf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe

Filesize
21.7MB

MD5
83c53c505565b7b55eaf09babbc6b539

SHA1
b2bd6132e9e8aff4e04fb46f6acebf93ff48e41f

SHA256
244fbb26b47effaadab2bdcd6907827ffd0b294a8a5f9473f88170bc03904354

SHA512
31188502dc7bc0234a7f7eb91f8ba2069dbe964a90a6328acfbe0c4c50f53b56651938487acf300d83129bf8aed873f93ee73d503caa9ff30e6d781f184beb51

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pejoo2sg.yxd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

Filesize
771B

MD5
fc7fdc374815ae23bcec8f15adaa5693

SHA1
80557159ffdb5360efb3df96574bdac71093e408

SHA256
5c9f51c21a99ac97afb95f4ac40f77e54213d9cfd6dd2e4ba4828f391a030015

SHA512
86296a609625092af66e0699e806c959cfe6f8caef6a93b01b50c446e7101cf8242f74a8cc8694714f3dae718c61e6a644366b160a3e33819480aba33ba00be0

Download Submit
C:\Users\Admin\Desktop\DeadCodeLauncher.exe

Filesize
21.4MB

MD5
4a10260e0877a388c779740a050cf77d

SHA1
a06077b7870d659d929e9d8773925bf11ee7fea6

SHA256
1d709aaeceacba216e1111fe9d63b3ce64d68db3b83254c6ab4e7914d0d889ff

SHA512
00c9506e56580f8c02b392ad9b812ec02a7122b7e890ee5b8a38a778086167fcbb51e965a1714e06f5e524044ebcc1bc47d21994ec15bfc096fa66582c58d9d1

Download Submit
memory/1848-209-0x000001D0DF730000-0x000001D0DF7BF000-memory.dmp

Filesize
572KB

Download
memory/1848-173-0x00007FFE89360000-0x00007FFE89362000-memory.dmp

Filesize
8KB

Download
memory/1848-182-0x000001D0E13B0000-0x000001D0E17FE000-memory.dmp

Filesize
4.3MB

Download
memory/1848-188-0x000001D0E13B0000-0x000001D0E17FE000-memory.dmp

Filesize
4.3MB

Download
memory/1848-190-0x000001D0DF730000-0x000001D0DF7BF000-memory.dmp

Filesize
572KB

Download
memory/1848-149-0x00007FFE89280000-0x00007FFE89282000-memory.dmp

Filesize
8KB

Download
memory/1848-148-0x00007FFE89270000-0x00007FFE89272000-memory.dmp

Filesize
8KB

Download
memory/1848-151-0x00007FFE892A0000-0x00007FFE892A2000-memory.dmp

Filesize
8KB

Download
memory/1848-150-0x00007FFE89290000-0x00007FFE89292000-memory.dmp

Filesize
8KB

Download
memory/1848-154-0x00007FFE892D0000-0x00007FFE892D2000-memory.dmp

Filesize
8KB

Download
memory/1848-153-0x00007FFE892C0000-0x00007FFE892C2000-memory.dmp

Filesize
8KB

Download
memory/1848-152-0x00007FFE892B0000-0x00007FFE892B2000-memory.dmp

Filesize
8KB

Download
memory/1848-155-0x00007FFE892E0000-0x00007FFE892E2000-memory.dmp

Filesize
8KB

Download
memory/1848-162-0x00007FFE892F0000-0x00007FFE892F2000-memory.dmp

Filesize
8KB

Download
memory/1848-170-0x00007FFE89330000-0x00007FFE89332000-memory.dmp

Filesize
8KB

Download
memory/1848-197-0x000001D0E0F90000-0x000001D0E101A000-memory.dmp

Filesize
552KB

Download
memory/1848-168-0x00007FFE89320000-0x00007FFE89322000-memory.dmp

Filesize
8KB

Download
memory/1848-167-0x00007FFE89310000-0x00007FFE89312000-memory.dmp

Filesize
8KB

Download
memory/1848-166-0x00007FFE89300000-0x00007FFE89302000-memory.dmp

Filesize
8KB

Download
memory/1848-171-0x00007FFE89340000-0x00007FFE89342000-memory.dmp

Filesize
8KB

Download
memory/1848-172-0x00007FFE89350000-0x00007FFE89352000-memory.dmp

Filesize
8KB

Download
memory/1848-202-0x000001D0DF5D0000-0x000001D0DF5EA000-memory.dmp

Filesize
104KB

Download
memory/1848-181-0x000001D0E1140000-0x000001D0E13A3000-memory.dmp

Filesize
2.4MB

Download
memory/1848-176-0x000001D0E1140000-0x000001D0E13A3000-memory.dmp

Filesize
2.4MB

Download
memory/1848-175-0x00007FFE89380000-0x00007FFE89382000-memory.dmp

Filesize
8KB

Download
memory/1848-174-0x00007FFE89370000-0x00007FFE89372000-memory.dmp

Filesize
8KB

Download
memory/1848-189-0x000001D0E13B0000-0x000001D0E17FE000-memory.dmp

Filesize
4.3MB

Download
memory/1848-214-0x00007FF7CFAA0000-0x00007FF7D26D7000-memory.dmp

Filesize
44.2MB

Download
memory/1848-210-0x000001D0DF5D0000-0x000001D0DF5EA000-memory.dmp

Filesize
104KB

Download
memory/1848-208-0x000001D0E0F90000-0x000001D0E101A000-memory.dmp

Filesize
552KB

Download
memory/2640-144-0x00000114B70C0000-0x00000114B70E2000-memory.dmp

Filesize
136KB

Download
memory/2716-112-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/4512-100-0x0000000000930000-0x0000000001E96000-memory.dmp

Filesize
21.4MB

Download
memory/5060-133-0x000002090B3E0000-0x000002090B3E1000-memory.dmp

Filesize
4KB

Download
memory/5060-129-0x000002090B3E0000-0x000002090B3E1000-memory.dmp

Filesize
4KB

Download
memory/5060-130-0x000002090B3E0000-0x000002090B3E1000-memory.dmp

Filesize
4KB

Download
memory/5060-132-0x000002090B3E0000-0x000002090B3E1000-memory.dmp

Filesize
4KB

Download
memory/5060-134-0x000002090B3E0000-0x000002090B3E1000-memory.dmp

Filesize
4KB

Download
memory/5060-122-0x000002090B3E0000-0x000002090B3E1000-memory.dmp

Filesize
4KB

Download
memory/5060-123-0x000002090B3E0000-0x000002090B3E1000-memory.dmp

Filesize
4KB

Download
memory/5060-124-0x000002090B3E0000-0x000002090B3E1000-memory.dmp

Filesize
4KB

Download
memory/5060-131-0x000002090B3E0000-0x000002090B3E1000-memory.dmp

Filesize
4KB

Download
memory/5060-128-0x000002090B3E0000-0x000002090B3E1000-memory.dmp

Filesize
4KB

Download