xworm | hxxps://drive[.]google[.]com/file/d/17HK-EZtmp9Jo3L4tgadFEfmAP_LNQyR5/view

Resubmissions

21-08-2024 15:43

240821-s6b3vszgrl 10

21-08-2024 15:40

240821-s36s3azfpp 10

21-08-2024 15:31

240821-sx7heazdlm 10

Analysis

max time kernel
207s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/17HK-EZtmp9Jo3L4tgadFEfmAP_LNQyR5/view

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

https://pastebin.com/raw/NEdmeQqG:1487

Mutex

DwhfverRJEI78ymc

Attributes

Install_directory
%AppData%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/NEdmeQqG

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral4/files/0x000900000002342c-349.dat	family_xworm
behavioral4/memory/3580-356-0x0000000000550000-0x0000000000560000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2788	powershell.exe
5116	powershell.exe
4932	powershell.exe
4292	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	DeadCodeLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	DeadCodeLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	52.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	DeadCodeLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	DeadCodeLauncher.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	52.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	52.exe

Executes dropped EXE 14 IoCs

pid	Process
2644	DeadCodeLauncher.exe
3580	52.exe
3324	DeadCodeLauncher.exe
1928	DeadCodeLauncher.exe
3928	DeadCodeLauncher.exe
920	DeadCodeLauncher.exe
2864	52.exe
4964	DeadCodeLauncher.exe
3748	52.exe
1312	DeadCodeLauncher.exe
3932	DeadCodeLauncher.exe
4316	DeadCodeLauncher.exe
1816	52.exe
4356	DeadCodeLauncher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	52.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
159	pastebin.com
160	pastebin.com
6	drive.google.com
10	drive.google.com
154	pastebin.com
155	pastebin.com
157	pastebin.com
158	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
151	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
1632	msedge.exe
1632	msedge.exe
4524	identity_helper.exe
4524	identity_helper.exe
4324	msedge.exe
4324	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
3324	DeadCodeLauncher.exe
3324	DeadCodeLauncher.exe
2788	powershell.exe
2788	powershell.exe
2788	powershell.exe
1876	taskmgr.exe
1876	taskmgr.exe
5116	powershell.exe
5116	powershell.exe
1876	taskmgr.exe
4964	DeadCodeLauncher.exe
4964	DeadCodeLauncher.exe
1876	taskmgr.exe
5116	powershell.exe
1876	taskmgr.exe
1312	DeadCodeLauncher.exe
1312	DeadCodeLauncher.exe
1876	taskmgr.exe
4932	powershell.exe
4932	powershell.exe
4932	powershell.exe
1876	taskmgr.exe
4292	powershell.exe
4292	powershell.exe
4292	powershell.exe
1876	taskmgr.exe
1876	taskmgr.exe
4356	DeadCodeLauncher.exe
4356	DeadCodeLauncher.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
4944	7zFM.exe
3324	DeadCodeLauncher.exe
4964	DeadCodeLauncher.exe
1312	DeadCodeLauncher.exe
4356	DeadCodeLauncher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	4944	7zFM.exe
Token: 35	4944	7zFM.exe
Token: SeSecurityPrivilege	4944	7zFM.exe
Token: SeDebugPrivilege	3580	52.exe
Token: SeDebugPrivilege	2864	52.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	3748	52.exe
Token: SeDebugPrivilege	1876	taskmgr.exe
Token: SeSystemProfilePrivilege	1876	taskmgr.exe
Token: SeCreateGlobalPrivilege	1876	taskmgr.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: 33	1876	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1876	taskmgr.exe
Token: SeDebugPrivilege	1816	52.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
4944	7zFM.exe
1632	msedge.exe
4944	7zFM.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe
1876	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4140	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1468	1632	msedge.exe	84
PID 1632 wrote to memory of 1468	1632	msedge.exe	84
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 4984	1632	msedge.exe	85
PID 1632 wrote to memory of 2452	1632	msedge.exe	86
PID 1632 wrote to memory of 2452	1632	msedge.exe	86
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87
PID 1632 wrote to memory of 4408	1632	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/17HK-EZtmp9Jo3L4tgadFEfmAP_LNQyR5/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcafda46f8,0x7ffcafda4708,0x7ffcafda4718
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,15949191544019493894,11145619716888302462,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6160 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3056

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\123123 пароль.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4944

C:\Users\Admin\Desktop\DeadCodeLauncher.exe
"C:\Users\Admin\Desktop\DeadCodeLauncher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2644
- C:\Users\Admin\AppData\Local\Temp\52.exe
  "C:\Users\Admin\AppData\Local\Temp\52.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\52.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '52.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3324

C:\Users\Admin\Desktop\DeadCodeLauncher.exe
"C:\Users\Admin\Desktop\DeadCodeLauncher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1928
- C:\Users\Admin\AppData\Local\Temp\52.exe
  "C:\Users\Admin\AppData\Local\Temp\52.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4964

C:\Users\Admin\Desktop\DeadCodeLauncher.exe
"C:\Users\Admin\Desktop\DeadCodeLauncher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3928
- C:\Users\Admin\AppData\Local\Temp\52.exe
  "C:\Users\Admin\AppData\Local\Temp\52.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1312

C:\Users\Admin\Desktop\DeadCodeLauncher.exe
"C:\Users\Admin\Desktop\DeadCodeLauncher.exe"
1⤵
- Executes dropped EXE
PID:920

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1876

C:\Users\Admin\Desktop\DeadCodeLauncher.exe
"C:\Users\Admin\Desktop\DeadCodeLauncher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3932
- C:\Users\Admin\AppData\Local\Temp\52.exe
  "C:\Users\Admin\AppData\Local\Temp\52.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4356

C:\Users\Admin\Desktop\DeadCodeLauncher.exe
"C:\Users\Admin\Desktop\DeadCodeLauncher.exe"
1⤵
- Executes dropped EXE
PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DeadCodeLauncher.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\142a0d5c-f93d-4804-928c-6b91641c6b61.tmp

Filesize
3KB

MD5
d7e2db986d6b1236bf830fbe7a0eef30

SHA1
d5975495635c5122209f18c82ce43a5f08b9752f

SHA256
a12508ee693f03fe0976f02d71e8e2a9047adbeef5ec68a26f279a37f8fcacf2

SHA512
96674035d4a4cd9b731ca64ad95930d459fb53c902b07e7f20c2c9f7b44ff79fc9c093aae4380c80a1e742ccb18d019939e09b8bee8561a2cddd7276bf0647da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
1fb28499baa9e4fe4f3bcc0778a8651e

SHA1
8b72e6e45703301bc830f16074beb40925c323c1

SHA256
3268e1098c2bf2bb362245d1721226cee982169d865d015815365f61398c88bf

SHA512
7c116b186462f3c765f2441802c6ac5f893af0d7056bc40ec3854780d5349623d0bc2af8c4a7c67f70818c17fc4dea052419ff17f95e5eed458e9c5a1cf4d53c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
23d647e16c85bae1c73c0caa53602fcb

SHA1
c4a8cac16902c7edb93d48bf0870bbac0b232534

SHA256
de7f5940e2f8b8a85642f3f6688add4ca19c109c852436fbd8ebdc7b211482e8

SHA512
e6235ceb0f5f3ed5e2d42542d4f1cc215f76bf69d2385fd2e40156fb9e6570420bde16e8b82aa8f34410a43ed3c2f2cf59dae8391b76ca8868398e6a7ae88c9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4fa0524bcfa065db71a151e48919b303

SHA1
3347e895433014aee66a30d6415c05e972d02c1c

SHA256
612c637d012f1d792a55974cf2292664866ec84cb6a32e6b389bd3de580638e3

SHA512
d090d19b1aad780cc4688692b95b9d317da7f3890152168496109cf0c2290cd7cb2d50fea560b2df298b2ea348bb7ec944a5efc88ce1ad357d9dcca0fb86bd61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93b74d5174bb9c24ace1db68121496c5

SHA1
aa172d064c2071d7f47087a887c783a6d9056ab1

SHA256
5ecfc0720384e46e90d2d824b756335385a731099cbfb2c7f56b62ccdf0cab2b

SHA512
60c638615bf1eb787256dd624fd093962bc6787e1f8875dbdedd22a44dc47057db1df733cc0bf787b3f5140b8574d5ef7e626f91420a5cb425437f1041752c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f86f45cbfb0559add9ac1c6ab95ca91

SHA1
f91967d6f7068cf9ed325bea1b8fe462fbbbcf56

SHA256
f46f1208a7701bc313781725ece11928dd387a6e470ba6f41ece8def1367b680

SHA512
ec4fa914ffbaf02438e58281c3db26dc2c4420fa0aa5e4448f077e21d07f0f885afe73417247eaf62e1520ad7db4dc52a255a918add160586687fc022434896c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e52906c819663a39e88382ffa8ed517

SHA1
25734e7efc673edc62b1a5dc752a6506f0f01e73

SHA256
07a199b6011e8f71bab8a22907e935bd8736e15ca25bbee4839f2c700deb335a

SHA512
f8ecd25f1568a2947cfec5ca3dd0dd1ddeeca1d7e850b7b4dbd182f19122adb0b1928724961697e6ad4b5b9ba6a495ec73bb5c9b91cd5661ec8b7801f58b848f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7585dade8a9939b71abc28afe32f1412

SHA1
9360961ce86699dec8d5b76dc2e5361314c89c2b

SHA256
51e7d6b4ef883c869b1d5bfd86c1d4583272ed3b69aa49f1738713a9d8a34ad6

SHA512
8dd1175e503d3922faf993a5c97c3d9ebe3b70406c594ee1e55f34b8e2f1b52d73f149aa99639e22d7cfcf8c5f91f41f5d22219f60accccf06fb50c2f6e738a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c6dc26d5f7d7a06ca2987f9d158434e2

SHA1
55eef293367d6d7c2b4678c24908913b1125e511

SHA256
a6c6655bf7d8bfb9a634f5b7bc2a5038b2d95162caccba4393b71291181b7607

SHA512
ff95066edaea8d017c65cc3093f8b5e1b743a405abe4049de673001f44fc6b86858ce131bff5b205e2205859257dc5c7c8a6ec500cbe851068cb8983ce95acd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
75043ed5c7c50809c3087c078cd17de7

SHA1
a84211391d0d5098e4482c229b962892bb8bfb3f

SHA256
724fe271d8561b7892b134a6069711881266e0dbf76d2d1c66b61821e8680ee6

SHA512
7492503095104851342a4ce292a8a3aa6df7348a36f511c76cfb78977c3d58fbcb10f379821696c383ab347c0dcaadc83361504c74f9cf6a325b6ed5eb5bf238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17ea263ce8c38396c330fd30047d0522

SHA1
65304731eecbe75dd17c1bafbcc48dbf25e17eb7

SHA256
e82e800314f4323137889614c5094bd5005946be034263b84ca957a992b099e8

SHA512
0799a50c0c6fe5eeca124395e57b38da73ae57554fa0063beb720bba8116e256f91f86c9138e452541e1672b349a4eb4154b3787dda67d481a6f67c97c336eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cdcbefa35d50716aa0ecc9dde5aeecd0

SHA1
1295b48f89518c5603d7e20ced808cb6f92e5916

SHA256
7c7e8fef645249b4f3a2976f83d058447a87184af57b94a9805c7155d59dd57c

SHA512
758467bbc503d14948d162449667fe43ceb161f85faefb3785d989f91c557b01f4f15a551ce0d2ad37f5ef5bff3e38e8eebd82041919ecb15628d73f84bb68f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\52.exe

Filesize
41KB

MD5
ea9a810f7368f48111f29b0ce79d875b

SHA1
c0ae2b564115a0487e2ea39046777a9013c52b98

SHA256
4e21ba88e33d63d676c0e447670d20ee4121d7153f2e13f1664fd863115a6bdc

SHA512
1e59ff6ec3f35f9329336ba3711e13d6fef22761803c2f217f48f25132083ba37c99f38b0418d6220c8bac2edd0dc988068bbd28882c17e9b60affe5a543cbf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\DeadCodeLauncher.exe

Filesize
21.7MB

MD5
83c53c505565b7b55eaf09babbc6b539

SHA1
b2bd6132e9e8aff4e04fb46f6acebf93ff48e41f

SHA256
244fbb26b47effaadab2bdcd6907827ffd0b294a8a5f9473f88170bc03904354

SHA512
31188502dc7bc0234a7f7eb91f8ba2069dbe964a90a6328acfbe0c4c50f53b56651938487acf300d83129bf8aed873f93ee73d503caa9ff30e6d781f184beb51

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5olp01sa.wkl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

Filesize
771B

MD5
77eb3fba98f456bbb3f83e0f9bf2f757

SHA1
7692102149d5c5d2dd73458b7528b4cdc8b4df42

SHA256
8121c4a2ef138d4f558f862d9782da904b000b793e57f69b1346f2e3033b5075

SHA512
7df1f25483d878d1473f7a8ce5e30d0823b538739a2e2b95c8be8de70def2112003abed6b36ad3b434a96bb7f7d245b87cba2ebe23afcdaa9c8a0bc915a38e1e

Download Submit
C:\Users\Admin\Desktop\DeadCodeLauncher.exe

Filesize
21.4MB

MD5
4a10260e0877a388c779740a050cf77d

SHA1
a06077b7870d659d929e9d8773925bf11ee7fea6

SHA256
1d709aaeceacba216e1111fe9d63b3ce64d68db3b83254c6ab4e7914d0d889ff

SHA512
00c9506e56580f8c02b392ad9b812ec02a7122b7e890ee5b8a38a778086167fcbb51e965a1714e06f5e524044ebcc1bc47d21994ec15bfc096fa66582c58d9d1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 949607.crdownload

Filesize
21.4MB

MD5
277f765d1fdd77a34e2f038e2a636892

SHA1
614c81533ec9b3eea3f3d736a9e118585d33ac75

SHA256
f7a878e766abcd2fc993c6df249663de3688dc6f9ea32fb55b81a3840c318f3b

SHA512
cfc280818f350d1d9fb5b516d24d109c1c3f38c631e09ebbbd7ee2982f2465e2f7803224f29c72974db8f06e2286db91596b8c7093fe7b37b587deae4e1c1e9c

Download Submit
memory/1876-445-0x00000181E37A0000-0x00000181E37A1000-memory.dmp

Filesize
4KB

Download
memory/1876-451-0x00000181E37A0000-0x00000181E37A1000-memory.dmp

Filesize
4KB

Download
memory/1876-452-0x00000181E37A0000-0x00000181E37A1000-memory.dmp

Filesize
4KB

Download
memory/1876-453-0x00000181E37A0000-0x00000181E37A1000-memory.dmp

Filesize
4KB

Download
memory/1876-454-0x00000181E37A0000-0x00000181E37A1000-memory.dmp

Filesize
4KB

Download
memory/1876-447-0x00000181E37A0000-0x00000181E37A1000-memory.dmp

Filesize
4KB

Download
memory/1876-446-0x00000181E37A0000-0x00000181E37A1000-memory.dmp

Filesize
4KB

Download
memory/2644-344-0x00000000000C0000-0x0000000001626000-memory.dmp

Filesize
21.4MB

Download
memory/2788-434-0x000001B2A9800000-0x000001B2A9822000-memory.dmp

Filesize
136KB

Download
memory/3324-424-0x0000015CBA9B0000-0x0000015CBA9CA000-memory.dmp

Filesize
104KB

Download
memory/3324-410-0x0000015CBA920000-0x0000015CBA9AA000-memory.dmp

Filesize
552KB

Download
memory/3324-404-0x0000015CBA890000-0x0000015CBA91F000-memory.dmp

Filesize
572KB

Download
memory/3324-402-0x0000015CBAC70000-0x0000015CBB0BE000-memory.dmp

Filesize
4.3MB

Download
memory/3324-382-0x00007FFCBF1D0000-0x00007FFCBF1D2000-memory.dmp

Filesize
8KB

Download
memory/3324-389-0x00007FFCBF240000-0x00007FFCBF242000-memory.dmp

Filesize
8KB

Download
memory/3324-388-0x00007FFCBF230000-0x00007FFCBF232000-memory.dmp

Filesize
8KB

Download
memory/3324-386-0x00007FFCBF210000-0x00007FFCBF212000-memory.dmp

Filesize
8KB

Download
memory/3324-385-0x00007FFCBF200000-0x00007FFCBF202000-memory.dmp

Filesize
8KB

Download
memory/3324-384-0x00007FFCBF1F0000-0x00007FFCBF1F2000-memory.dmp

Filesize
8KB

Download
memory/3324-383-0x00007FFCBF1E0000-0x00007FFCBF1E2000-memory.dmp

Filesize
8KB

Download
memory/3324-396-0x0000015CBAC70000-0x0000015CBB0BE000-memory.dmp

Filesize
4.3MB

Download
memory/3324-395-0x0000015CBAA00000-0x0000015CBAC63000-memory.dmp

Filesize
2.4MB

Download
memory/3324-390-0x0000015CBAA00000-0x0000015CBAC63000-memory.dmp

Filesize
2.4MB

Download
memory/3324-381-0x00007FFCBF1C0000-0x00007FFCBF1C2000-memory.dmp

Filesize
8KB

Download
memory/3324-380-0x00007FFCBF1B0000-0x00007FFCBF1B2000-memory.dmp

Filesize
8KB

Download
memory/3324-425-0x00007FF729130000-0x00007FF72BD67000-memory.dmp

Filesize
44.2MB

Download
memory/3324-416-0x0000015CBA9B0000-0x0000015CBA9CA000-memory.dmp

Filesize
104KB

Download
memory/3324-422-0x0000015CBA920000-0x0000015CBA9AA000-memory.dmp

Filesize
552KB

Download
memory/3324-423-0x0000015CBA890000-0x0000015CBA91F000-memory.dmp

Filesize
572KB

Download
memory/3324-403-0x0000015CBAC70000-0x0000015CBB0BE000-memory.dmp

Filesize
4.3MB

Download
memory/3324-387-0x00007FFCBF220000-0x00007FFCBF222000-memory.dmp

Filesize
8KB

Download
memory/3324-376-0x00007FFCBF170000-0x00007FFCBF172000-memory.dmp

Filesize
8KB

Download
memory/3324-372-0x00007FFCBF130000-0x00007FFCBF132000-memory.dmp

Filesize
8KB

Download
memory/3324-373-0x00007FFCBF140000-0x00007FFCBF142000-memory.dmp

Filesize
8KB

Download
memory/3324-374-0x00007FFCBF150000-0x00007FFCBF152000-memory.dmp

Filesize
8KB

Download
memory/3324-375-0x00007FFCBF160000-0x00007FFCBF162000-memory.dmp

Filesize
8KB

Download
memory/3324-377-0x00007FFCBF180000-0x00007FFCBF182000-memory.dmp

Filesize
8KB

Download
memory/3324-378-0x00007FFCBF190000-0x00007FFCBF192000-memory.dmp

Filesize
8KB

Download
memory/3324-379-0x00007FFCBF1A0000-0x00007FFCBF1A2000-memory.dmp

Filesize
8KB

Download
memory/3580-356-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download