xworm | a6382c10dfd269e3315fe4cdfb158c00aea1a179450cf3d3b633acf7e2123d74

Analysis

max time kernel
90s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2025, 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vt0.msi
Size

39.9MB
MD5

58729f548d660722ab09292e15a0fe45
SHA1

8a29bb19fd4f42fc4ef1af32d65265fb152b6f99
SHA256

a6382c10dfd269e3315fe4cdfb158c00aea1a179450cf3d3b633acf7e2123d74
SHA512

fa75ab3e28d829f39b14fd9e490d7247e102a81ff668468bd44cfc9c553e1f44d7df9d71d8e4517cdd086e23bae192ee1cad0ca96c57f465c4e8dc4ee539e0e2
SSDEEP

786432:CueucOCp8Ax4Hl/wBg1z9/XUbEBWExPRXG5pYolpXOUGPY9E9jzfGnHvga4I8Q:Cue3NpJx4tRz9CoPRXWYHHNJbGnP

Score

10^/10

xworm defense_evasion discovery execution persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

154.197.33.29:7000

Mutex

3MKBwUt55yRv3NZh

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4356-92-0x000002239EEF0000-0x000002239EEFE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2708	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Firefox-latest\Firefox-latest\wininstall.exe	msiexec.exe
File created	C:\Program Files (x86)\Firefox-latest\Firefox-latest\资源之家（无限宇宙壁纸） (64).jpg	msiexec.exe
File created	C:\Program Files (x86)\Firefox-latest\Firefox-latest\Firefox-latest.exe	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e592e69.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592e69.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FC2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3AFE6004-D57B-4344-AF45-6FFD508C370D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3273.tmp	msiexec.exe
File created	C:\Windows\Installer\e592e6b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F15.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI31B7.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4484	MSI3273.tmp
4356	wininstall.exe

Loads dropped DLL 12 IoCs

pid	Process
2072	MsiExec.exe
2072	MsiExec.exe
2072	MsiExec.exe
2072	MsiExec.exe
2072	MsiExec.exe
2072	MsiExec.exe
2072	MsiExec.exe
2072	MsiExec.exe
516	MsiExec.exe
516	MsiExec.exe
2072	MsiExec.exe
2072	MsiExec.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
4484	MSI3273.tmp

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
464	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0F57F10184F7FB449B27A9207CA599AB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4006EFA3B75D4434FA54F6DF05C873D0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4006EFA3B75D4434FA54F6DF05C873D0\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\ProductName = "Firefox-latest"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\PackageCode = "37D42E4DAE82B2E48A5E1D5827AC642A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\Language = "2052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0F57F10184F7FB449B27A9207CA599AB\4006EFA3B75D4434FA54F6DF05C873D0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\SourceList\PackageName = "vt0.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4006EFA3B75D4434FA54F6DF05C873D0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
840	msiexec.exe
840	msiexec.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	464	msiexec.exe
Token: SeIncreaseQuotaPrivilege	464	msiexec.exe
Token: SeSecurityPrivilege	840	msiexec.exe
Token: SeCreateTokenPrivilege	464	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	464	msiexec.exe
Token: SeLockMemoryPrivilege	464	msiexec.exe
Token: SeIncreaseQuotaPrivilege	464	msiexec.exe
Token: SeMachineAccountPrivilege	464	msiexec.exe
Token: SeTcbPrivilege	464	msiexec.exe
Token: SeSecurityPrivilege	464	msiexec.exe
Token: SeTakeOwnershipPrivilege	464	msiexec.exe
Token: SeLoadDriverPrivilege	464	msiexec.exe
Token: SeSystemProfilePrivilege	464	msiexec.exe
Token: SeSystemtimePrivilege	464	msiexec.exe
Token: SeProfSingleProcessPrivilege	464	msiexec.exe
Token: SeIncBasePriorityPrivilege	464	msiexec.exe
Token: SeCreatePagefilePrivilege	464	msiexec.exe
Token: SeCreatePermanentPrivilege	464	msiexec.exe
Token: SeBackupPrivilege	464	msiexec.exe
Token: SeRestorePrivilege	464	msiexec.exe
Token: SeShutdownPrivilege	464	msiexec.exe
Token: SeDebugPrivilege	464	msiexec.exe
Token: SeAuditPrivilege	464	msiexec.exe
Token: SeSystemEnvironmentPrivilege	464	msiexec.exe
Token: SeChangeNotifyPrivilege	464	msiexec.exe
Token: SeRemoteShutdownPrivilege	464	msiexec.exe
Token: SeUndockPrivilege	464	msiexec.exe
Token: SeSyncAgentPrivilege	464	msiexec.exe
Token: SeEnableDelegationPrivilege	464	msiexec.exe
Token: SeManageVolumePrivilege	464	msiexec.exe
Token: SeImpersonatePrivilege	464	msiexec.exe
Token: SeCreateGlobalPrivilege	464	msiexec.exe
Token: SeCreateTokenPrivilege	464	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	464	msiexec.exe
Token: SeLockMemoryPrivilege	464	msiexec.exe
Token: SeIncreaseQuotaPrivilege	464	msiexec.exe
Token: SeMachineAccountPrivilege	464	msiexec.exe
Token: SeTcbPrivilege	464	msiexec.exe
Token: SeSecurityPrivilege	464	msiexec.exe
Token: SeTakeOwnershipPrivilege	464	msiexec.exe
Token: SeLoadDriverPrivilege	464	msiexec.exe
Token: SeSystemProfilePrivilege	464	msiexec.exe
Token: SeSystemtimePrivilege	464	msiexec.exe
Token: SeProfSingleProcessPrivilege	464	msiexec.exe
Token: SeIncBasePriorityPrivilege	464	msiexec.exe
Token: SeCreatePagefilePrivilege	464	msiexec.exe
Token: SeCreatePermanentPrivilege	464	msiexec.exe
Token: SeBackupPrivilege	464	msiexec.exe
Token: SeRestorePrivilege	464	msiexec.exe
Token: SeShutdownPrivilege	464	msiexec.exe
Token: SeDebugPrivilege	464	msiexec.exe
Token: SeAuditPrivilege	464	msiexec.exe
Token: SeSystemEnvironmentPrivilege	464	msiexec.exe
Token: SeChangeNotifyPrivilege	464	msiexec.exe
Token: SeRemoteShutdownPrivilege	464	msiexec.exe
Token: SeUndockPrivilege	464	msiexec.exe
Token: SeSyncAgentPrivilege	464	msiexec.exe
Token: SeEnableDelegationPrivilege	464	msiexec.exe
Token: SeManageVolumePrivilege	464	msiexec.exe
Token: SeImpersonatePrivilege	464	msiexec.exe
Token: SeCreateGlobalPrivilege	464	msiexec.exe
Token: SeCreateTokenPrivilege	464	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	464	msiexec.exe
Token: SeLockMemoryPrivilege	464	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
464	msiexec.exe
464	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2072	840	msiexec.exe	89
PID 840 wrote to memory of 2072	840	msiexec.exe	89
PID 840 wrote to memory of 2072	840	msiexec.exe	89
PID 840 wrote to memory of 516	840	msiexec.exe	102
PID 840 wrote to memory of 516	840	msiexec.exe	102
PID 840 wrote to memory of 516	840	msiexec.exe	102
PID 840 wrote to memory of 4484	840	msiexec.exe	103
PID 840 wrote to memory of 4484	840	msiexec.exe	103
PID 2072 wrote to memory of 4356	2072	MsiExec.exe	104
PID 2072 wrote to memory of 4356	2072	MsiExec.exe	104
PID 4356 wrote to memory of 1576	4356	wininstall.exe	105
PID 4356 wrote to memory of 1576	4356	wininstall.exe	105
PID 4356 wrote to memory of 2708	4356	wininstall.exe	107
PID 4356 wrote to memory of 2708	4356	wininstall.exe	107
PID 4356 wrote to memory of 1640	4356	wininstall.exe	109
PID 4356 wrote to memory of 1640	4356	wininstall.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\vt0.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:464

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 58273DAC7768D2F20BFC21689F075456 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Program Files (x86)\Firefox-latest\Firefox-latest\wininstall.exe
    "C:\Program Files (x86)\Firefox-latest\Firefox-latest\wininstall.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /Query /TN SysMaintenanceService
      4⤵
      PID:1576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Program Files (x86)\\Firefox-latest\\Firefox-latest\\wininstall.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon -User 'Admin'; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit (New-TimeSpan -Minutes 0) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -RunOnlyIfNetworkAvailable; $principal = New-ScheduledTaskPrincipal -UserId 'Admin' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -TaskName 'SysMaintenanceService' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2708
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /Query /TN SysMaintenanceService
      4⤵
      PID:1640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4C0F6A09A6E8802DBB724C131CC920C7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:516
- C:\Windows\Installer\MSI3273.tmp
  "C:\Windows\Installer\MSI3273.tmp" /EnforcedRunAsAdmin /DontWait /RunAsAdmin "C:\Program Files (x86)\Firefox-latest\Firefox-latest\Firefox-latest.exe"
  2⤵
  - Executes dropped EXE
  - Access Token Manipulation: Create Process with Token
  PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e592e6a.rbs

Filesize
8KB

MD5
b03be0a96fe02f35c5067371ebaf2de3

SHA1
0d24a449f25cd9c7478c8cf28f12edcf112f8fb3

SHA256
8fa5d18ef0fd32d40796340e251252b00bdb6a19854676cc74cde991cdd6e214

SHA512
a17ed64ed003cbbc7ae64484664d3790773bd3b624898efeb816bf851565c7cf0b31250f8c623e6881a3131e629a67d6dee96e78834ac1790f3d556bd7836947

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5493.tmp

Filesize
381KB

MD5
891de63dad09d3f100263727297e9205

SHA1
aeb1c23ab5014dca9d5208afe96585b40ac2a27e

SHA256
96513f32d35ccdc3fe50eee2ee7b30836d1e5f09f73c13f151f13091464e0b50

SHA512
f517dfecf4d89ed140a9e31ab6e02da64d32070660494f18ea3d8a62228c30d89822e24a86ff0112d42a8b5cb90bb5e4d3e34e83697cf4cca7224a24fe2c45e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI57E4.tmp

Filesize
828KB

MD5
7f335df3a986fe5e0ee5d482f309aea6

SHA1
919c0c558eacc6ec0eefb053143034ebddc62aaf

SHA256
f9b5641d0c863da052f8a42c075cc006768fcee9c67e6721571a795c25f42746

SHA512
e18b68865514a03b52a3a76ffba62884ed10f0443774dd1647f8ecde71117fd5fbd9cc377a9a3c777366b205f8a88f9f9b4aa32df2ccdf26f0110d06253678e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4qiqi2a.suz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Installer\MSI3273.tmp

Filesize
517KB

MD5
028c9c708d810aba9603b63a8283d014

SHA1
ed4724e84c4ceb6a1619d34cc06369a1ab4d3d7d

SHA256
67504c94e46e70980cc5bbc0ea926e01fbd6116560304029261e2455004dc098

SHA512
9262da976a064732f8d12301d178d65d6df90c195937ff6e882c9de781d2ecabc3594cd71a1490b5c69b1c85da3c8bac8e4cee080f1055bcf51e50318f9e8d5f

Download Submit
C:\Windows\Installer\e592e69.msi

Filesize
39.9MB

MD5
58729f548d660722ab09292e15a0fe45

SHA1
8a29bb19fd4f42fc4ef1af32d65265fb152b6f99

SHA256
a6382c10dfd269e3315fe4cdfb158c00aea1a179450cf3d3b633acf7e2123d74

SHA512
fa75ab3e28d829f39b14fd9e490d7247e102a81ff668468bd44cfc9c553e1f44d7df9d71d8e4517cdd086e23bae192ee1cad0ca96c57f465c4e8dc4ee539e0e2

Download Submit
memory/2708-84-0x0000020BF34A0000-0x0000020BF34C2000-memory.dmp

Filesize
136KB

Download
memory/4356-91-0x000002239D660000-0x000002239D670000-memory.dmp

Filesize
64KB

Download
memory/4356-92-0x000002239EEF0000-0x000002239EEFE000-memory.dmp

Filesize
56KB

Download
memory/4356-93-0x00007FF77AA90000-0x00007FF77FD6E000-memory.dmp

Filesize
82.9MB

Download